By fusengine
Detect and remediate security vulnerabilities using OWASP Top 10, SAST scanning, CVE research, dependency audits, and secrets detection, with automated Python testing after each edit.
Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities.
Research CVEs and security advisories for project dependencies. Uses Exa, NVD API, OSV.dev, and GitHub Advisory Database to find known vulnerabilities.
Audit project dependencies for known vulnerabilities using ecosystem-specific tools (npm audit, composer audit, pip-audit, cargo audit, etc).
Verify and configure HTTP security headers (CSP, HSTS, CORS, X-Frame-Options, etc). Checks current configuration and generates framework-specific fixes.
Main security scanning orchestration. Detects language, runs OWASP Top 10 patterns, identifies vulnerabilities, generates structured reports. Use when scanning for XSS, SQL injection, command injection, secrets, or any security vulnerability.
Modifies files
Hook triggers on file write and edit operations
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
A plugin ecosystem that turns Claude Code into a supervised, multi-agent development environment. Expert agents write code, hooks enforce quality in real-time, skills inject framework-specific knowledge, and intelligent cartography auto-maps plugins and projects — so Claude never guesses, never duplicates, and always follows your architecture.

Without plugins: Claude Code writes code based on its training data. It can hallucinate APIs, duplicate existing code, ignore your project structure, and produce inconsistent quality.
With Fusengine plugins:
# Add marketplace
/plugin marketplace add fusengine/agents
# Install all plugins
/plugin install fuse-ai-pilot fuse-commit-pro fuse-laravel fuse-nextjs fuse-react fuse-astro fuse-swift-apple-expert fuse-solid fuse-tailwindcss fuse-design fuse-prompt-engineer fuse-shadcn-ui fuse-security fuse-changelog
# Setup (hooks + API keys + MCP servers)
~/.claude/plugins/marketplaces/fusengine-plugins/setup.sh # macOS / Linux
~\.claude\plugins\marketplaces\fusengine-plugins\setup.ps1 # Windows
Statusline (optional):
bun --cwd ~/.claude/plugins/marketplaces/fusengine-plugins/plugins/core-guards/statusline run config
User prompt → Hook detects project type → Expert agent activated
→ Hook loads SOLID references → Agent reads docs via MCP
→ Hook blocks if DRY violation → Agent writes code
→ Hook checks file size → Sniper validates quality
→ Hook blocks secrets → Commit with version bump
Every step is intercepted. Claude cannot skip research, cannot duplicate code, cannot exceed file size limits, and cannot commit without security validation.
Each plugin provides an expert agent that auto-activates when it detects the framework in your project. The agent has access to official documentation via MCP servers and follows SOLID principles enforced by hooks.
| Plugin | Detects | What the agent does |
|---|---|---|
| fuse-nextjs | next.config.* | App Router, RSC, Prisma 7, Better Auth, proxy.ts patterns |
| fuse-laravel | composer.json + artisan | Eloquent, Livewire, Blade, queues, Sanctum, Stripe Connect |
| fuse-react | package.json + React | React 19 hooks, TanStack Router/Form, Zustand stores |
| fuse-astro | astro.config.* | Islands, Content Layer, Actions, SEO, Starlight, i18n |
| fuse-swift-apple-expert | Package.swift | SwiftUI, concurrency, all Apple platforms (iOS → visionOS) |
| fuse-tailwindcss | tailwind.config.* | v4.1 CSS-first config, @theme, @utility, OKLCH colors |
| fuse-design | Any UI task | Gemini Design MCP + shadcn/ui + WCAG 2.2 accessibility |
| fuse-shadcn-ui | components.json | Radix/Base UI detection, registry, theming, migration |
npx claudepluginhub fusengine/agents --plugin fuse-securityExpert Prompt Engineer with Context Engineering, Meta-Prompting, Chain-of-Thought, Few-Shot, Agent Design, 50+ Template Library, and A/B Testing
Expert Tailwind CSS v4.1 - CSS-first configuration, @theme, @utility, @variant, Oxide engine 5x faster, OKLCH colors, container queries, 15 specialized skills
Expert Laravel 12 + PHP 8.5 with SOLID principles, Eloquent, Livewire, and comprehensive documentation
Expert Swift 6.2 + SwiftUI for iOS 26, macOS 26, iPadOS 26, watchOS 26, visionOS 26, tvOS 26 with Liquid Glass, @Observable, actors, SwiftData inheritance
Design Director for complete apps, sites, and SaaS. Multi-stack support (React/shadcn, Laravel/Livewire Flux, Swift/SwiftUI). Identity System, page layouts, motion system, palette generator, design audit. Anti-AI-Slop, WCAG 2.2, Gemini Design MCP.
Open-source cybersecurity analysis agent. Scans any local project for vulnerabilities: code security (SAST), dependency CVEs (SCA), secret leaks, authentication/authorization flaws, cryptographic weaknesses, misconfigurations, supply chain risks, and CI/CD security. Covers all OWASP 2025 Top 10 and CWE Top 25 categories. Generates prioritized reports with remediation guidance. Invoke with /cyber-neo [path].
Security best practices advisor with vulnerability detection and fixes
Comprehensive vulnerability scanning for code, dependencies, and configurations with CVE detection
Security scanning, dependency CVE audits, and exposure-aware risk prioritization.
Agentic-Security is a powerful Claude Code plugin that automatically performs Application Security Testing (SAST, SCA, secrets detection, and more). Think of it as the easy button for making your Claude-generated code safe and secure.
Automated OWASP security checks — Web Top 10:2025, LLM Top 10:2025, API Security Top 10:2023