
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
agent-arche
Advanced tools
Multi-platform AI agent orchestration for GitHub Copilot, Claude Code, and Codex
Multi-platform AI agent orchestration - specialists for GitHub Copilot, Claude Code, and Codex. This is still in beta phase, because some skills are still getting improved on how they are called and used through agents.
npx agent-arche install
Run from your project root. The installer now asks in this order:
| Scope | What gets installed |
|---|---|
| Full orchestration | Full platform package set (agents, hooks, instructions/rules, prompts/commands, skills, memory, and platform root files where applicable) |
| Skills only | Shared skills folder only, installed to the platform skill destination |
Platforms supported:
| Platform | Install destination |
|---|---|
| GitHub Copilot | .github/ |
| Claude Code | .claude/ + CLAUDE.md |
| Codex | .codex/ + .agents/skills/ + AGENTS.md |
Seed the memory / context file (do this once after install):
| Platform | Prompt |
|---|---|
| GitHub Copilot | @Orchestrator use the analyze-codebase skill on this project |
| Claude Code | Use the orchestrator agent to run the analyze-codebase skill on this project |
| Codex | Use the orchestrator agent to run the analyze-codebase skill on this project |
This walks through your codebase, interviews you about decisions and context, then populates the project memory that all agents read in future sessions.
Update to the latest version later:
npx agent-arche update
Verify integrity:
npm view agent-arche dist.integrity
Compare the hash with the one stored in agent-arche.json inside your install directory (.github/, .claude/, or .codex/).
If anyone is curious about how the agents utilize the skills, it's mapped as in the image.
Copy the appropriate platform folder to your project:
copilot/ → .github/, skills/ → .github/skills/, memory/ → .github/memory/claude/ → .claude/, skills/ → .claude/skills/, claude/CLAUDE.md → CLAUDE.mdcodex/config.toml → .codex/config.toml, codex/agents/ → .codex/agents/, codex/hooks/ → .codex/hooks/, codex/hooks.json → .codex/hooks.json, codex/instructions/ → .codex/instructions/, codex/rules/ → .codex/rules/, memory/ → .codex/memory/, skills/ → .agents/skills/, codex/AGENTS.md → AGENTS.mdFor Codex, .codex/instructions/ is a project convention used by the bundled Codex agents. Those agents inspect the files they are planning, editing, or reviewing and then load every matching instruction file using the same glob patterns as the Copilot setup.
For better PR and issue workflows, copy the templates/ contents to .github/ and update the comments inside.
The CLI automatically adjusts agent models based on your subscription:
Note: this applies only to Full orchestration installs. For Skills only installs, Copilot plan selection is skipped.
| Subscription | Model change |
|---|---|
| Student | All Claude models (Sonnet + Opus) → GPT-5.3-Codex (copilot). Designer (Gemini) unchanged. |
| Pro | Opus-only agents (Planner, Researcher) → Claude Sonnet 4.6 (copilot). Others unchanged. |
| Pro+ | No changes, all models stay as configured. |
Agents are specialist roles that handle specific types of work. The Orchestrator delegates tasks to them, they never run on their own unless invoked directly for single-purpose jobs.
| Agent | Purpose |
|---|---|
| Orchestrator | The coordination brain. Classifies requests, builds a pipeline of agents, confirms it with the user, then delegates. Never writes code or edits files itself. |
| Planner | Creates implementation plans by researching the codebase and skill files. For new features, runs the grill-me → to-prd → to-issues workflow before planning. Never writes code. |
| Researcher | Deep-dives into prior art, library docs, CVEs, and GitHub issues before implementation begins. Never writes code. |
| Coder | Writes implementation code and unit tests following project conventions. Uses TDD (red-green-refactor) methodology. |
| Designer | Handles UI/UX work using design-intelligence plus the design skills to create product-fit components, layouts, styling, and motion. Never touches server-side code. |
| Code Reviewer | Audits code for standards compliance, framework syntax correctness, TypeScript strictness, naming, and error handling. Returns a structured issue report. Never modifies code. |
| Security Auditor | Scans for OWASP Top 10 vulnerabilities, injection, broken access control, XSS, hardcoded secrets, SSRF, etc. Never modifies code. |
| UX Reviewer | Reviews UI components for product fit, accessibility, usability, interaction design, visual quality, and cognitive load. Never modifies code. |
| Tester | Writes and runs Playwright E2E tests for critical user flows. Focuses on happy path, error path, and edge cases. |
| Docs Updater | Updates CHANGELOG, README, and docs/ after implementation is verified. Never touches source code. |
Skills are reference documents that agents load before doing work in a specific domain. They contain best practices, checklists, templates, and anti-patterns.
| Skill | Purpose |
|---|---|
caveman | Mandatory default mode. Compressed communication protocol, drops articles and filler, uses fragments and short synonyms, keeps technical terms exact. Reduces token usage significantly. Disable with "stop caveman" or "normal mode". |
caveman-compress | Compression-optimized variant for maximum brevity. |
| Skill | Purpose |
|---|---|
analyze-codebase | Bootstraps the memory vault for a new project. Silently explores the codebase, interviews you in batches of 3–5 questions, then writes ADRs, patterns, learnings, and a feature index. Run this once when you first install agent-arche. |
grill-me | Interrogates the user about every aspect of a plan until reaching shared understanding. Walks down each branch of the design tree, resolving dependencies one by one. Used by the Planner before creating a PRD. |
to-prd | Synthesizes the current conversation context into a structured PRD (problem statement, user stories, implementation decisions, testing decisions) and submits it as a GitHub issue. |
to-issues | Breaks a PRD into independently-grabbable GitHub issues using vertical-slice tracer bullets. Each issue cuts through all layers end-to-end rather than slicing horizontally by layer. |
tdd | Test-driven development methodology: red-green-refactor in vertical slices. Includes supporting files on deep modules, interface design for testability, mocking guidelines, and refactoring candidates. |
improve-codebase-architecture | Explores a codebase to find shallow modules and architectural friction, then proposes module-deepening refactors. Spawns multiple sub-agents to design competing interfaces before creating an RFC issue. |
| Skill | Purpose |
|---|---|
design-intelligence | Product-aware UI/UX direction and routing. Builds the design-system brief before implementation: audience, product type, tone, density, palette, typography, motion level, states, accessibility, and follow-up skills. |
design | Baseline premium UI implementation skill. Uses the design-intelligence brief plus Anti-Codex quality guardrails to produce polished, product-fit interfaces. |
soft | High-end agency aesthetic with vibe archetypes (Ethereal Glass, Editorial Luxury, Soft Structuralism). |
minimalist | Ultra-flat editorial style, warm monochrome, typographic contrast, bento grids, extreme whitespace. No gradients or heavy shadows. |
brutalist | Raw mechanical interfaces, Swiss typographic print meets military terminal aesthetics. Rigid grids, extreme type scale contrast. |
redesign | Surgically upgrades existing UIs to premium quality via Scan → Diagnose → Fix workflow while preserving the current stack and behavior. |
animate | Everyday purposeful motion: hover, focus, active, loading, empty, error, route, modal, accordion, list, and state transitions. |
gsap | Advanced GSAP motion engineering for cinematic landing pages, pinned scroll sections, scrubbed timelines, editorial stories, and immersive product showcases. |
stitch | Generates agent-friendly DESIGN.md files for Google Stitch with calibrated color, typography, and motion specs. |
| Skill | Purpose |
|---|---|
coding-standards | Project coding standards, TypeScript strict mode, naming conventions, file organization, error handling patterns, forbidden patterns. |
api-design | REST API conventions, response envelopes, HTTP status codes, Zod validation, pagination, error hierarchy, URL design, and security checklist. |
critique | Deep design critique using product-fit checks, heuristic scoring, cognitive load analysis, personas, design-token review, component consistency, and accessibility evidence. |
ui-audit | Scores a UI across quality dimensions, including accessibility, performance, responsiveness, visual consistency, anti-patterns, and fit to the intended product/audience. |
ui-optimize | Diagnoses and fixes UI performance, Core Web Vitals, rendering, animations, images, and bundle size with before/after validation. |
seo | 8-phase prioritized SEO execution plan, technical foundation, metadata, structured data, Core Web Vitals, internal linking, and monitoring. |
output | Overrides default LLM truncation behavior. Demands complete code output, bans placeholder patterns, skeleton code, and // ... comments. |
| Skill | Purpose |
|---|---|
commit-conventions | Conventional Commits format, type prefixes, imperative mood subject lines, 72-char limit, breaking change format. |
branch-conventions | Branch naming format: <type>/<issue>-<description> with lowercase-hyphen rules and lifecycle management. |
pr-standards | PR title format, required issue references, description template (What/Why/How to test), 400-line diff limit, squash merge policy. |
| Skill | Example request |
|---|---|
caveman | "Use compressed mode while coordinating this implementation." |
caveman-compress | "Compress the project memory files so agents spend fewer tokens on startup." |
analyze-codebase | "Bootstrap this repo's memory before we start using the agents." |
grill-me | "Interrogate me until the product requirements are no longer vague." |
to-prd | "Turn this feature discussion into a PRD issue." |
to-issues | "Break the PRD into implementation issues that can be worked independently." |
tdd | "Implement this parser with red-green-refactor and focused tests." |
improve-codebase-architecture | "Find shallow modules and propose a deeper interface for this subsystem." |
design-intelligence | "Plan the visual direction for a premium SaaS dashboard before implementation." |
design | "Build the settings page with polished, production-grade UI." |
soft | "Make this agency homepage feel elegant, luminous, and high-end." |
minimalist | "Create a clean editorial dashboard with warm monochrome surfaces." |
brutalist | "Design a raw tactical telemetry interface for dense operational data." |
redesign | "Upgrade this existing landing page without changing its behavior." |
animate | "Add purposeful transitions, loading feedback, and micro-interactions to this flow." |
gsap | "Create a cinematic landing page with pinned scroll sections." |
stitch | "Generate a DESIGN.md for Google Stitch to keep future screens consistent." |
coding-standards | "Review this TypeScript module for naming, strictness, imports, and error handling." |
api-design | "Design the REST API shape, validation, pagination, and error responses." |
critique | "Give a deep UX critique of this dashboard with heuristic scoring and persona risks." |
ui-audit | "Score this checkout flow before launch and tell me what must be fixed first." |
ui-optimize | "Find why this page feels janky and reduce load, CLS, and animation cost." |
seo | "Prepare this marketing page for search, sharing, and Core Web Vitals." |
output | "Return the complete component without placeholders or skipped sections." |
commit-conventions | "Help me name commits for these staged changes." |
branch-conventions | "Create a branch name for issue 42's checkout redesign." |
pr-standards | "Draft a PR title, body, checklist, and test notes for this change." |
Hooks are scripts that run automatically at specific points during an agent session. They enforce safety rules without requiring the agent to remember them.
| Hook | Trigger | What it does |
|---|---|---|
session-start.cjs | SessionStart | Injects project startup context: read AGENTS.md, use .codex/config.toml for MCP/runtime settings, and load matching .codex/instructions/ files before code work. |
pre-tool-safety.cjs | PreToolUse | Blocks clearly destructive Bash commands such as rm -rf, git reset --hard, git push --force, drop table, and PowerShell delete variants. |
changelog-reminder.cjs | Stop | At the end of a turn, checks whether source files changed without a matching changelog update and reminds the agent before the session closes. |
Auto-injected coding standards that activate based on which files the agent is working with.
| Rule | Applies to | What it enforces |
|---|---|---|
typescript | **/*.ts, **/*.tsx | TypeScript strict mode, no any without comment, explicit return types on exports. |
svelte | **/*.svelte | Svelte 5 runes only, correct component structure order. |
tests | **/*.test.ts, **/*.spec.ts | Test file structure, one describe per module, descriptive test names, nested describe for groups. |
api-routes | **/routes/api/**, **/api/**, **/server/** | Validate all request input at boundaries, use schema validators, reject unexpected fields. |
In Copilot these are host-native instruction files. In Codex they are implemented by the bundled agents: they read every matching file in .codex/instructions/ before planning, editing, testing, or reviewing code.
Codex does not use a Copilot-style tools: [...] frontmatter list inside agent files.
sandbox_mode, approval_policy, and web_search in .codex/config.toml..codex/config.toml.context7, playwright, github, and openaiDeveloperDocs so a project can opt in without re-learning the config shape.User-invocable shortcuts that perform a single focused task. These install as Copilot prompts and Claude commands; Codex does not install prompt files, so use the Codex agents by name instead.
| Prompt | Purpose |
|---|---|
code-review | Review selected code against project coding standards (TypeScript, naming, error handling, imports). |
write-tests | Write unit tests for selected code, happy path, edge cases, and error cases with proper setup/teardown. |
debug | Systematic debug cycle: reproduce → gather evidence → isolate → hypothesize → verify → fix. |
create-issue | Draft a GitHub issue with title, description, acceptance criteria, labels, and branch name. |
pr-description | Generate a PR description from staged changes, what changed, why, and how to test it. |
security-review | Security review covering all OWASP Top 10 categories against selected code. |
Every project gets persistent context. Native project files give the host assistant startup guidance; agent-arche memory folders store longer-lived decisions, patterns, learnings, reviews, and session notes.
| Platform | Memory location | Format |
|---|---|---|
| GitHub Copilot | .github/memory/ (Obsidian vault) | Linked Markdown notes with wiki-links |
| Claude Code | .claude/memory/ + CLAUDE.md at project root | Linked Markdown notes plus root project context |
| Codex | .codex/memory/ + AGENTS.md at project root | Linked Markdown notes plus Codex project instructions |
After installing, run the analyze-codebase skill to seed it with your project's context.
If you installed Skills only, memory files are not installed by the CLI.
Built on top of excellent open-source work:
| Repo | What we took from it |
|---|---|
| cyxzdev/Uncodixfy | Design and UI skill inspiration |
| pbakaus/impeccable | Foundation for the ui-audit, ui-optimize, critique, animate skills |
| Leonxlnx/taste-skill | gsap, redesign, soft, minimalist, brutalist, stitch, output, and other quality-focused skills |
| anthropics/claude-code frontend-design | Frontend design skill patterns |
| mattpocock/skills | grill-me, to-prd, to-issues, tdd, and improve-codebase-architecture skills |
| JuliusBrussee/caveman | caveman, and caveman-compress communication skills |
FAQs
Selective Codex skills, lean hooks, indexed memory, and optional multi-agent orchestration
We found that agent-arche demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.