
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
ecc-universal
Advanced tools
Complete collection of battle-tested Claude Code configs — agents, skills, hooks, commands, and rules evolved over 10+ months of intensive daily use by an Anthropic hackathon winner
Language: English | 繁體中文
50K+ stars | 6K+ forks | 30 contributors | 6 languages supported | Anthropic Hackathon Winner
The performance optimization system for AI agent harnesses. From an Anthropic hackathon winner.
Not just configs. A complete system: skills, instincts, memory optimization, continuous learning, security scanning, and research-first development. Production-ready agents, hooks, commands, rules, and MCP configurations evolved over 10+ months of intensive daily use building real products.
Works across Claude Code, Codex, Cowork, and other AI agent harnesses.
Use these live signals when presenting ECC to sponsors, platforms, or ecosystem partners:
ecc-universal on npmecc-agentshield on npm.github/workflows/monthly-metrics.ymlDownload counts for Claude Code plugin installs are not currently exposed as a public API. For partner reporting, combine npm metrics with GitHub App installs and repository traffic/fork growth.
For a sponsor-call metrics checklist and command snippets, see docs/business/metrics-and-sponsorship.md.
Sponsor ECC | Sponsor Tiers | Sponsorship Program
This repo is the raw code only. The guides explain everything.
|
|
|
| Shorthand Guide Setup, foundations, philosophy. Read this first. | Longform Guide Token optimization, memory persistence, evals, parallelization. |
| Topic | What You'll Learn |
|---|---|
| Token Optimization | Model selection, system prompt slimming, background processes |
| Memory Persistence | Hooks that save/load context across sessions automatically |
| Continuous Learning | Auto-extract patterns from sessions into reusable skills |
| Verification Loops | Checkpoint vs continuous evals, grader types, pass@k metrics |
| Parallelization | Git worktrees, cascade method, when to scale instances |
| Subagent Orchestration | The context problem, iterative retrieval pattern |
ECC_HOOK_PROFILE=minimal|standard|strict and ECC_DISABLED_HOOKS=... for runtime gating without editing hook files./harness-audit, /loop-start, /loop-status, /quality-gate, /model-route.AGENTS.md-based Codex support, installer targeting, and Codex docsfrontend-slides skill — Zero-dependency HTML presentation builder with PPTX conversion guidance and strict viewport-fit rulesarticle-writing, content-engine, market-research, investor-materials, investor-outreach/codex-setup command generates codex.md for OpenAI Codex CLI compatibilitysearch-first, swift-actor-persistence, swift-protocol-di-testing, regex-vs-llm-structured-text, content-hash-cache-pattern, cost-aware-llm-pipeline, skill-stocktake/security-scan skill runs AgentShield directly from Claude Code; 1282 tests, 102 rulesparse_instinct_file() was silently dropping all content after frontmatter (Action, Evidence, Examples sections) during /instinct-import. Fixed by community contributor @ericcai0814 (#148, #161)configure-ecc skill provides guided setup with merge/overwrite detection/pm2, /multi-plan, /multi-execute, /multi-backend, /multi-frontend, /multi-workflow) for managing complex multi-service workflowscommon/ + typescript/ + python/ + golang/ directories. Install only the languages you needllms.txt for comprehensive OpenCode docs/sessions command for session historySee the full changelog in Releases.
Get up and running in under 2 minutes:
# Add marketplace
/plugin marketplace add affaan-m/everything-claude-code
# Install plugin
/plugin install everything-claude-code@everything-claude-code
⚠️ Important: Claude Code plugins cannot distribute
rulesautomatically. Install them manually:
# Clone the repo first
git clone https://github.com/affaan-m/everything-claude-code.git
cd everything-claude-code
# Recommended: use the installer (handles common + language rules safely)
./install.sh typescript # or python or golang
# You can pass multiple languages:
# ./install.sh typescript python golang
# or target cursor:
# ./install.sh --target cursor typescript
# or target antigravity:
# ./install.sh --target antigravity typescript
For manual install instructions see the README in the rules/ folder.
# Try a command (plugin install uses namespaced form)
/everything-claude-code:plan "Add user authentication"
# Manual install (Option 2) uses the shorter form:
# /plan "Add user authentication"
# Check available commands
/plugin list everything-claude-code@everything-claude-code
✨ That's it! You now have access to 16 agents, 65 skills, and 40 commands.
This plugin now fully supports Windows, macOS, and Linux, alongside tight integration across major IDEs (Cursor, OpenCode, Antigravity) and CLI harnesses. All hooks and scripts have been rewritten in Node.js for maximum compatibility.
The plugin automatically detects your preferred package manager (npm, pnpm, yarn, or bun) with the following priority:
CLAUDE_PACKAGE_MANAGER.claude/package-manager.jsonpackageManager field~/.claude/package-manager.jsonTo set your preferred package manager:
# Via environment variable
export CLAUDE_PACKAGE_MANAGER=pnpm
# Via global config
node scripts/setup-package-manager.js --global pnpm
# Via project config
node scripts/setup-package-manager.js --project bun
# Detect current setting
node scripts/setup-package-manager.js --detect
Or use the /setup-pm command in Claude Code.
Use runtime flags to tune strictness or disable specific hooks temporarily:
# Hook strictness profile (default: standard)
export ECC_HOOK_PROFILE=standard
# Comma-separated hook IDs to disable
export ECC_DISABLED_HOOKS="pre:bash:tmux-reminder,post:edit:typecheck"
This repo is a Claude Code plugin - install it directly or copy components manually.
everything-claude-code/
|-- .claude-plugin/ # Plugin and marketplace manifests
| |-- plugin.json # Plugin metadata and component paths
| |-- marketplace.json # Marketplace catalog for /plugin marketplace add
|
|-- agents/ # Specialized subagents for delegation
| |-- planner.md # Feature implementation planning
| |-- architect.md # System design decisions
| |-- tdd-guide.md # Test-driven development
| |-- code-reviewer.md # Quality and security review
| |-- security-reviewer.md # Vulnerability analysis
| |-- build-error-resolver.md
| |-- e2e-runner.md # Playwright E2E testing
| |-- refactor-cleaner.md # Dead code cleanup
| |-- doc-updater.md # Documentation sync
| |-- go-reviewer.md # Go code review
| |-- go-build-resolver.md # Go build error resolution
| |-- python-reviewer.md # Python code review (NEW)
| |-- database-reviewer.md # Database/Supabase review (NEW)
|
|-- skills/ # Workflow definitions and domain knowledge
| |-- coding-standards/ # Language best practices
| |-- clickhouse-io/ # ClickHouse analytics, queries, data engineering
| |-- backend-patterns/ # API, database, caching patterns
| |-- frontend-patterns/ # React, Next.js patterns
| |-- frontend-slides/ # HTML slide decks and PPTX-to-web presentation workflows (NEW)
| |-- article-writing/ # Long-form writing in a supplied voice without generic AI tone (NEW)
| |-- content-engine/ # Multi-platform social content and repurposing workflows (NEW)
| |-- market-research/ # Source-attributed market, competitor, and investor research (NEW)
| |-- investor-materials/ # Pitch decks, one-pagers, memos, and financial models (NEW)
| |-- investor-outreach/ # Personalized fundraising outreach and follow-up (NEW)
| |-- continuous-learning/ # Auto-extract patterns from sessions (Longform Guide)
| |-- continuous-learning-v2/ # Instinct-based learning with confidence scoring
| |-- iterative-retrieval/ # Progressive context refinement for subagents
| |-- strategic-compact/ # Manual compaction suggestions (Longform Guide)
| |-- tdd-workflow/ # TDD methodology
| |-- security-review/ # Security checklist
| |-- eval-harness/ # Verification loop evaluation (Longform Guide)
| |-- verification-loop/ # Continuous verification (Longform Guide)
| |-- golang-patterns/ # Go idioms and best practices
| |-- golang-testing/ # Go testing patterns, TDD, benchmarks
| |-- cpp-coding-standards/ # C++ coding standards from C++ Core Guidelines (NEW)
| |-- cpp-testing/ # C++ testing with GoogleTest, CMake/CTest (NEW)
| |-- django-patterns/ # Django patterns, models, views (NEW)
| |-- django-security/ # Django security best practices (NEW)
| |-- django-tdd/ # Django TDD workflow (NEW)
| |-- django-verification/ # Django verification loops (NEW)
| |-- python-patterns/ # Python idioms and best practices (NEW)
| |-- python-testing/ # Python testing with pytest (NEW)
| |-- springboot-patterns/ # Java Spring Boot patterns (NEW)
| |-- springboot-security/ # Spring Boot security (NEW)
| |-- springboot-tdd/ # Spring Boot TDD (NEW)
| |-- springboot-verification/ # Spring Boot verification (NEW)
| |-- configure-ecc/ # Interactive installation wizard (NEW)
| |-- security-scan/ # AgentShield security auditor integration (NEW)
| |-- java-coding-standards/ # Java coding standards (NEW)
| |-- jpa-patterns/ # JPA/Hibernate patterns (NEW)
| |-- postgres-patterns/ # PostgreSQL optimization patterns (NEW)
| |-- nutrient-document-processing/ # Document processing with Nutrient API (NEW)
| |-- project-guidelines-example/ # Template for project-specific skills
| |-- database-migrations/ # Migration patterns (Prisma, Drizzle, Django, Go) (NEW)
| |-- api-design/ # REST API design, pagination, error responses (NEW)
| |-- deployment-patterns/ # CI/CD, Docker, health checks, rollbacks (NEW)
| |-- docker-patterns/ # Docker Compose, networking, volumes, container security (NEW)
| |-- e2e-testing/ # Playwright E2E patterns and Page Object Model (NEW)
| |-- content-hash-cache-pattern/ # SHA-256 content hash caching for file processing (NEW)
| |-- cost-aware-llm-pipeline/ # LLM cost optimization, model routing, budget tracking (NEW)
| |-- regex-vs-llm-structured-text/ # Decision framework: regex vs LLM for text parsing (NEW)
| |-- swift-actor-persistence/ # Thread-safe Swift data persistence with actors (NEW)
| |-- swift-protocol-di-testing/ # Protocol-based DI for testable Swift code (NEW)
| |-- search-first/ # Research-before-coding workflow (NEW)
| |-- skill-stocktake/ # Audit skills and commands for quality (NEW)
| |-- liquid-glass-design/ # iOS 26 Liquid Glass design system (NEW)
| |-- foundation-models-on-device/ # Apple on-device LLM with FoundationModels (NEW)
| |-- swift-concurrency-6-2/ # Swift 6.2 Approachable Concurrency (NEW)
| |-- autonomous-loops/ # Autonomous loop patterns: sequential pipelines, PR loops, DAG orchestration (NEW)
| |-- plankton-code-quality/ # Write-time code quality enforcement with Plankton hooks (NEW)
|
|-- commands/ # Slash commands for quick execution
| |-- tdd.md # /tdd - Test-driven development
| |-- plan.md # /plan - Implementation planning
| |-- e2e.md # /e2e - E2E test generation
| |-- code-review.md # /code-review - Quality review
| |-- build-fix.md # /build-fix - Fix build errors
| |-- refactor-clean.md # /refactor-clean - Dead code removal
| |-- learn.md # /learn - Extract patterns mid-session (Longform Guide)
| |-- learn-eval.md # /learn-eval - Extract, evaluate, and save patterns (NEW)
| |-- checkpoint.md # /checkpoint - Save verification state (Longform Guide)
| |-- verify.md # /verify - Run verification loop (Longform Guide)
| |-- setup-pm.md # /setup-pm - Configure package manager
| |-- go-review.md # /go-review - Go code review (NEW)
| |-- go-test.md # /go-test - Go TDD workflow (NEW)
| |-- go-build.md # /go-build - Fix Go build errors (NEW)
| |-- skill-create.md # /skill-create - Generate skills from git history (NEW)
| |-- instinct-status.md # /instinct-status - View learned instincts (NEW)
| |-- instinct-import.md # /instinct-import - Import instincts (NEW)
| |-- instinct-export.md # /instinct-export - Export instincts (NEW)
| |-- evolve.md # /evolve - Cluster instincts into skills
| |-- pm2.md # /pm2 - PM2 service lifecycle management (NEW)
| |-- multi-plan.md # /multi-plan - Multi-agent task decomposition (NEW)
| |-- multi-execute.md # /multi-execute - Orchestrated multi-agent workflows (NEW)
| |-- multi-backend.md # /multi-backend - Backend multi-service orchestration (NEW)
| |-- multi-frontend.md # /multi-frontend - Frontend multi-service orchestration (NEW)
| |-- multi-workflow.md # /multi-workflow - General multi-service workflows (NEW)
| |-- orchestrate.md # /orchestrate - Multi-agent coordination
| |-- sessions.md # /sessions - Session history management
| |-- eval.md # /eval - Evaluate against criteria
| |-- test-coverage.md # /test-coverage - Test coverage analysis
| |-- update-docs.md # /update-docs - Update documentation
| |-- update-codemaps.md # /update-codemaps - Update codemaps
| |-- python-review.md # /python-review - Python code review (NEW)
|
|-- rules/ # Always-follow guidelines (copy to ~/.claude/rules/)
| |-- README.md # Structure overview and installation guide
| |-- common/ # Language-agnostic principles
| | |-- coding-style.md # Immutability, file organization
| | |-- git-workflow.md # Commit format, PR process
| | |-- testing.md # TDD, 80% coverage requirement
| | |-- performance.md # Model selection, context management
| | |-- patterns.md # Design patterns, skeleton projects
| | |-- hooks.md # Hook architecture, TodoWrite
| | |-- agents.md # When to delegate to subagents
| | |-- security.md # Mandatory security checks
| |-- typescript/ # TypeScript/JavaScript specific
| |-- python/ # Python specific
| |-- golang/ # Go specific
|
|-- hooks/ # Trigger-based automations
| |-- README.md # Hook documentation, recipes, and customization guide
| |-- hooks.json # All hooks config (PreToolUse, PostToolUse, Stop, etc.)
| |-- memory-persistence/ # Session lifecycle hooks (Longform Guide)
| |-- strategic-compact/ # Compaction suggestions (Longform Guide)
|
|-- scripts/ # Cross-platform Node.js scripts (NEW)
| |-- lib/ # Shared utilities
| | |-- utils.js # Cross-platform file/path/system utilities
| | |-- package-manager.js # Package manager detection and selection
| |-- hooks/ # Hook implementations
| | |-- session-start.js # Load context on session start
| | |-- session-end.js # Save state on session end
| | |-- pre-compact.js # Pre-compaction state saving
| | |-- suggest-compact.js # Strategic compaction suggestions
| | |-- evaluate-session.js # Extract patterns from sessions
| |-- setup-package-manager.js # Interactive PM setup
|
|-- tests/ # Test suite (NEW)
| |-- lib/ # Library tests
| |-- hooks/ # Hook tests
| |-- run-all.js # Run all tests
|
|-- contexts/ # Dynamic system prompt injection contexts (Longform Guide)
| |-- dev.md # Development mode context
| |-- review.md # Code review mode context
| |-- research.md # Research/exploration mode context
|
|-- examples/ # Example configurations and sessions
| |-- CLAUDE.md # Example project-level config
| |-- user-CLAUDE.md # Example user-level config
| |-- saas-nextjs-CLAUDE.md # Real-world SaaS (Next.js + Supabase + Stripe)
| |-- go-microservice-CLAUDE.md # Real-world Go microservice (gRPC + PostgreSQL)
| |-- django-api-CLAUDE.md # Real-world Django REST API (DRF + Celery)
| |-- rust-api-CLAUDE.md # Real-world Rust API (Axum + SQLx + PostgreSQL) (NEW)
|
|-- mcp-configs/ # MCP server configurations
| |-- mcp-servers.json # GitHub, Supabase, Vercel, Railway, etc.
|
|-- marketplace.json # Self-hosted marketplace config (for /plugin marketplace add)
Two ways to generate Claude Code skills from your repository:
Use the /skill-create command for local analysis without external services:
/skill-create # Analyze current repo
/skill-create --instincts # Also generate instincts for continuous-learning
This analyzes your git history locally and generates SKILL.md files.
For advanced features (10k+ commits, auto-PRs, team sharing):
Install GitHub App | ecc.tools
# Comment on any issue:
/skill-creator analyze
# Or auto-triggers on push to default branch
Both options create:
Built at the Claude Code Hackathon (Cerebral Valley x Anthropic, Feb 2026). 1282 tests, 98% coverage, 102 static analysis rules.
Scan your Claude Code configuration for vulnerabilities, misconfigurations, and injection risks.
# Quick scan (no install needed)
npx ecc-agentshield scan
# Auto-fix safe issues
npx ecc-agentshield scan --fix
# Deep analysis with three Opus 4.6 agents
npx ecc-agentshield scan --opus --stream
# Generate secure config from scratch
npx ecc-agentshield init
What it scans: CLAUDE.md, settings.json, MCP configs, hooks, agent definitions, and skills across 5 categories — secrets detection (14 patterns), permission auditing, hook injection analysis, MCP server risk profiling, and agent config review.
The --opus flag runs three Claude Opus 4.6 agents in a red-team/blue-team/auditor pipeline. The attacker finds exploit chains, the defender evaluates protections, and the auditor synthesizes both into a prioritized risk assessment. Adversarial reasoning, not just pattern matching.
Output formats: Terminal (color-graded A-F), JSON (CI pipelines), Markdown, HTML. Exit code 2 on critical findings for build gates.
Use /security-scan in Claude Code to run it, or add to CI with the GitHub Action.
Plankton (credit: @alxfazio) is a recommended companion for write-time code quality enforcement. It runs formatters and 20+ linters on every file edit via PostToolUse hooks, then spawns Claude subprocesses (routed to Haiku/Sonnet/Opus by violation complexity) to fix issues the main agent missed. Three-phase architecture: auto-format silently (40-50% of issues), collect remaining violations as structured JSON, delegate fixes to a subprocess. Includes config protection hooks that prevent agents from modifying linter configs to pass instead of fixing code. Supports Python, TypeScript, Shell, YAML, JSON, TOML, Markdown, and Dockerfile. Use alongside AgentShield for security + quality coverage. See skills/plankton-code-quality/ for full integration guide.
The instinct-based learning system automatically learns your patterns:
/instinct-status # Show learned instincts with confidence
/instinct-import <file> # Import instincts from others
/instinct-export # Export your instincts for sharing
/evolve # Cluster related instincts into skills
See skills/continuous-learning-v2/ for full documentation.
Minimum version: v2.1.0 or later
This plugin requires Claude Code CLI v2.1.0+ due to changes in how the plugin system handles hooks.
Check your version:
claude --version
⚠️ For Contributors: Do NOT add a
"hooks"field to.claude-plugin/plugin.json. This is enforced by a regression test.
Claude Code v2.1+ automatically loads hooks/hooks.json from any installed plugin by convention. Explicitly declaring it in plugin.json causes a duplicate detection error:
Duplicate hooks file detected: ./hooks/hooks.json resolves to already-loaded file
History: This has caused repeated fix/revert cycles in this repo (#29, #52, #103). The behavior changed between Claude Code versions, leading to confusion. We now have a regression test to prevent this from being reintroduced.
The easiest way to use this repo - install as a Claude Code plugin:
# Add this repo as a marketplace
/plugin marketplace add affaan-m/everything-claude-code
# Install the plugin
/plugin install everything-claude-code@everything-claude-code
Or add directly to your ~/.claude/settings.json:
{
"extraKnownMarketplaces": {
"everything-claude-code": {
"source": {
"source": "github",
"repo": "affaan-m/everything-claude-code"
}
}
},
"enabledPlugins": {
"everything-claude-code@everything-claude-code": true
}
}
This gives you instant access to all commands, agents, skills, and hooks.
Note: The Claude Code plugin system does not support distributing
rulesvia plugins (upstream limitation). You need to install rules manually:# Clone the repo first git clone https://github.com/affaan-m/everything-claude-code.git # Option A: User-level rules (applies to all projects) mkdir -p ~/.claude/rules cp -r everything-claude-code/rules/common/* ~/.claude/rules/ cp -r everything-claude-code/rules/typescript/* ~/.claude/rules/ # pick your stack cp -r everything-claude-code/rules/python/* ~/.claude/rules/ cp -r everything-claude-code/rules/golang/* ~/.claude/rules/ # Option B: Project-level rules (applies to current project only) mkdir -p .claude/rules cp -r everything-claude-code/rules/common/* .claude/rules/ cp -r everything-claude-code/rules/typescript/* .claude/rules/ # pick your stack
If you prefer manual control over what's installed:
# Clone the repo
git clone https://github.com/affaan-m/everything-claude-code.git
# Copy agents to your Claude config
cp everything-claude-code/agents/*.md ~/.claude/agents/
# Copy rules (common + language-specific)
cp -r everything-claude-code/rules/common/* ~/.claude/rules/
cp -r everything-claude-code/rules/typescript/* ~/.claude/rules/ # pick your stack
cp -r everything-claude-code/rules/python/* ~/.claude/rules/
cp -r everything-claude-code/rules/golang/* ~/.claude/rules/
# Copy commands
cp everything-claude-code/commands/*.md ~/.claude/commands/
# Copy skills (core vs niche)
# Recommended (new users): core/general skills only
cp -r everything-claude-code/.agents/skills/* ~/.claude/skills/
cp -r everything-claude-code/skills/search-first ~/.claude/skills/
# Optional: add niche/framework-specific skills only when needed
# for s in django-patterns django-tdd springboot-patterns; do
# cp -r everything-claude-code/skills/$s ~/.claude/skills/
# done
Copy the hooks from hooks/hooks.json to your ~/.claude/settings.json.
Copy desired MCP servers from mcp-configs/mcp-servers.json to your ~/.claude.json.
Important: Replace YOUR_*_HERE placeholders with your actual API keys.
Subagents handle delegated tasks with limited scope. Example:
---
name: code-reviewer
description: Reviews code for quality, security, and maintainability
tools: ["Read", "Grep", "Glob", "Bash"]
model: opus
---
You are a senior code reviewer...
Skills are workflow definitions invoked by commands or agents:
# TDD Workflow
1. Define interfaces first
2. Write failing tests (RED)
3. Implement minimal code (GREEN)
4. Refactor (IMPROVE)
5. Verify 80%+ coverage
Hooks fire on tool events. Example - warn about console.log:
{
"matcher": "tool == \"Edit\" && tool_input.file_path matches \"\\\\.(ts|tsx|js|jsx)$\"",
"hooks": [{
"type": "command",
"command": "#!/bin/bash\ngrep -n 'console\\.log' \"$file_path\" && echo '[Hook] Remove console.log' >&2"
}]
}
Rules are always-follow guidelines, organized into common/ (language-agnostic) + language-specific directories:
rules/
common/ # Universal principles (always install)
typescript/ # TS/JS specific patterns and tools
python/ # Python specific patterns and tools
golang/ # Go specific patterns and tools
See rules/README.md for installation and structure details.
Not sure where to start? Use this quick reference:
| I want to... | Use this command | Agent used |
|---|---|---|
| Plan a new feature | /everything-claude-code:plan "Add auth" | planner |
| Design system architecture | /everything-claude-code:plan + architect agent | architect |
| Write code with tests first | /tdd | tdd-guide |
| Review code I just wrote | /code-review | code-reviewer |
| Fix a failing build | /build-fix | build-error-resolver |
| Run end-to-end tests | /e2e | e2e-runner |
| Find security vulnerabilities | /security-scan | security-reviewer |
| Remove dead code | /refactor-clean | refactor-cleaner |
| Update documentation | /update-docs | doc-updater |
| Review Go code | /go-review | go-reviewer |
| Review Python code | /python-review | python-reviewer |
| Audit database queries | (auto-delegated) | database-reviewer |
Starting a new feature:
/everything-claude-code:plan "Add user authentication with OAuth"
→ planner creates implementation blueprint
/tdd → tdd-guide enforces write-tests-first
/code-review → code-reviewer checks your work
Fixing a bug:
/tdd → tdd-guide: write a failing test that reproduces it
→ implement the fix, verify test passes
/code-review → code-reviewer: catch regressions
Preparing for production:
/security-scan → security-reviewer: OWASP Top 10 audit
/e2e → e2e-runner: critical user flow tests
/test-coverage → verify 80%+ coverage
/plugin list everything-claude-code@everything-claude-code
This shows all available agents, commands, and skills from the plugin.
This is the most common issue. Do NOT add a "hooks" field to .claude-plugin/plugin.json. Claude Code v2.1+ automatically loads hooks/hooks.json from installed plugins. Explicitly declaring it causes duplicate detection errors. See #29, #52, #103.
Too many MCP servers eat your context. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k.
Fix: Disable unused MCPs per project:
// In your project's .claude/settings.json
{
"disabledMcpServers": ["supabase", "railway", "vercel"]
}
Keep under 10 MCPs enabled and under 80 tools active.
Yes. Use Option 2 (manual installation) and copy only what you need:
# Just agents
cp everything-claude-code/agents/*.md ~/.claude/agents/
# Just rules
cp -r everything-claude-code/rules/common/* ~/.claude/rules/
Each component is fully independent.
Yes. ECC is cross-platform:
.cursor/. See Cursor IDE Support..opencode/. See OpenCode Support..agent/.See CONTRIBUTING.md. The short version:
skills/your-skill-name/SKILL.md (with YAML frontmatter)agents/your-agent.mdThe plugin includes a comprehensive test suite:
# Run all tests
node tests/run-all.js
# Run individual test files
node tests/lib/utils.test.js
node tests/lib/package-manager.test.js
node tests/hooks/hooks.test.js
Contributions are welcome and encouraged.
This repo is meant to be a community resource. If you have:
Please contribute! See CONTRIBUTING.md for guidelines.
ECC provides full Cursor IDE support with hooks, rules, agents, skills, commands, and MCP configs adapted for Cursor's native format.
# Install for your language(s)
./install.sh --target cursor typescript
./install.sh --target cursor python golang swift
| Component | Count | Details |
|---|---|---|
| Hook Events | 15 | sessionStart, beforeShellExecution, afterFileEdit, beforeMCPExecution, beforeSubmitPrompt, and 10 more |
| Hook Scripts | 16 | Thin Node.js scripts delegating to scripts/hooks/ via shared adapter |
| Rules | 29 | 9 common (alwaysApply) + 20 language-specific (TypeScript, Python, Go, Swift) |
| Agents | Shared | Via AGENTS.md at root (read by Cursor natively) |
| Skills | Shared + Bundled | Via AGENTS.md at root and .cursor/skills/ for translated additions |
| Commands | Shared | .cursor/commands/ if installed |
| MCP Config | Shared | .cursor/mcp.json if installed |
Cursor has more hook events than Claude Code (20 vs 8). The .cursor/hooks/adapter.js module transforms Cursor's stdin JSON to Claude Code's format, allowing existing scripts/hooks/*.js to be reused without duplication.
Cursor stdin JSON → adapter.js → transforms → scripts/hooks/*.js
(shared with Claude Code)
Key hooks:
Cursor rules use YAML frontmatter with description, globs, and alwaysApply:
---
description: "TypeScript coding style extending common rules"
globs: ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
alwaysApply: false
---
ECC provides first-class Codex support for both the macOS app and CLI, with a reference configuration, Codex-specific AGENTS.md supplement, and shared skills.
# Copy the reference config to your home directory
cp .codex/config.toml ~/.codex/config.toml
# Run Codex CLI in the repo — AGENTS.md is auto-detected
codex
Codex macOS app:
AGENTS.md is auto-detected..codex/config.toml to ~/.codex/config.toml for CLI/app behavior consistency.| Component | Count | Details |
|---|---|---|
| Config | 1 | .codex/config.toml — model, permissions, MCP servers, persistent instructions |
| AGENTS.md | 2 | Root (universal) + .codex/AGENTS.md (Codex-specific supplement) |
| Skills | 16 | .agents/skills/ — SKILL.md + agents/openai.yaml per skill |
| MCP Servers | 4 | GitHub, Context7, Memory, Sequential Thinking (command-based) |
| Profiles | 2 | strict (read-only sandbox) and yolo (full auto-approve) |
Skills at .agents/skills/ are auto-loaded by Codex:
| Skill | Description |
|---|---|
| tdd-workflow | Test-driven development with 80%+ coverage |
| security-review | Comprehensive security checklist |
| coding-standards | Universal coding standards |
| frontend-patterns | React/Next.js patterns |
| frontend-slides | HTML presentations, PPTX conversion, visual style exploration |
| article-writing | Long-form writing from notes and voice references |
| content-engine | Platform-native social content and repurposing |
| market-research | Source-attributed market and competitor research |
| investor-materials | Decks, memos, models, and one-pagers |
| investor-outreach | Personalized outreach, follow-ups, and intro blurbs |
| backend-patterns | API design, database, caching |
| e2e-testing | Playwright E2E tests |
| eval-harness | Eval-driven development |
| strategic-compact | Context management |
| api-design | REST API design patterns |
| verification-loop | Build, test, lint, typecheck, security |
Codex does not yet provide Claude-style hook execution parity. ECC enforcement there is instruction-based via AGENTS.md and persistent_instructions, plus sandbox permissions.
ECC provides full OpenCode support including plugins and hooks.
# Install OpenCode
npm install -g opencode
# Run in the repository root
opencode
The configuration is automatically detected from .opencode/opencode.json.
| Feature | Claude Code | OpenCode | Status |
|---|---|---|---|
| Agents | ✅ 16 agents | ✅ 12 agents | Claude Code leads |
| Commands | ✅ 40 commands | ✅ 31 commands | Claude Code leads |
| Skills | ✅ 65 skills | ✅ 37 skills | Claude Code leads |
| Hooks | ✅ 8 event types | ✅ 11 events | OpenCode has more! |
| Rules | ✅ 29 rules | ✅ 13 instructions | Claude Code leads |
| MCP Servers | ✅ 14 servers | ✅ Full | Full parity |
| Custom Tools | ✅ Via hooks | ✅ 6 native tools | OpenCode is better |
OpenCode's plugin system is MORE sophisticated than Claude Code with 20+ event types:
| Claude Code Hook | OpenCode Plugin Event |
|---|---|
| PreToolUse | tool.execute.before |
| PostToolUse | tool.execute.after |
| Stop | session.idle |
| SessionStart | session.created |
| SessionEnd | session.deleted |
Additional OpenCode events: file.edited, file.watcher.updated, message.updated, lsp.client.diagnostics, tui.toast.show, and more.
| Command | Description |
|---|---|
/plan | Create implementation plan |
/tdd | Enforce TDD workflow |
/code-review | Review code changes |
/build-fix | Fix build errors |
/e2e | Generate E2E tests |
/refactor-clean | Remove dead code |
/orchestrate | Multi-agent workflow |
/learn | Extract patterns from session |
/checkpoint | Save verification state |
/verify | Run verification loop |
/eval | Evaluate against criteria |
/update-docs | Update documentation |
/update-codemaps | Update codemaps |
/test-coverage | Analyze coverage |
/go-review | Go code review |
/go-test | Go TDD workflow |
/go-build | Fix Go build errors |
/python-review | Python code review (PEP 8, type hints, security) |
/multi-plan | Multi-model collaborative planning |
/multi-execute | Multi-model collaborative execution |
/multi-backend | Backend-focused multi-model workflow |
/multi-frontend | Frontend-focused multi-model workflow |
/multi-workflow | Full multi-model development workflow |
/pm2 | Auto-generate PM2 service commands |
/sessions | Manage session history |
/skill-create | Generate skills from git |
/instinct-status | View learned instincts |
/instinct-import | Import instincts |
/instinct-export | Export instincts |
/evolve | Cluster instincts into skills |
/promote | Promote project instincts to global scope |
/projects | List known projects and instinct stats |
/learn-eval | Extract and evaluate patterns before saving |
/setup-pm | Configure package manager |
/harness-audit | Audit harness reliability, eval readiness, and risk posture |
/loop-start | Start controlled agentic loop execution pattern |
/loop-status | Inspect active loop status and checkpoints |
/quality-gate | Run quality gate checks for paths or entire repo |
/model-route | Route tasks to models by complexity and budget |
Option 1: Use directly
cd everything-claude-code
opencode
Option 2: Install as npm package
npm install ecc-universal
Then add to your opencode.json:
{
"plugin": ["ecc-universal"]
}
.opencode/MIGRATION.md.opencode/README.md.opencode/instructions/INSTRUCTIONS.mdllms.txt (complete OpenCode docs for LLMs)ECC is the first plugin to maximize every major AI coding tool. Here's how each harness compares:
| Feature | Claude Code | Cursor IDE | Codex CLI | OpenCode |
|---|---|---|---|---|
| Agents | 16 | Shared (AGENTS.md) | Shared (AGENTS.md) | 12 |
| Commands | 40 | Shared | Instruction-based | 31 |
| Skills | 65 | Shared | 10 (native format) | 37 |
| Hook Events | 8 types | 15 types | None yet | 11 types |
| Hook Scripts | 20+ scripts | 16 scripts (DRY adapter) | N/A | Plugin hooks |
| Rules | 29 (common + lang) | 29 (YAML frontmatter) | Instruction-based | 13 instructions |
| Custom Tools | Via hooks | Via hooks | N/A | 6 native tools |
| MCP Servers | 14 | Shared (mcp.json) | 4 (command-based) | Full |
| Config Format | settings.json | hooks.json + rules/ | config.toml | opencode.json |
| Context File | CLAUDE.md + AGENTS.md | AGENTS.md | AGENTS.md | AGENTS.md |
| Secret Detection | Hook-based | beforeSubmitPrompt hook | Sandbox-based | Hook-based |
| Auto-Format | PostToolUse hook | afterFileEdit hook | N/A | file.edited hook |
| Version | Plugin | Plugin | Reference config | 1.8.0 |
Key architectural decisions:
persistent_instructions and sandbox permissionsI've been using Claude Code since the experimental rollout. Won the Anthropic x Forum Ventures hackathon in Sep 2025 building zenith.chat with @DRodriguezFX - entirely using Claude Code.
These configs are battle-tested across multiple production applications.
Claude Code usage can be expensive if you don't manage token consumption. These settings significantly reduce costs without sacrificing quality.
Add to ~/.claude/settings.json:
{
"model": "sonnet",
"env": {
"MAX_THINKING_TOKENS": "10000",
"CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "50"
}
}
| Setting | Default | Recommended | Impact |
|---|---|---|---|
model | opus | sonnet | ~60% cost reduction; handles 80%+ of coding tasks |
MAX_THINKING_TOKENS | 31,999 | 10,000 | ~70% reduction in hidden thinking cost per request |
CLAUDE_AUTOCOMPACT_PCT_OVERRIDE | 95 | 50 | Compacts earlier — better quality in long sessions |
Switch to Opus only when you need deep architectural reasoning:
/model opus
| Command | When to Use |
|---|---|
/model sonnet | Default for most tasks |
/model opus | Complex architecture, debugging, deep reasoning |
/clear | Between unrelated tasks (free, instant reset) |
/compact | At logical task breakpoints (research done, milestone complete) |
/cost | Monitor token spending during session |
The strategic-compact skill (included in this plugin) suggests /compact at logical breakpoints instead of relying on auto-compaction at 95% context. See skills/strategic-compact/SKILL.md for the full decision guide.
When to compact:
When NOT to compact:
Critical: Don't enable all MCPs at once. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k.
disabledMcpServers in project config to disable unused onesAgent Teams spawns multiple context windows. Each teammate consumes tokens independently. Only use for tasks where parallelism provides clear value (multi-module work, parallel reviews). For simple sequential tasks, subagents are more token-efficient.
Hitting daily limits? See the Token Optimization Guide for recommended settings and workflow tips.
Quick wins:
// ~/.claude/settings.json
{
"model": "sonnet",
"env": {
"MAX_THINKING_TOKENS": "10000",
"CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "50",
"CLAUDE_CODE_SUBAGENT_MODEL": "haiku"
}
}
Use /clear between unrelated tasks, /compact at logical breakpoints, and /cost to monitor spending.
These configs work for my workflow. You should:
This project is free and open source. Sponsors help keep it maintained and growing.
Become a Sponsor | Sponsor Tiers | Sponsorship Program
MIT - Use freely, modify as needed, contribute back if you can.
Star this repo if it helps. Read both guides. Build something great.
FAQs
Complete collection of battle-tested Claude Code configs — agents, skills, hooks, commands, and rules evolved over 10+ months of intensive daily use by an Anthropic hackathon winner
The npm package ecc-universal receives a total of 991 weekly downloads. As such, ecc-universal popularity was classified as not popular.
We found that ecc-universal demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.