
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
kodelyth-ecc
Advanced tools
Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) tha
Kodelyth ECC is a production-grade AI coding toolkit — 70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 194 skills, 97 commands, a god-tier semantic intent-routing system, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
Works with Claude Code, Windsurf, Cursor, Codex CLI, Google Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, and Gemini CLI.
No telemetry. No cloud. Just rules, agents, skills, MCP server, and your own private memory store — all on your disk. The local dashboard gives you full visibility without sending anything anywhere.
Most "AI agent kits" are folders of markdown files you have to remember the names of. ECC is infrastructure — a layered system where intent routing, compound memory, parallel orchestration, and quality hooks all reinforce each other.
You: "I've been staring at this NullPointerException for two hours,
I'm losing my mind."
AI: → Routing to debug-detective (your error + frustration matches the bug-tracking signal)
That kind of bug is exhausting — let's trace it properly so we
fix the root cause, not the symptom.
First, can you share the full stack trace and...
You never typed use debug-detective. You didn't have to. The toolkit read the intent, picked the specialist, and announced the routing. Next time you can invoke it directly — but you don't have to remember names to get senior-grade help.
| Layer | What it does | Other kits |
|---|---|---|
| Intent routing | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
| 70 agents | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
| 194 skills | Domain knowledge files agents read on demand | Rarely separated from agents |
| 97 commands | Slash workflows (/tdd, /devil-mode, /team-review) | Limited or none |
| 8 parallel commands | Fire 3-8 agents simultaneously, aggregate results | Rare |
| Compound memory | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
| 22+ hooks | Quality gates, secret scan, project-DNA detection | Often missing |
| 11 IDE platforms | Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI (13 install targets) | 1-2 platforms typical |
| Zero telemetry | Everything stays on your disk; verifiable | Many kits phone home |
| Feature | Kodelyth ECC | agency-agents | awesome-claude-agents | Generic prompt libs |
|---|---|---|---|---|
| Specialist agents | 70 | ~30 | ~20 | Varies |
| Skills as separate layer | ✅ 194 | ❌ | ❌ | ❌ |
| Slash commands | ✅ 97 | Some | Some | ❌ |
| Parallel multi-agent commands | ✅ 8 (incl. /devil-mode) | ❌ | ❌ | ❌ |
| Intent routing (plain language → agent) | ✅ 10-tier rule | ❌ | ❌ | ❌ |
| Local BM25 self-learning memory | ✅ | ❌ | ❌ | ❌ |
| Compound learning from corrections | ✅ tasks/lessons.md | ❌ | ❌ | ❌ |
| Adversarial / red-team agents | ✅ 8 (devil-mode) | ❌ | ❌ | ❌ |
| Quality hooks | ✅ 22+ | Some | ❌ | ❌ |
| IDE platforms | 11 (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
| Telemetry | ❌ none | Varies | ❌ | Varies |
| Test coverage | ✅ 373 tests | ❌ | ❌ | ❌ |
| Distributed via | npx, curl, clone | Manual | Manual | Manual |
npx kodelyth-ecc # Claude Code (default)
npx kodelyth-ecc --target windsurf-project # Windsurf (per-project)
npx kodelyth-ecc --target windsurf-home # Windsurf (global)
npx kodelyth-ecc --target cursor-project # Cursor IDE
npx kodelyth-ecc --target codex-home # Codex CLI
npx kodelyth-ecc --target antigravity # Google Antigravity
npx kodelyth-ecc --target opencode # OpenCode
npx kodelyth-ecc --target cline # Cline (VS Code)
npx kodelyth-ecc --target roocode # Roo Code (VS Code)
npx kodelyth-ecc --target aider # Aider terminal agent
npx kodelyth-ecc --target kimi # Kimi Code
npx kodelyth-ecc --target gemini-project # Gemini CLI (project)
npx kodelyth-ecc --target gemini-home # Gemini CLI (global)
Node.js 18+ required. Download Node if you don't have it.
Feature depth varies by platform — hooks are a Claude Code native format, and some platforms have no agent/command concept:
| Platform | Agents | Skills | Commands | Hooks | Rules |
|---|---|---|---|---|---|
| Claude Code | ✓ 70 | ✓ 194 | ✓ 97 | ✓ 22+ | ✓ |
| Roo Code | ✓ | ✓ | ✓ | — | ✓ |
| Codex CLI | ✓ | ✓ | ✓ | — | ✓ |
| Aider | ✓ | ✓ | ✓ | — | ✓ |
| Kimi | ✓ | ✓ | ✓ | — | ✓ |
| Windsurf | ✓ | ✓ | — | — | ✓ |
| Antigravity | ✓ | partial | ✓ | — | ✓ |
| Gemini CLI | ✓ | ✓ | — | — | ✓ |
| Cursor | — | ✓ | — | — | ✓ |
| Cline | ✓ | — | ✓ | — | ✓ |
| OpenCode | — | — | — | — | ✓ |
Hooks use Claude Code's JSON settings format — no equivalent exists on other platforms. Cursor reads rules and skills from .cursor/; its agent system uses a different format not yet compatible with ECC agents.
Memory storage is a single shared file at ~/.kodelyth/memory/memories.jsonl — every IDE on the same machine reads and writes the same memories. The only thing that varies is how memories surface:
| Platform | Auto-recall on every prompt | Auto-capture on success | Manual recall via MCP tool | Dashboard "Live IDE activity" |
|---|---|---|---|---|
| Claude Code | ✓ (hook) | ✓ (hook) | ✓ | ✓ Claude session files |
| Windsurf | — | — | ✓ recall_memory | ✓ Windsurf + Windsurf-Next state |
| Cursor | — | — | ✓ recall_memory | ✓ workspace storage dirs |
| Codex CLI | — | — | ✓ recall_memory | — |
| Antigravity | — | — | ✓ recall_memory | ✓ .agent/ in cwd |
| Roo Code / Aider / Kimi / Cline / Gemini CLI / OpenCode | — | — | ✓ if MCP-capable | — |
What this means in practice:
rules/common/memory-protocol.md rule (installed automatically) tells the AI to call the recall_memory MCP tool proactively at the start of substantive prompts.KODELYTH_EXTRA_IDE_WATCH env var (comma-separated).# Watch additional paths in the dashboard
export KODELYTH_EXTRA_IDE_WATCH="$HOME/my-agent-logs,$HOME/other-tool/state"
npx kodelyth-ecc dashboard
npx github:sifxprime/kodelyth-ecc
Same --target flags work.
curl -fsSL https://raw.githubusercontent.com/sifxprime/kodelyth-ecc/main/install.sh | bash
With a target:
curl -fsSL https://raw.githubusercontent.com/sifxprime/kodelyth-ecc/main/install.sh | bash -s -- --target windsurf-project
Pre-configured for who you actually are:
npx kodelyth-ecc --bundle indie-hacker # Solo founder / SaaS — ship fast, validate, harden
npx kodelyth-ecc --bundle red-team # Security engineer — devil-mode + adversarial workflows
npx kodelyth-ecc --bundle enterprise # Compliance / audit team — SBOM, license, supply chain
Each bundle installs the full ECC toolkit (all 70 agents, 194 skills, 97 commands, 22+ hooks), adds a BUNDLE.md cheat sheet, and biases the AI toward audience-fit workflows on every session.
Combine with any target:
npx kodelyth-ecc --bundle red-team --target windsurf-project
npx kodelyth-ecc --bundle enterprise --target codex-home
npx kodelyth-ecc --bundle indie-hacker --target antigravity
git clone https://github.com/sifxprime/kodelyth-ecc.git
cd kodelyth-ecc
# macOS / Linux
./install.sh # Claude Code (default)
./install.sh --target windsurf-project # Windsurf
# Windows (PowerShell)
.\install.ps1
.\install.ps1 -Target windsurf-project
Run ECC as a Model Context Protocol server and consume it from Claude Desktop, LangGraph, AutoGen, CrewAI, OpenAI Agents SDK, Cursor, Windsurf — anything that speaks MCP.
npx kodelyth-ecc mcp # stdio JSON-RPC server
What it exposes (all local, zero telemetry):
route_intent, recall_memory, capture_memory, list_agents, get_skill, audit_skill_match, …kodelyth://... URIsDrop into Claude Desktop in 30 seconds:
// claude_desktop_config.json
{
"mcpServers": {
"kodelyth-ecc": {
"command": "npx",
"args": ["-y", "kodelyth-ecc", "mcp"]
}
}
}
Full reference: docs/mcp.md.
The toolkit ships with a single rule file (rules/common/agent-intent-routing.md) that the AI loads automatically on every session. It maps what you say to the right specialist agent across 10 priority tiers.
1. Explicit — type it directly:
use debug-detective
@code-reviewer
invoke security-reviewer
2. Implicit — just describe your problem; the AI routes you:
| What you write | Auto-routed to |
|---|---|
| "I'm stuck, no idea where to start" | kodelyth-advisor |
| "I've been debugging this for hours" | debug-detective |
| "nothing works, driving me crazy" | debug-detective |
| "Should I use Context or Zustand?" | pair-programmer |
| "help me build a todo app" | /project-launch |
| "I have this idea for a SaaS dashboard" | /project-launch |
| "I'm starting a new side project" | /project-launch |
| "can you review my code?" | code-reviewer or /team-review |
| "review my project before I deploy" | /team-review |
| "is my project ready to ship?" | /team-review |
| "my site looks plain, needs visuals" | image-architect |
| "I need an OG image for my app" | image-architect |
| "remember we always use pnpm here" | /lessons |
| "Build failed on Vercel" | build-error-resolver |
| "Is this JWT signing secure?" | security-reviewer |
| "Why is this so slow?" | performance-optimizer |
| "Plan the v2 migration" | planner + migration-guide |
| "Tests pass locally but fail on CI" | flake-hunter + env-debugger |
"I lost my commits after reset --hard" | git-rescue |
| "npm install is failing" | dependency-doctor |
| "Cut a 1.4 release" | release-captain |
| "Add accessibility to this form" | ux-reviewer |
| "Open-source this project" | opensource-forker (chain) |
| [paste code with no text] | code-reviewer |
| [paste stack trace with no text] | debug-detective |
The AI always announces which agent is taking over (→ Routing to <agent>) and always teaches you the explicit form for next time (Tip: type "use <agent>"). No silent personality changes.
Real problems span multiple specialties. ECC ships standard handoff chains:
pair-programmer → tdd-guide → code-reviewer → security-reviewer
(approach) (write tests) (review impl) (auth, validation)
debug-detective → tdd-guide → refactor-cleaner
(root cause) (regression test) (cleanup)
opensource-forker → opensource-sanitizer → opensource-packager → release-captain
(clean fork) (strip secrets) (README, license) (cut v0.1.0)
See skills/agent-handoff/SKILL.md for the full handoff protocol and standard chains.
Eight commands fire multiple specialist agents simultaneously and aggregate their results into a single structured report.
| Command | Agents Fired | Time Saved |
|---|---|---|
/project-launch | architect + pair-programmer + security-reviewer + tdd-guide + ux-reviewer | 45 min → 10 min |
/team-review | code-reviewer + security-reviewer + performance-optimizer + api-guardian | 60 min → 15 min |
/security-audit | security-reviewer + dependency-doctor + api-guardian | 30 min → 8 min |
/debug-blitz | debug-detective + silent-failure-hunter + env-debugger | 60 min → 15 min |
/refactor-sprint | refactor-cleaner + code-simplifier + type-design-analyzer + tdd-guide | 45 min → 12 min |
/pre-release | release-captain + security-reviewer + code-reviewer | 30 min → 8 min |
/onboard | code-explorer + architect + doc-updater | 45 min → 12 min |
/devil-mode | 8 adversarial agents (see below) | Hours → 20 min |
Each command waits for all agents to complete, then returns a single Team Review Report with findings bucketed by severity: CRITICAL → HIGH → MEDIUM → LOW.
8 adversarial agents that read your codebase the way an attacker would. Fire them in parallel with /devil-mode:
/devil-mode --pre-public # before going open-source — full secret/license/IP sweep
/devil-mode --pre-launch # before launch — adds AI red-team + chaos planning
/devil-mode --all # all 8 adversarial agents in parallel
The crew: prompt-injection-hunter, supply-chain-auditor, secret-hunter, license-violation-finder, jailbreak-tester, code-stealer-detector, backdoor-hunter, chaos-engineer. Each ships with real bash-grep patterns, severity calibration, and remediation playbooks — not theatrical personas.
You have a working, real-time dashboard. One command launches it:
npx kodelyth-ecc dashboard
# Opens http://127.0.0.1:5747 in your browser
What's inside:
| Tab | What you see |
|---|---|
| Overview | Agent count, memory stats, session count, recent activity |
| Memory | Browse, search, and manage your local BM25 memory store |
| Evolve | Self-improving memory — review AI-proposed refinements |
| Catalog | Full searchable index of all 70 agents, 194 skills, 97 commands |
| Sessions | Live IDE activity (Claude Code, Windsurf, Windsurf-Next, Cursor, Antigravity) + orchestration/swarm sessions |
Real-time:
KODELYTH_EXTRA_IDE_WATCH=path1,path2 to watch additional pathsSecurity design:
Content-Security-Policy, X-Frame-Options, X-Content-Type-Options on every responseFull reference: docs/dashboard.md.
The first time you solve a hard problem, ECC remembers what worked. The next time you hit something similar, your AI surfaces the past solution before you ask.
Session 1 (March):
You: "Stripe webhook signatures are failing in production"
AI: [helps you debug, you discover raw body parser is required]
You: "Perfect, that worked, thanks"
→ ECC's Stop hook queues the lesson for review.
→ You confirm with /memory review-pending → stored locally.
Session 2 (August, new project):
You: "I need to add Stripe webhooks to checkout"
AI: I checked your memory — you solved this exact problem in March.
Raw body parser before signature validation, test with stripe-cli
not curl. Want me to apply the same pattern?
You: "Yes, do it"
→ 30 minutes of past debugging saved in 3 seconds.
| Layer | Mechanism |
|---|---|
| Capture | A Stop hook scans your session JSONL, extracts (problem, approach, gotchas, tags). Queues for your review — never auto-stores. |
| Storage | ~/.kodelyth/memory/memories.jsonl — append-only log on your disk only. Override with KODELYTH_MEMORY_DIR. |
| Retrieval | BM25 keyword + tag search. Pure JS, sub-millisecond, no embeddings, no network. |
| Session-start injection | A SessionStart hook builds a cache-friendly context block: stable prefix (your patterns + recent project memories) → variable suffix (relevant to current task). |
| Auto chat detection | A UserPromptSubmit hook watches every message you type, runs BM25 search on it, and injects relevant memories before the AI responds. Per-session repeat suppression. |
| Cost win | The stable prefix sits in the prompt cache. Anthropic charges 10% on cached tokens (5-min TTL); OpenAI auto-caches prefixes ≥1024 tokens. Long sessions become dramatically cheaper. |
Every byte stays on your machine. Verify any time with ls -la ~/.kodelyth/memory/. Sync across machines is opt-in (Dropbox/iCloud/git on that folder).
/memory # Stats and recent memories
/memory recall <query> # BM25 search
/memory remember "<title>" # Capture (interactive — confirms before storing)
/memory review-pending # Review Stop-hook candidates
/memory forget <id> # Soft-delete a memory
/memory inject [--query <text>] # Print what your AI sees about you
/memory remember still does.See skills/kodelyth-memory/SKILL.md for the full design + CLI reference.
Every correction you give Claude gets encoded into your project permanently. The toolkit gets smarter every session without any effort from you.
Session 1: You type "use pnpm not npm"
→ Session ends
→ capture-correction.js scans the JSONL
→ Writes to tasks/lessons.md: "- use pnpm not npm"
Session 2: read-lessons.js fires at session start
→ Injects: "PROJECT LESSONS — HARD RULES: - use pnpm not npm"
→ Claude uses pnpm without being told
Month 1: 10+ corrections stacked
→ Claude knows your naming style, preferred patterns, tech opinions
→ Zero ramp-up time on any new task
Month 3: You try another tool
→ It uses npm. It uses the wrong pattern. It asks basic questions.
→ You come back.
| Layer | File | Scope | How it works |
|---|---|---|---|
| Project Lessons | tasks/lessons.md | Per-project | Hard rules from your corrections. Injected at session start as mandatory context. |
| Global Memory | ~/.kodelyth/memory/ | Cross-project | BM25 fuzzy recall of past solutions. Auto-fires on every prompt you type. |
| Intent Routing | 70 agents | Always-on | Routes your message to the right specialist from the first word. No names needed. |
capture-correction.js — Stop hook, runs async at session end:
"no don't", "use X instead", "stop doing Y", "we always", "wrong approach", etc.)tasks/lessons.md with date groupingread-lessons.js — SessionStart hook, fires first before any other hook:
tasks/lessons.md and formats rules as PROJECT LESSONS — HARD RULES blocktasks/todo.md items into session contexttasks/lessons.md — your project's rulebookEdit it freely. Add rules manually. Remove rules that no longer apply. It's a plain markdown file at tasks/lessons.md in your project root.
# Claude Lessons
Project: **my-app**
## 2026-05-06
- use pnpm not npm
- never add try/catch without logging the error first
- we use Zod for validation, not Yup
- component files go in src/components, not src/app
| Component | Count | Description |
|---|---|---|
| Agents | 70 | Specialist subagents — reviewers, planners, debuggers, architects, devil-mode adversarial crew, incident-commander, load-tester, memory, image-architect |
| Skills | 194 | Domain knowledge — patterns, testing, security, DevOps, intent routing, memory |
| Commands | 97 | Slash command workflows (/tdd, /plan, /memory, /devil-mode, /doctor, /update, etc.) |
| Parallel commands | 8 | /devil-mode, /team-review, /security-audit, /debug-blitz, /refactor-sprint, /pre-release, /onboard, /project-launch |
| Hooks | 22+ | Quality gates, secret scanning, branch checks, memory inject + capture + correction + project DNA |
| Rules | 14 | Always-on coding standards + intent routing + memory protocol + self-improvement workflow |
| Memory | local | BM25-indexed personal memory at ~/.kodelyth/memory/ (zero deps) |
| Agent | One-line job |
|---|---|
kodelyth-advisor | Master guide — picks the right tool when you don't know where to start |
kodelyth-memory | Curates your local memory — recalls past solutions, captures new ones |
pair-programmer | The engineer who sits next to you before you write the code |
debug-detective | Never guesses — traces every bug to root cause |
silent-failure-hunter | Finds bugs that don't throw errors |
incident-commander | Runs production incidents — triage, contain, postmortem. P0s only. |
load-tester | Load and stress testing — k6, Locust, Artillery, capacity planning |
ux-reviewer | Reviews UX behavior + WCAG 2.1 AA accessibility (never touches design) |
api-guardian | Detects breaking API changes before they ship |
migration-guide | Framework / language version upgrades, phase by phase |
dependency-doctor | npm/pip/cargo/maven hell — CVE triage, lockfile diagnosis |
git-rescue | Recovers from broken git states without destroying history |
release-captain | Owns the release ritual — semver, tagging, publishing, rollback |
env-debugger | "Works on my machine" hunter — env, config, secrets, layers |
flake-hunter | Stabilizes flaky tests — never adds blind retries |
image-architect | AI image generation — Gemini/DALL-E/fal.ai/SVG, platform-aware |
| Category | Agents |
|---|---|
| Guidance | kodelyth-advisor, pair-programmer, planner, architect, code-architect, chief-of-staff, migration-guide |
| Code Review | code-reviewer, typescript-reviewer, python-reviewer, go-reviewer, rust-reviewer, java-reviewer, kotlin-reviewer, cpp-reviewer, csharp-reviewer, flutter-reviewer, database-reviewer, healthcare-reviewer |
| Build Fixers | build-error-resolver, go-build-resolver, rust-build-resolver, java-build-resolver, kotlin-build-resolver, cpp-build-resolver, dart-build-resolver, pytorch-build-resolver, dependency-doctor, env-debugger |
| Debugging | debug-detective, silent-failure-hunter, flake-hunter |
| Incident & Load | incident-commander, load-tester |
| Security & API | security-reviewer, api-guardian |
| Performance | performance-optimizer |
| Quality | refactor-cleaner, code-simplifier, type-design-analyzer |
| Testing | tdd-guide, e2e-runner, pr-test-analyzer, flake-hunter |
| Documentation | doc-updater, docs-lookup, comment-analyzer |
| Release & Ops | release-captain, git-rescue |
| Open Source | opensource-forker, opensource-packager, opensource-sanitizer |
| Specialized | seo-specialist, ux-reviewer, code-explorer |
Once installed (Claude Code target), these hooks run automatically with zero configuration:
| Hook | What it does |
|---|---|
| Session start — lessons | Reads tasks/lessons.md and injects your hard rules + project DNA as context |
| Session start — memory | Loads relevant past solutions from global BM25 memory |
| Auto chat recall | Watches every prompt, injects relevant memories before AI responds |
| Correction capture | Detects when you correct Claude, encodes the rule to tasks/lessons.md |
| Pre-commit | Catches console.log, secrets, bad commit messages |
| Quality gate | Runs type checks and formatting after edits |
| Git push reminder | Prompts review before pushing |
| Config protection | Blocks weakening of linter/formatter configs |
| Desktop notify | macOS notification when a long task finishes |
| MCP health check | Validates MCP servers before calling them |
| Test reminder | Prompts to write tests when code is edited without tests |
| Branch name check | Blocks git branches that don't match naming convention |
/kodelyth-quickstart
use kodelyth-advisor # Not sure what to do? Start here
use pair-programmer # Think through approach before writing code
use planner # Plan a feature before writing code
use code-reviewer # Review after writing code
use debug-detective # Trace a bug to its root cause
use api-guardian # Check API changes for breaking contracts
use security-reviewer # Review security-sensitive code
use ux-reviewer # Review frontend UX and accessibility
use migration-guide # Upgrading a framework or language version
use tdd-guide # Write tests the right way
use performance-optimizer # Diagnose and fix slowness
use dependency-doctor # npm/pip/cargo dep hell
use git-rescue # Broken git state, lost commits, bad rebase
use release-captain # Cut a clean release with rollback plan
use env-debugger # "Works on my machine" — env/config/secrets
use flake-hunter # Stabilize flaky tests
The intent router will route you to the right one. The AI announces who's taking over, helps you, and tells you the explicit name for next time.
/typescript-patterns # TypeScript + React + Next.js
/python-patterns # Python best practices
/golang-patterns # Go best practices
/postgres-patterns # Database patterns
/docker-patterns # Container patterns
/coding-standards # Universal baseline
/git-mastery # Trunk-based dev, rebase, bisect, monorepos
/observability # Structured logging, metrics, OpenTelemetry, SLOs
/smart-debug # Systematic debugging framework
/intent-routing # How the auto-routing system works
/agent-handoff # Standard multi-agent handoff chains
~/.claude/| Source | Destination | What it does |
|---|---|---|
agents/ | ~/.claude/agents/ | All 70 subagents available globally |
skills/ | ~/.claude/skills/ | All 194 skills loadable via commands |
hooks/hooks.json | ~/.claude/hooks/ | Automated quality gates |
rules/ | ~/.claude/rules/ | Always-on standards + intent routing |
commands/ | ~/.claude/commands/ | Slash commands (/tdd, /plan, etc.) |
.windsurf/ (project) or ~/.codeium/windsurf/ (global)| Source | Destination | Notes |
|---|---|---|
agents/ | .windsurf/agents/ | Call with use <agent-name> in Cascade |
skills/ | .windsurf/skills/ | Domain knowledge, loadable via chat |
rules/ | .windsurf/rules/ | Flattened rule files |
rules/common/ | .windsurfrules | Concatenated — Windsurf reads this automatically every session |
.cursor/ in project root| Source | Destination |
|---|---|
rules/ | .cursor/rules/ |
skills/ | .cursor/skills/ |
~/.codex/| Source | Destination |
|---|---|
agents/ | ~/.codex/agents/ |
skills/ | ~/.codex/skills/ |
commands/ | ~/.codex/commands/ |
rules/ | ~/.codex/rules/ |
.agent/ in project root| Source | Destination |
|---|---|
agents/ | .agent/skills/ |
commands/ | .agent/workflows/ |
rules/ | .agent/rules/ |
.opencode/ in project root| Source | Destination |
|---|---|
rules/ | .opencode/rules/ |
Works with any target:
npx kodelyth-ecc --profile nextjs # Claude Code
npx kodelyth-ecc --target windsurf-project --profile nextjs # Windsurf
npx kodelyth-ecc --target antigravity --profile python-api # Antigravity
Available profiles:
| Profile | Includes |
|---|---|
nextjs | TypeScript + React + Next.js rules |
python-api | Python + Django/FastAPI rules |
fullstack | TypeScript + Python + Go rules |
mobile | Kotlin + Swift rules |
backend | Go + Python + Java rules |
Or specify languages directly:
npx kodelyth-ecc typescript python golang rust java kotlin php swift cpp dart ruby elixir
| Platform | Supported | Install target | What gets installed |
|---|---|---|---|
| Claude Code | Full | claude-home (default) | Agents, skills, commands, hooks, rules |
| Windsurf | Full | windsurf-project / windsurf-home | Agents, skills, rules, .windsurfrules |
| Cursor | Full | cursor-project | Rules, skills |
| Codex CLI | Full | codex-home | Agents, skills, commands, rules |
| Google Antigravity | Full | antigravity | Agents → skills, commands → workflows, rules |
| OpenCode | Rules only | opencode | Rules (agents + skills not yet supported by OpenCode) |
OS support: macOS, Linux (install.sh), Windows (install.ps1), or any OS with Node.js 18+ (npx).
ECC is 100% local files. No telemetry, no cloud, no account, no tracking. Everything is markdown your AI reads on every session.
npx kodelyth-ecc verify checks your install against the sha256 manifest.We welcome new agents, skills, hooks, and intent routing patterns that meet the Kodelyth Standard — specialist personas, model-agnostic, production-grade examples.
When adding a new agent, also update rules/common/agent-intent-routing.md with your trigger patterns so the intent router knows when to call you.
See CONTRIBUTING.md for templates, checklists, and the full Kodelyth Standard.
See CHANGELOG.md. v1.8.0 highlights:
github-social-preview.svg and og-image.svg fully redesigned with two-panel layout: brand left, 2×2 stat cards right, dot grid texture, amber accentv1.7.3 highlights:
v1.7.0 highlights:
execFileSync), CSP on all responses, SSE client cap (max 10), TOCTOU fixes--pre-public / --pre-launch / --all flags, real bash-grep patterns and remediation playbooksv1.5.8 highlights:
npx kodelyth-ecc --target windsurf-home # comment no longer crashes./doctor command — health check on your ECC install without leaving your IDE./update command — upgrade to the latest version automatically./security-audit, /pre-release, /debug-blitz, /refactor-sprint, /onboard).v1.5.2 highlights:
image-architect agent — platform-aware AI image generation (Gemini Imagen 3, DALL-E 3, fal.ai, SVG)/project-launch — 5 founding-team agents fire in parallel (45 min → 10 min)/team-review — 4 audit agents fire in parallel (60 min → 15 min)/lessons command — cross-platform lesson loadingv1.5.1 highlights:
capture-correction.js Stop hook — auto-encodes corrections to tasks/lessons.mdread-lessons.js SessionStart hook — injects lessons + project DNA before first messagerules/common/self-improvement-workflow.md — 6-pattern self-improvement loopv1.5.0 highlights:
incident-commander — production incident responseload-tester — load/stress testing with k6, Locust, Artilleryv1.4.0 highlights:
kodelyth-memory — local self-learning memory (BM25, zero deps, cache-friendly)Kodelyth ECC is designed and maintained by Shofiqul Islam — full-stack engineer and AI tooling builder.
| Platform | Link |
|---|---|
| GitHub | @sifxprime |
| X / Twitter | @sifxprime |
| facebook.com/sifxprime | |
| @sifxprime | |
| npm | npmjs.com/package/kodelyth-ecc |
FAQs
Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) tha
We found that kodelyth-ecc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.