By metraton
Security-first orchestrator with specialized agents, hooks, and governance for AI coding
Agents are the specialists of Gaia. Each one has a narrow domain, a set of allowed tools, and a list of skills that get injected at startup. The orchestrator never does domain work itself — it reads the user's intent, picks the right agent, and dispatches it. What comes back is a `agent_contract_handoff` block with findings, changes, and a verification result.
Use when inspecting, diagnosing, or validating the actual state of running systems — pods, services, logs, cloud resources, network connectivity, SSH access — or when comparing what IS running against what SHOULD be running (drift between live state and IaC/desired-state).
Use when writing, modifying, debugging, or reviewing application code, CI/CD pipelines, or developer tooling — or when investigating an application-layer bug or behavior.
Use for personal-workspace tasks — curating Gaia memory, organizing or moving workspace files, web research and summarization, Gmail triage, and loading on-demand integration skills
Use when a user prompt arrives in Gaia and needs to be routed — when intent must be matched to a specialist surface, when multiple surfaces touch the same question, when an approval or pending grant must be presented for informed consent, or when conversational synthesis must weave specialist contracts into strategy
Use when constructing or interpreting the approval handoff envelope between subagent and orchestrator -- sealed_payload schema, approval_id format, APPROVAL_REQUEST contract shape, and reading a granted approval from the DB
Use when you need the exact field schema, required/conditional/optional status, or the trigger for any field of the agent_contract_handoff envelope -- input or output, top-level field, sub-field table, plan_status enum, or the JSON-not-YAML rule
Use when creating a new specialist agent for Gaia, or reviewing whether an existing agent follows the correct structure, tone, and component inventory
Use when producing any agent response
Use when an agent returns an agent_contract_handoff response that needs to be interpreted and presented to the user
Executes bash commands
Hook triggers when Bash tool is used
Modifies files
Hook triggers on file write and edit operations
Uses power tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Uses Bash, Write, or Edit tools
Uses Bash, Write, or Edit tools
General Agentic Integration Architecture
Gaia is event-driven. Every capability in the codebase is attached to a moment in the Claude Code lifecycle — a prompt arriving, a tool being called, an agent completing. Reading the folder structure without that lens makes it look like a collection of files. Reading it with that lens, everything clicks into place.
The flow is this: a user sends a prompt, the UserPromptSubmit hook fires and injects the orchestrator's identity and a routing recommendation. The orchestrator picks a specialist agent and dispatches it. Before that agent's first tool call lands, the PreToolUse hook intercepts it — injecting context, validating permissions, blocking dangerous commands. The agent does its work and returns a agent_contract_handoff. The SubagentStop hook fires, validates the contract, records metrics, and writes to episodic memory.
UserPromptSubmit -> routing -> PreToolUse -> agent -> PostToolUse -> SubagentStop
| | | | | |
identity surface- security agent_contract_handoff audit log metrics +
injection routing.json gate + memory
context
injection
That pipeline is the spine. Everything else in this repo is either a component of that pipeline (hooks/, agents/, skills/, config/) or infrastructure that supports it (build/, bin/, tests/). Start with the folder that matches the behavior you want to understand, and its README will tell you where it fits in the flow.
Gaia is a multi-agent orchestration system for DevOps automation. It ships two sub-plugins — gaia-ops (full orchestrator) and gaia-security (security-only) — with security-first command classification, specialized AI agents, and plugin-based distribution. Currently integrates with Claude Code.
agents/gaia-orchestrator.md, activated via settings.json agent config; skills loaded on-demandbash -c, eval, python -c wrappers that bypass regex patternsask dialoggaia memory CLI with FTS5 search, episode inspection, and session context orientation# Add the marketplace
/plugin marketplace add metraton/gaia
# Install the full system (includes security)
/plugin install gaia-ops
# Or install security only
/plugin install gaia-security # Security hooks only
npm install @jaguilar87/gaia
The npm install postinstall script bootstraps the database, creates .claude/, writes symlinks, and registers the plugin. Run gaia doctor afterward to verify.
# Install and bootstrap (postinstall does the rest)
npm install @jaguilar87/gaia
# Or install globally
npm install -g @jaguilar87/gaia
The postinstall hook does everything automatically. To scan your project stack after install:
gaia scan
gaia install (run by postinstall) will:
~/.gaia/gaia.db) with the current schema.claude/ directory with symlinks to this packagesettings.local.json (preserves existing user config)plugin-registry.jsonnpx claudepluginhub metraton/gaiaKeeps you in the loop only when it matters. Gaia Security analyzes every command and classifies it into risk tiers: read-only queries run freely, simulations and validations pass through, and state-changing operations (create, delete, apply, push) pause for your explicit approval before executing. Irreversible commands like dropping databases or deleting cloud infrastructure are permanently blocked.
Full DevOps orchestration for Claude Code. Eight specialized agents handle the complete development lifecycle — analysis, planning, execution, and deployment. Gaia-Ops scans your codebase to understand it and injects the right context into each sub-agent. Every command is classified by risk: read-only runs freely, state changes pause for your approval, and irreversible operations are permanently blocked.
Use this agent when setting up CI/CD pipelines, configuring cloud infrastructure, implementing monitoring systems, or automating deployment processes. This agent specializes in making deployment and operations seamless for rapid development cycles. Examples:\n\n<example>\nContext: Setting up automated deployments\nuser: "We need automatic deployments when we push to main"\nassistant: "I'll set up a complete CI/CD pipeline. Let me use the devops-automator agent to configure automated testing, building, and deployment."\n<commentary>\nAutomated deployments require careful pipeline configuration and proper testing stages.\n</commentary>\n</example>\n\n<example>\nContext: Infrastructure scaling issues\nuser: "Our app crashes when we get traffic spikes"\nassistant: "I'll implement auto-scaling and load balancing. Let me use the devops-automator agent to ensure your infrastructure handles traffic gracefully."\n<commentary>\nScaling requires proper infrastructure setup with monitoring and automatic responses.\n</commentary>\n</example>\n\n<example>\nContext: Monitoring and alerting setup\nuser: "We have no idea when things break in production"\nassistant: "Observability is crucial for rapid iteration. I'll use the devops-automator agent to set up comprehensive monitoring and alerting."\n<commentary>\nProper monitoring enables fast issue detection and resolution in production.\n</commentary>\n</example>
Deployment engineering with Terraform and infrastructure as code
Cloud infrastructure agents — cloud, container, SRE specialists
Infrastructure maintenance with security audits and update management
DevOps, cloud, and deployment specialists - Kubernetes, Terraform, AWS, Azure, GCP, and SRE
Plugin-first Claude Code workflows with planning, CI/CD debugging, reusable agents, TODOs, and MCP safety policies.