By subagentceo
Operator-side IT admin plugin for GitHub-tier operations: claude-code OAuth rotation, repo→org secret promotion, secrets parity audit, branch-protection ruleset CRUD, and a security-aware linter for Claude Code Action workflows (.github/workflows/claude*.yml). Dogfoods OSEC1/OSEC2/OSEC3 (secret model), OIT1 (minter pattern), and OAUTO13 (workflow security baseline) into a single plugin that exercises the full claude-code plugin spec: skills + hooks + monitors + agents + MCP server.
Admin access level
Server config contains admin-level keywords
Modifies files
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Full CRUD over the GitHub branch protection ruleset (gh api repos/.../rulesets/<id>). Use when adding/removing required status checks, adjusting strict_required_status_checks_policy, or modifying any other ruleset parameter. The chassis ruleset id is 16440994 (from setup-branch-protection.ts).
Lints .github/workflows/claude*.yml files for the OAUTO13 security baseline derived from https://github.com/anthropics/claude-code-action/blob/main/docs/security.md. Use whenever editing claude.yml or claude-code-review.yml; this skill catches anti-patterns (wildcard allowed_bots, pull_request_target with write perms, missing @v1 pin, ANTHROPIC_API_KEY presence, etc.) at edit time instead of CI time. Also exposed as MCP tool lint_claude_action_workflow.
Re-mint CLAUDE_CODE_OAUTH_TOKEN via `claude setup-token` and dual-write to gh org + repo. Use when rotating the Claude Code OAuth token (quarterly per docs/operator-runbooks/secret-rotation.md, immediately on compromise, or when switching the active identity between admin-jadecli and alex-jadecli). Wraps the manual flow used 2026-05-18 into a reusable scaffold.
Run the OSEC1 parity verifier (npm run verify:secrets) plus a drift report by secret age. Use to confirm gh-org/repo/local plane parity and identify secrets stale enough to warrant rotation under the OSEC2 quarterly policy.
Promote a repo-scoped GitHub secret to org scope (visibility=selected). Use when a secret currently exists at gh-repo scope but is needed at gh-org for the OSEC1 parity table. Operator-paste required because the gh API is write-only on secret values.
This plugin requires configuration values that are prompted when the plugin is enabled. Sensitive values are stored in your system keychain.
gh_orgOrg for secret promotion + branch-protection ops. Defaults to subagentceo for this chassis.
${user_config.gh_org}gh_repoRepo name (without owner). Defaults to knowledge-engineering for this chassis.
${user_config.gh_repo}secret_max_age_daysSecrets older than this trigger a drift notification from the secret-age-watch monitor.
${user_config.secret_max_age_days}Hook triggers on file write and edit operations
Hook triggers on file write and edit operations
Uses power tools
Uses Bash, Write, or Edit tools
Uses power tools
Uses Bash, Write, or Edit tools
Solo-founder chassis for shipping a Claude-powered product. Multi-agent research orchestrator + 28 vendor doc mirrors + 16+ MCP tools across 5 lanes + Cloudflare Sandbox runner + Neon-branched per-PR previews. OAuth-only.
This repo is a fork-and-ship chassis, not a one-off project. The intent (per PRODUCTRD.md) is that another founder clones the repo, swaps the seed prompts and vendor list, and inherits everything else: the verify chain, the heartbeat memory layer, the auto-merge loop, the citation discipline, the operator runbooks, and the OAuth-only posture.
| Surface | What | Where |
|---|---|---|
| Orchestrator | Opus 4.7 (1M context) — 4 sub-agents over @anthropic-ai/claude-agent-sdk | src/agent/run.ts |
| MCP tools | 16+ tools across 5 lanes: engineering_*, blog_*, support_*, llms_*, vendor_* + search_tools | src/mcp/ |
| Vendor mirror | 28 vendor doc surfaces (anthropics, cloudflare, neon, stripe, twilio, workos, elevenlabs, aws, openfeature, gcp, ...) — 1,369 anthropics docs alone | vendor/ |
| Crawler | crawlee + llms.txt / html-index / sitemap.xml discovery; preflight-304 idempotency | scripts/crawl-vendors.ts |
| Worker runner | Cloudflare Sandbox + Durable Objects for per-task ephemeral execution (scaffolded) | infra/cloudflare/ |
| Neon branching | Per-PR Neon DB branches via cloudflare-preview.yml | migrations/, scripts/migrate-neon.ts |
| Frontend | outcomesdk.com Cloudflare Worker — pretext-driven SPA over vendor/ markdown | frontend/ |
| Heartbeat memory | Cross-session orchestration state | seeds/memory/heartbeat/ |
| Feature flags | OpenFeature + Cloudflare Flagship provider | src/lib/openfeature.ts |
| Plugin manifest | 3 Anthropic marketplaces (official, knowledge-work, community) | .claude/plugins.json |
unset ANTHROPIC_API_KEY # OAuth-only — fails closed if this is set
export CLAUDE_CODE_OAUTH_TOKEN=... # mint via `claude setup-token`
npm install
npm run verify # mcp + tf + citations + gates + libs + freshness + project
npm run dev "trivial test query" # local orchestrator turn
See DEVELOPER.md for the full first-time setup + day-to-day workflows.
| Doc | When to read |
|---|---|
CLAUDE.md | A Claude session starting in this repo — load-bearing context auto-loaded by claude |
DEVELOPER.md | First-time setup; adding a vendor / lane / skill / test |
RUNBOOK.md | Using Claude Opus 4.7 1M context as the web orchestrator |
CONTRIBUTING.md | Forking-founder onboarding + PR discipline |
docs/architecture.md | Runtime topology |
docs/governance.md | Branch ruleset + auto-merge state machine |
docs/security.md | OSV-Scanner dependency-vuln gate posture |
docs/context-management.md | Token counting, cache boundary, settingSources, safety hooks |
docs/CONVENTIONS.md | Outcome-driven Conventional Commits |
docs/PROJECT.md | Cowork-style project manifest |
docs/pending.md | Live action dashboard — operator + agent queue |
docs/operator-runbooks/README.md | Claude-in-Chrome operator runbooks (CF API token, GH PAT, etc.) |
PRODUCTRD.md | Chassis intent + functional requirements |
SUBPROCESSORS.md | Vendor inventory for fork-time re-evaluation |
| Lane | Source | Tools |
|---|---|---|
engineering | anthropic.com/engineering | engineering_{index,fetch,search} |
blog | claude.com/blog | blog_{index,fetch,search} |
support | support.claude.com | support_{collections,collection,article} |
llms | namespaces under *.claude.com/llms.txt, anthropic.com/llms.txt, vendor llms.txts | llms_{namespaces,fetch,grep} |
vendor | the local vendor/ mirror (28 surfaces) | vendor_{list,fetch,grep} |
Plus search_tools for progressive disclosure across the surfaces.
The full lane-to-tool map is in docs/architecture.md. Per-lane docs at docs/lanes/{engineering,blog,support,llms,vendor}/index.md.
| Sub-agent | Tools | Purpose |
|---|---|---|
npm-research | 4 npm-registry MCP tools | Primary npm data; cites registry URLs |
verifier | 12 knowledge-bridge tools (excl. vendor_*) | Independent grader vs docs/rubric.md |
crawl-curator | 3 vendor_* tools | Per-vendor crawl.json audits + drift detection |
npx claudepluginhub subagentceo/knowledge-engineering --plugin github-it-adminPer-merged-PR audit follow-up generator. Reads the session transcript at ~/.claude/projects/<dir>/<session-id>.jsonl, computes tool-call waste/latency/throughput stats for the work that landed a given PR, and emits a templated follow-up PR body plus the top 3 highest-impact findings as issue bodies. Dogfoods OAUDIT family: build-use-iterate-improve the merge process itself by surfacing where the agent wasted calls.
Code-intelligence + document tooling for mirroring HTML/PDF documentation (e.g. anthropic.com/sitemap.xml pages): HTML, TypeScript, and JavaScript language servers (VS Code's extracted servers + typescript-language-server) plus the official Model Context Protocol PDF server. Binaries are pinned as repo devDependencies and invoked via npx.
Personalized platform-engineering plugin for the operator: AlloyDB Omni install, Docker MCP profile wiring, Voyage+Turbopuffer+AlloyDB embeddings architecture, and citation/test/outcome discipline. Modeled after subagentceo/knowledge-work-plugins/cowork-plugin-management.
Operator-side IT admin plugin: scriptable CRUD over vendor API tokens for Cloudflare, Turbopuffer, Neon, Parallel.ai, and Nimbleway. Implements the OSEC3 long-lived-minter pattern with macOS keychain bootstrap. Replaces browser-click token mint flows with deterministic CLI flows that never leak secret values into agent context.
Harness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review
Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security