
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Platform-agnostic AI development methodology with TDD, quality gates, and structured workflows
A structured development methodology for AI coding assistants.
Installation · Quick Start · When to Use It · How It Works · Commands · Docs
The KnowzCode source repo now has two parallel distribution shapes:
./../plugins/knowzcodeThe Codex package is additive. It does not replace the existing Claude-oriented source layout.
AI coding assistants lack structure. Without it, they:
KnowzCode is a platform-agnostic development methodology that lives in your project's knowzcode/ directory.
KnowzCode adds overhead. Use it when the cost of getting implementation wrong is higher than the cost of being systematic.
Native agent mode is usually enough for:
Reach for KnowzCode when:
Every feature follows a structured loop with quality gates between phases:
Goal -> Analyze -> Approve -> Design -> Approve -> Build -> Audit -> Approve -> Ship
KnowzCode automatically classifies tasks by complexity:
/knowzcode:fix)/plugin marketplace add knowz-io/knowz-skills
/plugin install knowzcode@knowz-skills
cd your-project/
/knowzcode:init
/knowzcode:work "Build user authentication"
The packaged Codex plugin lives at ../plugins/knowzcode.
That package currently contains:
skills/ for discoverable KnowzCode workflowsknowzcode/ support content required by the workflows.codex-plugin/plugin.json for Codex plugin metadataIt intentionally does not ship Claude-style agent-team definitions as active Codex package content. Codex workflows use Codex-native skills and, when needed, Codex-native delegation primitives.
This gives you a Codex-local plugin packaging shape in the repo. It is separate from the CLI-generated cross-platform install flow described below.
npx knowzcode
npx knowzcode install --platforms claude,gemini
npx knowzcode install --platforms all
Primary:
| Platform | Shape |
|---|---|
| Claude Code | Plugin marketplace + Claude-oriented source product |
| OpenAI Codex | Discoverable skills and packaged local plugin artifacts |
| Gemini CLI | Native commands, skills, and adapter files |
Additional adapters: Cursor, GitHub Copilot, and Windsurf.
/knowzcode:work "Build user authentication with email and password"
/knowzcode:explore "how is authentication implemented?"
/knowzcode:fix "Fix typo in login button text"
| Command | Description |
|---|---|
/knowzcode:init | Initialize KnowzCode in project |
/knowzcode:work <goal> | Start feature workflow |
/knowzcode:explore <topic> | Research before implementing |
/knowzcode:audit [type] | Run quality audits |
/knowzcode:fix <target> | Quick targeted fix |
/knowzcode:status | Check status |
/knowzcode:telemetry | Investigate production telemetry |
/knowzcode:telemetry-setup | Configure telemetry sources |
/knowzcode:continue | Resume active workflow |
/knowzcode:start-work | Redirect implementation intent into /knowzcode:work |
Current Codex support in this repo is split between:
../plugins/knowzcodeKey Codex rules for this repo:
AGENTS.md is optional supporting context, not the required package mechanismcodex mcp add or ~/.codex/config.toml)node ../scripts/validate-platform-surfaces.mjsyour-project/
└── knowzcode/
├── knowzcode_loop.md
├── knowzcode_project.md
├── knowzcode_architecture.md
├── knowzcode_tracker.md
├── knowzcode_log.md
├── specs/
├── prompts/
├── workgroups/
└── enterprise/
| Guide | Description |
|---|---|
| Getting Started | Walkthrough, MCP setup, file structure |
| Understanding KnowzCode | Concepts and architecture deep dive |
| Workflow Reference | Phase details and orchestration |
| Prompts Guide | Prompt templates and command reference |
| Product | Purpose |
|---|---|
| knowz | MCP vault features such as setup, registration, learning capture, and flush |
KnowzCode works without the companion product, but Knowz adds vault-backed memory and knowledge workflows.
Enterprises that self-host the Knowz platform can customize endpoints and branding by creating an enterprise.json file in the plugin root:
{
"brand": "Acme Corp",
"mcp_endpoint": "https://mcp.acme.internal/mcp",
"api_endpoint": "https://api.acme.internal/api/v1"
}
Fork -> branch -> PR. See CLAUDE.md for developer docs.
MIT License with Commons Clause - see LICENSE for details.
FAQs
Platform-agnostic AI development methodology with TDD, quality gates, and structured workflows
The npm package knowzcode receives a total of 55 weekly downloads. As such, knowzcode popularity was classified as not popular.
We found that knowzcode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.