
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
cocosuperintelligence
Advanced tools
CoCo Super Intelligence — summon an advisory board of 495 world-class minds inside your AI coding session. A vendor-neutral orchestration layer for Claude Code, Cursor, and Codex: 228 skills (190 installed by default), 387 commands, 34 agents, and disk-pe
495 personas across 13 departments, 228 skills1 and 387 commands in the full catalog (coco main, 2026-10-05).
Open-core: the core is MIT, and Super Intelligence is proprietary. Files stay on your machine. No telemetry. A version check may contact GitHub once a day.
A hard call in a coding session usually gets one model's opinion, with no name on it and no record of who disagreed. CoCo seats a cross-team board of 495 personas, each modeled on the public writing of a named expert, answering from cited public stances, and returns one pick plus the dissent. They are not those people's views or endorsement. The same install carries the skills and commands that do the work after the verdict, and writes phase state to disk so a cleared chat does not erase the plan. It is not a new model and not a new harness. It installs into the one you already run.
Personas are modeled on the public writing of named experts and are not those people's views or endorsement. See the persona disclaimer. To request removal or correction of a persona, see docs/personas/TAKEDOWN.md.
An illustration built from a real /SI-Decide run (Claude Sonnet 5.5, 30 September 2026, US$0.41). Persona names are replaced with role archetypes and the output is trimmed for length; no other words are changed. The full output, with the same replacements, is in docs/readme/terminal/si-decide-full.md. Note what it admits: the embedding router was offline, so it fell back to keywords, and stances applied beyond their source are marked extrapolated.
A real meta_select.py Stage-A run on this machine. The embedding router was offline (Connection refused), so this shows the keyword-fallback routing path (method: keyword, degraded: true), not embed cosine.
Prerequisites: git, bash, Node.js 14 or newer (for npx), and python3 (it generates the /SI-* commands).
npx cocosuperintelligence installs the latest release. It clones the pinned release tag (currently v1.8.0, not floating main) into ./coco of the current directory, then runs install.sh. Run it from your home folder, so the clone is ~/coco and not a folder inside another project. On a fresh machine it took about 3 minutes, including the download.
npx cocosuperintelligence
Open Claude Code and run:
/SI-Decide "Should a 10-person startup move its public REST API to GraphQL this quarter?"
Newest main, which is ahead of that pin:
git clone https://github.com/coco-research/coco.git ~/coco && bash ~/coco/install.sh
Adapter flags and bundle selection: docs/install.md.
/SI-Decide seats 16-32 of 495 personas across 13 departments. Add --debate for reaction rounds./clear. Decisions, phase state, and progress stay on disk.COCO_NO_UPDATE_CHECK=1 to skip the daily GitHub version check.You type a question. The orchestrator scores 495 personas across 13 departments on domain fit, cell coverage, and productive conflict, then seats 16-32. Each seated persona is modeled on the public writing of a named expert, answers from cited public stances, and is not that person's views or endorsement. --debate adds reaction rounds before the tally. The decision is one pick, the dissents are named, and a stance check flags anything that does not trace to a source.
How the router scores teams: systems/superintelligence/README.md. What each editor actually receives: adapters/INDEX.md.
Released on npm: npx cocosuperintelligence installs the latest release (CHANGELOG).
Measured on main, a default Claude Code install delivers 190 of the 228 skills (the rest are the opt-in security pack and Cursor-only skills), 387 commands and 34 agents (docs/delivered-counts.json).
Known gap: most GSD skills need the upstream GSD toolkit at ~/.claude/get-shit-done (see systems/gsd/README.md).
From a checkout you already have, bash install.sh auto-detects the editor. Narrow it with --adapter cursor or --systems gsd,brain. --core-only skips bundles. reverse-skill stays opt-in: --systems reverse-skill.
The remote bootstrap clones the same pinned release tag as npx (not floating main) to ~/.coco, prints the commit, and waits for you to type y before it runs install.sh:
bash <(curl -fsSL https://raw.githubusercontent.com/coco-research/coco/main/bin/coco-bootstrap.sh)
npx cocosuperintelligence update checks out the pinned release tag. A git clone updates with git pull --ff-only && bash install.sh. bash scripts/check-update.sh prints the version. The check contacts GitHub at most once a day and sends no telemetry.
Uninstall removes symlinks whose target is this clone, and only those. Run it from the clone root:
CLONE="$(pwd)"
find ~/.claude ~/.cursor ~/.grok ~/.copilot -type l -lname "${CLONE}/*" -delete
for app in "Code" "Code - Insiders" "VSCodium" "VSCodium - Insiders"; do for base in "$HOME/Library/Application Support" "${XDG_CONFIG_HOME:-$HOME/.config}"; do [ -d "$base/$app/User" ] && find "$base/$app/User" -type l -lname "${CLONE}/*" -delete; done; done
A contains-match on the folder name would also delete links into a path that merely contains that name (for example coco-research when the clone is coco). Hermes profiles live under ~/.hermes/profiles; use the same "${CLONE}/*" prefix there. Uninstall does not remove the generated SI*.md command files or the rules block between <!-- coco:rules-start --> and <!-- coco:rules-end --> in CLAUDE.md; delete those by hand.
Super Intelligence summons a panel inside the session you already have open. Every contribution is from a persona modeled on the public writing of a named expert and grounded in a cited public source. It is not that person's views or endorsement.
/SI-Decide "Should we migrate our database to pgvector?"
/SI-AI-Decide "Which embedding model gives the best cost/performance?"
/SI-Eng-Pre-Mortem "Review our zero-downtime cache migration strategy"
/SI-GRC-Review "Check this customer onboarding flow for GDPR compliance"
495 expert personas, organized across 13 specialized departments:
| Department | Experts | Focus |
|---|---|---|
| Engineering | 70 | Software architecture, cloud systems, systems coding, compilers, infrastructure |
| AI | 59 | Neural-network research, LLM optimization, safety, alignment, vector databases |
| Product & Design | 56 | Design systems, UX, product strategy, growth loops |
| Finance | 47 | Valuation, corporate finance, macro modeling, fintech infrastructure |
| Trading | 46 | Quant analysis, market microstructure, derivatives pricing, crypto liquidity |
| Legal & IP | 31 | Privacy law, antitrust, patent and copyright policy, digital rights |
| Risk & Compliance (GRC) | 30 | GDPR, HIPAA, SOC 2, security auditing, international regulation |
| Strategy | 29 | Platform economics, business models, competitive analysis |
| Data & Analytics | 29 | Data engineering, pipeline optimization, predictive modeling |
| Climate & Energy | 25 | Decarbonization policy, clean-energy economics, carbon markets, circular economy |
| Education & EdTech | 25 | Learning science, curriculum design, education policy, assessment |
| Healthcare & Life Sciences | 25 | Health economics, genomics, clinical medicine, public health policy |
| Sales / GTM / Marketing | 23 | Product-market fit, sales ops, growth marketing, enterprise GTM |
/SI-Decide, /SI-Tradeoff) plus 325 per-team commands (25 verbs × 13 teams, such as /SI-AI-Decide). Generated on your machine at install time. Nothing is uploaded.cells fields in systems/superintelligence/registry.json.--debate. The panel argues in reacting rounds, then returns a verdict with named dissent instead of a false consensus.The 495-persona roster was compiled with a systematic multi-tier workflow. Candidate generation was evaluated across local Qwen (via LM Studio), a hosted small model, and Gemini Flash, but Claude research agents proved the quality winner for resolving historical data and citing verifiable signal. Personas are checked by an advisory validation gate (validate_persona.py) that enforces five things: every required frontmatter field is present; at least 4 cited URLs resolve live (non-404); every public_stance carries an evidence_url, so no stance is uncited; at least 2 recent signals within 12 months (or 2 persistent signals for historical archetypes); and any pairs_well_with / productive_conflict_with slug refers to a real roster member. Two limits are worth stating plainly: the gate confirms that a stance is cited, not that a quotation is authentic, and home_team is only checked for presence, not validated against the list of real teams. A NEEDS-TOPUP verdict is advisory. It does not currently affect which personas a council selects at runtime.
CoCo ships 228 skills (76 core + 152 across bundles)1. Each one is an instruction set with state, checks, and error handling, not a one-line prompt. A slice:
ui-ux-pro-max · frontend-design · brainstorming · writing-plans · test-driven-development · systematic-debugging · verification-before-completion · prd-generator · openai-agents · coco-loop · coco-ads · arch-index
Core skills (76)
agent-lightning · agent-self-eval · ai-marketing-videos · ai-product · api-design-principles · arb-review · arch-index · axiom-liquid-glass · brainstorming · browser-automation · c4-architecture · change-log · cli-anything · clone-website · coco · coco-ads · coco-cli · coco-diagram · coco-loop · coco-ship · code-verification · context-budget · design-taste-frontend · dispatching-parallel-agents · doc-sync · dr-plan · executing-plans · expo-api-routes · find-skills · finishing-a-development-branch · frontend-design · generate-tests · goal · humanizer · irp · journey-map · karpathy-guidelines · local-llm · media-memory · meeting-notes · nfr-tracker · openai-agents · openai-api · openai-apps-mcp · openai-whisper · pmstudio · prd-generator · prd-mastery · project-docs · receiving-code-review · recovery-plan · redesign-existing-projects · requesting-code-review · scroll-world · skill-creator · skill-evolution · stakeholder-comms · subagent-driven-development · swiftui-liquid-glass · systematic-debugging · tailwind-patterns · task-prd-creator · test-driven-development · ui-ux-pro-max · ultra-think · using-git-worktrees · using-superpowers · vercel-react-best-practices · verification-before-completion · visual-explainer · voice-ai · web-design-guidelines · workflow-routing · writing-plans · writing-skills
GSD bundle skills (68) — the full gsd-* project-orchestration lifecycle: gsd-new-project, gsd-plan-phase, gsd-execute-phase, gsd-verify-work, gsd-autonomous, gsd-debug, gsd-ui-phase, gsd-secure-phase, gsd-workstreams, gsd-forensics, gsd-milestone-summary, gsd-map-codebase, gsd-profile-user, and 55 more (see systems/gsd/skills/).
Brain bundle skills (6) — brain · brain-init · brain-rescan · brain-update · brain-export · brain-wiki.
Super Intelligence bundle (13) — one orchestration skill per built team (ai, engineering, product-design, finance, trading, risk-compliance, strategy, data-analytics, gtm, climate-energy, education-edtech, healthcare-life-sciences, legal-ip), which generate the 342 /SI-* commands at install.
HyperFrames bundle skills (20) — embedded-captions · faceless-explainer · figma · general-video · hyperframes · hyperframes-animation · hyperframes-cli · hyperframes-core · hyperframes-creative · hyperframes-keyframes · hyperframes-registry · media-use · motion-graphics · music-to-video · pr-to-video · product-launch-video · remotion-to-hyperframes · slideshow · talking-head-recut · website-to-video.
M0 bundle skills (4) — m0 · m0-handoff · m0-recall · m0-remember.
Cognee bundle skills (3) — cognee · cognee-recall · cognee-store.
Not installed by default (38): the reverse-skill security pack (33 reverse-engineering and penetration-testing skills, installed only with --systems reverse-skill; see systems/reverse-skill/) and 5 Cursor-only skills that ship with the Cursor adapter: create-rule · create-skill · create-subagent · migrate-to-skills · update-cursor-settings.
Six bundles install by default. --core-only skips them. --systems <list> installs an explicit subset. reverse-skill is not one of the six: it vendors reverse-engineering and penetration-testing methodology under systems/reverse-skill/ and installs only with --systems reverse-skill. See systems/reverse-skill/README.md.
~/.claude/get-shit-done/, which this installer does not yet provide; see systems/gsd/README.md. Phase state lives in .planning/. Workstreams are isolated git checkouts./SI-* commands across 13 teams. This is the board above.hyperframes under Apache-2.0.cognee server is not running./team is not a bundle. It is part of the core install (/team ship, /team plan, /team review, /team verify) and needs no flag. /team ship runs 6 development stages and 7 verification gates, and it can declare where files should land, then fail if they did not. The check is structural (paths exist), not a judgement that the code does what the component promised. Design adapted from lak7/devildev (Apache-2.0); no upstream code was copied. See CREDITS.md.
A default Claude Code install delivers 190 skills, 387 commands and 34 agents, measured by running the installer. The repository holds 228 skills; the difference is the opt-in security pack and Cursor-only skills. The measured row is main.
228Skills76 Core + 152 Bundle · 190 install by default | 387Slash Commands45 Core + 342 Generated | 34Specialized Agents10 Core + 24 Bundle | 495Expert PersonasSuper Intelligence Board | 15Cross-IDE RulesCursor MDC Rules |
--systems reverse-skill.| Spec Version | latest release |
| License | Open-core — MIT core; Super Intelligence is proprietary |
| Total Skills | 228 in the repository (76 Core + 152 Bundle); 190 install by default on Claude Code |
| Slash Commands | 387 on a default install — 45 Core (shipped) + 342 Super Intelligence (325 per-team + 17 cross-team, generated at install) |
| Specialized Agents | 34 (10 Core + 24 Bundle) |
| Expert Personas | 495 across 13 departments and 98 cells |
| System Bundles | 6 (GSD, Brain, Cognee, HyperFrames, Super Intelligence, M0) — installed by default. reverse-skill, the security-testing bundle, stays opt-in with --systems reverse-skill. /team is core and needs no flag. |
| Cross-IDE Rules | 15 (.mdc files) |
| Workflows Defined | 3 (.md pipelines) |
| Install Time | About 3 minutes on a fresh machine, including the download (measured at 189 seconds). |
| Telemetry / SaaS | No telemetry, no hosted service. One optional version check against GitHub per day (COCO_NO_UPDATE_CHECK=1 turns it off) |
Core install ships 76 skills + 45 commands + 10 agents + 15 rules (146 active assets). A plain bash install.sh delivers 190 skills, 387 commands and 34 agents on Claude Code: every bundle in the default allow-list (GSD, Brain, Cognee, HyperFrames, Super Intelligence, M0) is installed by default. --core-only installs the core set alone, and --systems <list> installs an explicit subset — including reverse-skill, the security-testing bundle, which stays opt-in and is never part of the default set. Super Intelligence slash commands are generated locally at install time from the team registries — no command files are transmitted or stored remotely. adapters/INDEX.md records what each adapter actually delivers, measured by running it.
Neither. It is Markdown and YAML that installs into the harness you already use (Claude Code, Cursor, Codex CLI, or any AGENTS.md tool). The host runs the model and the agents. CoCo supplies the skills, commands, agents, rules, and the persona board.
CoCo's files stay on your machine. It adds no telemetry and no hosted service. Your editor's own privacy policy is unchanged. The CLI checks GitHub for a newer version at most once a day. COCO_NO_UPDATE_CHECK=1 turns that off.
Edit skills/<name>/SKILL.md, then run bash install.sh so the symlinks pick up the edit.
Run bash install.sh --adapter cursor (or the adapter you want). The skills and workflows come with you. The full list is adapters/INDEX.md.
CoCo stands on other people's work. The short list:
systems/hyperframes/.clone-website.--debate.coco-ads.design-taste-frontend and redesign-existing-projects.cli-anything.web-design-guidelines, and vercel-labs/agent-skills for vercel-react-best-practices (link-only stub).Full attributions, including audio (ende.app, Kenney.nl), are in CREDITS.md. If something influenced CoCo and is missing, that is a bug: open an issue.
CoCo is open-core: the core is MIT-licensed and contributions are welcome. The Super Intelligence System (systems/superintelligence/) is proprietary. See systems/superintelligence/LICENSE.
CONTRIBUTING.md.SECURITY.md. Conduct: CODE_OF_CONDUCT.md.Releases are in CHANGELOG.md and on the GitHub Releases page.
Open-core. The core of this repository is MIT, in LICENSE. Super Intelligence (systems/superintelligence/) is proprietary, in systems/superintelligence/LICENSE. Third-party bundles keep their own licences: HyperFrames is Apache-2.0, and reverse-skill documents its upstream licence in its own README.
190 of the 228 skills install by default on Claude Code, together with all 387 commands and 34 agents. The other 38 are the opt-in reverse-skill security pack (33, installed only with --systems reverse-skill) and 5 Cursor-only skills. Measured by running the installer, not by counting files: see docs/delivered-counts.json, and adapters/INDEX.md for every other IDE. ↩ ↩2
FAQs
CoCo Super Intelligence — summon an advisory board of 495 world-class minds inside your AI coding session. A vendor-neutral orchestration layer for Claude Code, Cursor, and Codex: 228 skills (190 installed by default), 387 commands, 34 agents, and disk-pe
We found that cocosuperintelligence demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.