Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for "security audit", "check for vulnerabilities", "security review", or "are we secure".
Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to "harden this", "add security to this service", "what security do I need", or "secure this before launch".
Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to "set up IAM", "create roles", "service accounts", or "access control".
Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when asked about "security posture", "how secure is this", or "security assessment".
Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wise", "map our attack surface", or before designing any security-sensitive feature.
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Engineering + product, second to none.
Your elite AI team as Claude Code agents. 2 leads + 21 specialists. 125 skills. Every major engineering and product discipline covered.
Simple by default. Scalable by design.
Right now, everyone gets a generalized AI assistant. Engineers, product managers, designers, strategists — all prompting separately, getting separate outputs, then copying results into Slack threads for the next person to feed back into AI. It's a relay race where every handoff loses context.
That's the wrong unit of automation. Instead of giving each person an AI assistant, give the whole company an AI team. Specialists that talk to each other, share context, and run the show end to end — from user research to infrastructure to deployment — without the copy-paste relay.
That's Tonone. Not twenty-three copies of the same generalist. Twenty-three specialists, each owning one domain, coordinated by leads who know when to call who and at what depth.
Complexity is debt. Every unnecessary abstraction, every over-engineered solution, every "just in case" feature — it all accrues interest. It slows you down today and buries you tomorrow.
Scalability compounds. When you build simple, correct foundations, they carry more weight over time without breaking. Simple systems are easier to debug, easier to extend, and easier to hand off.
No boilerplate generators. No tutorial-grade scaffolds. Production-ready output that respects your codebase, your stack, and your time.
| Agent | Hat | What They Do |
|---|---|---|
| Apex | Engineering Lead | Orchestrates the team, scopes work, controls depth and budget |
| Forge | Infrastructure | Cloud services, networking, IaC, cost optimization |
| Relay | DevOps | CI/CD, deployments, GitOps, developer experience |
| Spine | Backend | APIs, system design, performance, distributed systems |
| Flux | Data | Databases, migrations, pipelines, data modeling |
| Warden | Security | IAM, secrets, compliance, threat modeling |
| Vigil | Observability + Reliability | Monitoring, alerting, SRE, incident response, SLOs |
| Prism | Frontend/DX | UI, internal tools, developer portals |
| Cortex | ML/AI | Model training, MLOps, feature engineering, LLM integration |
| Touch | Mobile | Native iOS/Android, cross-platform, app stores |
| Volt | Embedded/IoT | Firmware, microcontrollers, edge computing, protocols |
| Atlas | Knowledge Engineering | Architecture docs, ADRs, API specs, system diagrams |
| Lens | Data Analytics & BI | Dashboards, metrics design, reporting, data storytelling |
| Proof | QA & Testing | Test strategy, E2E suites, integration testing, flaky triage |
| Pave | Platform Engineering | Developer experience, golden paths, service catalogs |
| Agent | Hat | What They Do |
|---|---|---|
| Helm | Head of Product | Orchestrates the product team, writes briefs, hands off to Apex |
| Echo | User Research | User interviews, personas, Jobs-to-Be-Done, feedback synthesis |
| Lumen | Product Analytics | Metrics frameworks, funnel analysis, OKRs, A/B test design |
| Draft | UX Design | User flows, information architecture, wireframes |
| Form | Visual Design | Brand identity, color systems, typography, design system |
| Crest | Product Strategy | Roadmap planning, prioritization, competitive analysis |
| Pitch | Product Marketing | Positioning, messaging, value prop, GTM, launch copy |
| Surge | Growth | Acquisition channels, activation funnels, retention playbooks |
Prerequisites: Claude Code v1.0+
/plugin marketplace add tonone-ai/tonone
/plugin install tonone@tonone-ai
Then just talk to them:
npx claudepluginhub tonone-ai/tonone --plugin wardenEngineering + Product + Operations + Legal + Design + Data Science + Security Operations + Developer Experience + Infrastructure Specialist + AI Operations team — 100 agents as Claude Code specialists. Infrastructure, DevOps, backend, security, ML/AI, mobile, UX, analytics, growth, revenue, content, PR, customer success, finance, people, operations, support, contracts, compliance, IP, governance, regulatory, color systems, typography, motion, accessibility, design tokens, forecasting, feature engineering, model training, drift monitoring, vector search, LLM fine-tuning, pen testing, detection engineering, incident response, zero trust, API docs, SDK design, developer onboarding, Kubernetes, Terraform, FinOps, service mesh, edge computing, caching, queuing, multi-cloud, chaos engineering, model deployment, LLM evaluation, AI observability, guardrails, prompt engineering, embeddings, ranking, and more.
UX designer — user flows, information architecture, wireframes, and interaction design
Backend engineer — APIs, system design, performance, distributed systems
Platform engineer — developer experience, service catalogs, internal CLIs, golden paths, environment management
Growth engineer — acquisition channels, activation funnels, retention playbooks, and PLG strategy
Infrastructure engineer — cloud services, networking, IaC, cost optimization
Research-backed, opinionated guidance for building cloud infrastructure that doesn't rot — multi-account governance, naming conventions, IaC organization, security, deployment pipelines, and operational hygiene, distilled from production experience across multiple cloud migrations
Cloud and infrastructure security including cloud posture assessment, network segmentation, container security, Kubernetes hardening, IAM policy design, and zero-trust architecture.
Use this agent when you need to design scalable architecture and folder structures for new features or projects. Examples include: when starting a new feature module, refactoring existing code organization, planning microservice boundaries, designing component hierarchies, or establishing project structure conventions. For example: user: 'I need to add a user authentication system to my app' -> assistant: 'I'll use the code-architect agent to design the architecture and folder structure for your authentication system' -> <uses agent>. Another example: user: 'How should I organize my e-commerce product catalog feature?' -> assistant: 'Let me use the code-architect agent to design a scalable structure for your product catalog' -> <uses agent>.
Security agents — security, compliance, privacy specialists
Harness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses