By subagentceo
Operator-side IT admin plugin for GitHub-tier operations: claude-code OAuth rotation, repo→org secret promotion, secrets parity audit, branch-protection ruleset CRUD, and a security-aware linter for Claude Code Action workflows (.github/workflows/claude*.yml). Dogfoods OSEC1/OSEC2/OSEC3 (secret model), OIT1 (minter pattern), and OAUTO13 (workflow security baseline) into a single plugin that exercises the full claude-code plugin spec: skills + hooks + monitors + agents + MCP server.
Based on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Full CRUD over the GitHub branch protection ruleset (gh api repos/.../rulesets/<id>). Use when adding/removing required status checks, adjusting strict_required_status_checks_policy, or modifying any other ruleset parameter. The chassis ruleset id is 16440994 (from setup-branch-protection.ts).
Lints .github/workflows/claude*.yml files for the OAUTO13 security baseline derived from https://github.com/anthropics/claude-code-action/blob/main/docs/security.md. Use whenever editing claude.yml or claude-code-review.yml; this skill catches anti-patterns (wildcard allowed_bots, pull_request_target with write perms, missing @v1 pin, ANTHROPIC_API_KEY presence, etc.) at edit time instead of CI time. Also exposed as MCP tool lint_claude_action_workflow.
Re-mint CLAUDE_CODE_OAUTH_TOKEN via `claude setup-token` and dual-write to gh org + repo. Use when rotating the Claude Code OAuth token (quarterly per docs/operator-runbooks/secret-rotation.md, immediately on compromise, or when switching the active identity between admin-jadecli and alex-jadecli). Wraps the manual flow used 2026-05-18 into a reusable scaffold.
Run the OSEC1 parity verifier (npm run verify:secrets) plus a drift report by secret age. Use to confirm gh-org/repo/local plane parity and identify secrets stale enough to warrant rotation under the OSEC2 quarterly policy.
Promote a repo-scoped GitHub secret to org scope (visibility=selected). Use when a secret currently exists at gh-repo scope but is needed at gh-org for the OSEC1 parity table. Operator-paste required because the gh API is write-only on secret values.
This plugin requires configuration values that are prompted when the plugin is enabled. Sensitive values are stored in your system keychain.
gh_orgOrg for secret promotion + branch-protection ops. Defaults to subagentceo for this chassis.
${user_config.gh_org}gh_repoRepo name (without owner). Defaults to knowledge-engineering for this chassis.
${user_config.gh_repo}secret_max_age_daysSecrets older than this trigger a drift notification from the secret-age-watch monitor.
${user_config.secret_max_age_days}Admin access level
Server config contains admin-level keywords
Modifies files
Hook triggers on file write and edit operations
Uses power tools
Uses Bash, Write, or Edit tools
Solo-founder chassis for shipping a Claude-powered product. Multi-agent research orchestrator + 28 vendor doc mirrors + 16+ MCP tools across 5 lanes + Cloudflare Sandbox runner + Neon-branched per-PR previews. OAuth-only.
This repo is a fork-and-ship chassis, not a one-off project. The intent (per PRODUCTRD.md) is that another founder clones the repo, swaps the seed prompts and vendor list, and inherits everything else: the verify chain, the heartbeat memory layer, the auto-merge loop, the citation discipline, the operator runbooks, and the OAuth-only posture.
| Surface | What | Where |
|---|---|---|
| Orchestrator | Opus 4.7 (1M context) — 4 sub-agents over @anthropic-ai/claude-agent-sdk | src/agent/run.ts |
| MCP tools | 16+ tools across 5 lanes: engineering_*, blog_*, support_*, llms_*, vendor_* + search_tools | src/mcp/ |
| Vendor mirror | 28 vendor doc surfaces (anthropics, cloudflare, neon, stripe, twilio, workos, elevenlabs, aws, openfeature, gcp, ...) — 1,369 anthropics docs alone | vendor/ |
| Crawler | crawlee + llms.txt / html-index / sitemap.xml discovery; preflight-304 idempotency | scripts/crawl-vendors.ts |
| Worker runner | Cloudflare Sandbox + Durable Objects for per-task ephemeral execution (scaffolded) | infra/cloudflare/ |
| Neon branching | Per-PR Neon DB branches via cloudflare-preview.yml | migrations/, scripts/migrate-neon.ts |
| Frontend | outcomesdk.com Cloudflare Worker — pretext-driven SPA over vendor/ markdown | frontend/ |
| Heartbeat memory | Cross-session orchestration state | seeds/memory/heartbeat/ |
| Feature flags | OpenFeature + Cloudflare Flagship provider | src/lib/openfeature.ts |
| Plugin manifest | 3 Anthropic marketplaces (official, knowledge-work, community) | .claude/plugins.json |
unset ANTHROPIC_API_KEY # OAuth-only — fails closed if this is set
export CLAUDE_CODE_OAUTH_TOKEN=... # mint via `claude setup-token`
npm install
npm run verify # mcp + tf + citations + gates + libs + freshness + project
npm run dev "trivial test query" # local orchestrator turn
See DEVELOPER.md for the full first-time setup + day-to-day workflows.
| Doc | When to read |
|---|---|
CLAUDE.md | A Claude session starting in this repo — load-bearing context auto-loaded by claude |
DEVELOPER.md | First-time setup; adding a vendor / lane / skill / test |
RUNBOOK.md | Using Claude Opus 4.7 1M context as the web orchestrator |
CONTRIBUTING.md | Forking-founder onboarding + PR discipline |
docs/architecture.md | Runtime topology |
docs/governance.md | Branch ruleset + auto-merge state machine |
docs/security.md | OSV-Scanner dependency-vuln gate posture |
docs/context-management.md | Token counting, cache boundary, settingSources, safety hooks |
docs/CONVENTIONS.md | Outcome-driven Conventional Commits |
docs/PROJECT.md | Cowork-style project manifest |
docs/pending.md | Live action dashboard — operator + agent queue |
docs/operator-runbooks/README.md | Claude-in-Chrome operator runbooks (CF API token, GH PAT, etc.) |
PRODUCTRD.md | Chassis intent + functional requirements |
SUBPROCESSORS.md | Vendor inventory for fork-time re-evaluation |
| Lane | Source | Tools |
|---|---|---|
engineering | anthropic.com/engineering | engineering_{index,fetch,search} |
blog | claude.com/blog | blog_{index,fetch,search} |
support | support.claude.com | support_{collections,collection,article} |
llms | namespaces under *.claude.com/llms.txt, anthropic.com/llms.txt, vendor llms.txts | llms_{namespaces,fetch,grep} |
vendor | the local vendor/ mirror (28 surfaces) | vendor_{list,fetch,grep} |
Plus search_tools for progressive disclosure across the surfaces.
The full lane-to-tool map is in docs/architecture.md. Per-lane docs at docs/lanes/{engineering,blog,support,llms,vendor}/index.md.
| Sub-agent | Tools | Purpose |
|---|---|---|
npm-research | 4 npm-registry MCP tools | Primary npm data; cites registry URLs |
verifier | 12 knowledge-bridge tools (excl. vendor_*) | Independent grader vs docs/rubric.md |
crawl-curator | 3 vendor_* tools | Per-vendor crawl.json audits + drift detection |
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimnpx claudepluginhub subagentceo/knowledge-engineering --plugin github-it-adminPer-merged-PR audit follow-up generator. Reads the session transcript at ~/.claude/projects/<dir>/<session-id>.jsonl, computes tool-call waste/latency/throughput stats for the work that landed a given PR, and emits a templated follow-up PR body plus the top 3 highest-impact findings as issue bodies. Dogfoods OAUDIT family: build-use-iterate-improve the merge process itself by surfacing where the agent wasted calls.
Code-intelligence + document tooling for mirroring HTML/PDF documentation (e.g. anthropic.com/sitemap.xml pages): HTML, TypeScript, and JavaScript language servers (VS Code's extracted servers + typescript-language-server) plus the official Model Context Protocol PDF server. Binaries are pinned as repo devDependencies and invoked via npx.
Personalized platform-engineering plugin for the operator: AlloyDB Omni install, Docker MCP profile wiring, Voyage+Turbopuffer+AlloyDB embeddings architecture, and citation/test/outcome discipline. Modeled after subagentceo/knowledge-work-plugins/cowork-plugin-management.
Operator-side IT admin plugin: scriptable CRUD over vendor API tokens for Cloudflare, Turbopuffer, Neon, Parallel.ai, and Nimbleway. Implements the OSEC3 long-lived-minter pattern with macOS keychain bootstrap. Replaces browser-click token mint flows with deterministic CLI flows that never leak secret values into agent context.
Harness-native ECC plugin for engineering teams - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses
Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
A growing collection of Claude-compatible academic workflow bundles. Covers scientific figures, manuscript writing and polishing, reviewer assessment, citation retrieval, data availability, paper reading, literature search, response letters, paper-to-PPTX conversion, and evidence-grounded Chinese invention patent drafting. Rules are organized as reusable skill folders with explicit workflows and quality checks.
Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security