
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
strray-ai
Advanced tools
⚡ 0xRay: Self-Healing AI Governance OS - Enterprise AI orchestration for OpenCode, Hermes, and OpenClaw
0xRay (StringRay) is now a first-class citizen inside the official Grok CLI — full plugin with real PreToolUse governance hooks, researcher + governance MCP servers, and the complete Dynamo Solar SSOT decision engine.
Install the plugin in one command:
npx strray-ai grok install
Then just use Grok normally. The full power of 0xRay (researcher, governance, skills) is available natively.
Enterprise AI Orchestration Framework for OpenCode, Hermes, and OpenClaw — by 0xRayAI
Intelligent Multi-Agent Coordination with 99.6% Systematic Error Prevention
0xRay extends OpenCode, Hermes Agent, and OpenClaw with intelligent multi-agent orchestration, Codex compliance validation, and enterprise-grade security. It automatically routes tasks to specialized agents based on complexity and provides systematic error prevention across all three runtimes.
0xRay is a one-command level-up for OpenCode. Instead of installing OpenCode first, then adding 0xRay, just run:
npx strray-ai install
This single command:
Goal: Any developer can run one command and instantly get a production-grade, governed agent runtime.
# Install 0xRay (auto-configures OpenCode on install)
npm install strray-ai
# That's it! 0xRay is now active.
# Restart OpenCode or Hermes to load the plugin.
What happens during install?
For use with Hermes Agent without OpenCode:
npx strray-ai install --standalone
This installs only the MCP servers - no OpenCode dependency.
| Agent | Purpose | Status |
|---|---|---|
@architect | System design & technical decisions | Active |
@security-auditor | Vulnerability detection | Active |
@code-reviewer | Quality assessment | Active |
@refactorer | Technical debt elimination | Active |
@testing-lead | Testing strategy & coverage | Active |
@bug-triage-specialist | Error investigation | Active |
@researcher | Codebase exploration | Active |
Note: 0xRay auto-configures all agents during installation. To customize agent settings, see the Agent Configuration Guide.
0xRay is now a first-class citizen inside the official Grok CLI (same depth as OpenCode).
PreToolUse for governance enforcement).mcp.json registration for strray-governance + strray-skills (researcher, etc.)npx strray-ai grok install (auto-trust + project seeding)Install the plugin:
npx strray-ai grok install
Then just use Grok — the researcher and full governance system are now available natively.
0xRay ships a production-grade governance engine:
Governance is the heart of self-healing AI development.
See docs/governance/ and the governance-core.ts for the full matrix.
0xRay integrates with OpenClaw - a self-hosted AI gateway that connects messaging platforms (WhatsApp, Telegram, Discord, Slack) to AI coding agents.
ws://127.0.0.1:18789# Configure in .opencode/openclaw/config.json
{
"gatewayUrl": "ws://127.0.0.1:18789",
"authToken": "your-device-token",
"deviceId": "your-device-id",
"apiServer": { "enabled": true, "port": 18431 },
"hooks": { "enabled": true, "toolBefore": true, "toolAfter": true }
}
# Initialize in code
import { initializeOpenClawIntegration } from 'strray-ai';
const integration = await initializeOpenClawIntegration();
See OpenClaw Integration Guide for details.
0xRay's MCP servers work as native tools in Hermes Agent — a standalone AI coding agent with its own runtime, not dependent on OpenCode or Hermes. This gives you the full 0xRay toolset (code analysis, linting, security scanning, orchestration, state management) inside any Hermes session.
Hermes discovers 10 0xRay MCP servers automatically. Each server exposes tools that Hermes can call directly — no prompts, no proxies, no agent delegation overhead.
| MCP Server | Tools Exposed | What It Does |
|---|---|---|
strray-architect-tools | codebase_structure, dependency_analysis, context_analysis, architecture_assessment | Analyze project structure, dependencies, patterns, and architectural health |
strray-auto-format | auto_format, format_check | Prettier + ESLint + TypeScript formatting and validation |
strray-enforcer | rule_validation, codex_enforcement, quality_gate_check, run_pre_commit_validation | Codex compliance, quality gates, pre-commit validation |
strray-estimation | validate_estimate, start_tracking, complete_tracking, get_accuracy_report | Task estimation with calibration and accuracy tracking |
strray-framework-help | strray_get_capabilities, strray_get_commands, strray_explain_capability | Framework reference, agent docs, capability lookups |
strray-lint | lint, lint_check | ESLint validation with auto-fix and rule-specific checks |
strray-orchestrator | orchestrate_task, analyze_complexity, get_orchestration_status, optimize_orchestration, cancel_orchestration | Multi-agent task planning, complexity scoring, parallel optimization |
strray-researcher | search_codebase, find_implementation, get_documentation | Codebase search, pattern finding, documentation lookup |
strray-security-scan | security_scan, dependency_audit | Vulnerability scanning and dependency audit |
strray-state-manager | get_state, set_state, delete_state, list_state, backup_state, restore_state, validate_state | Persistent key-value state with backup/restore |
npm install strray-ai
~/.hermes/config.yaml):mcp_servers:
strray-architect-tools:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/architect-tools.server.js
timeout: 30
strray-auto-format:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/auto-format.server.js
timeout: 30
strray-enforcer:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/enforcer-tools.server.js
timeout: 30
strray-estimation:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/estimation.server.js
timeout: 30
strray-framework-help:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/framework-help.server.js
timeout: 30
strray-lint:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/lint.server.js
timeout: 30
strray-orchestrator:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/orchestrator/server.js
timeout: 60
strray-researcher:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/researcher.server.js
timeout: 60
strray-security-scan:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/security-scan.server.js
timeout: 30
strray-state-manager:
command: node
args:
- ./node_modules/strray-ai/dist/mcps/state-manager.server.js
timeout: 30
mcp_strray_ prefix.Once connected, Hermes can use the tools directly in conversation:
| OpenCode Plugin | Hermes MCP | |
|---|---|---|
| Runtime | OpenCode or Claude Code | Any Hermes session (CLI, Telegram, Discord) |
| Discovery | Plugin injection via opencode.json | MCP protocol via config.yaml |
| Tool Access | Agent-to-agent delegation | Direct tool calls from Hermes |
| Context | Shared OpenCode session | Full Hermes session with memory |
| Platforms | Terminal only | CLI, Telegram, Discord, WhatsApp, Slack |
args if Hermes runs from a different working directory than your projecttimeout for orchestrator and researcher (60s) — they do heavier analysis.strray/state/mcp-state.json — survives Hermes restarts| Guide | Description |
|---|---|
| Agent Configuration | Copy-paste opencode.json agent setup |
| Configuration Reference | Complete features.json settings |
| Agent Documentation | Detailed agent specifications |
| Universal Codex | 60-term codex reference |
| Troubleshooting | Common issues & solutions |
0xRay provides CLI utilities for managing and monitoring your installation:
# Core commands
npx strray-ai status # Check configuration and plugin status
npx strray-ai validate # Validate installation and dependencies
npx strray-ai capabilities # Show all available features
npx strray-ai health # Run health check on framework components
npx strray-ai report # Generate usage and performance reports
# Agent management
npx strray-ai publish-agent --agent orchestrator # Package agent for AgentStore
# Skills management
npx strray-ai skill:install # Show starter packs + available sources
npx strray-ai skill:install agency-agents # Install from registry (auto-detects format)
npx strray-ai skill:install <github-url> # Install from any repo
npx strray-ai skill:registry list # Show all registry sources
npx strray-ai antigravity status # Show installed skills with licenses
Note: Installation is automatic via npm install strray-ai. The postinstall hook configures everything automatically.
0xRay works out of the box with sensible defaults. The npm postinstall hook automatically sets up:
.opencode/
├── agents/ # 42 agent configurations (YAML configs)
├── skills/ # Framework skills
├── strray/
│ ├── codex.json # Codex rules
│ ├── features.json # Feature flags
│ └── config.json # Token/memory management
└── hooks/ # Pre/post processing hooks
Edit .opencode/agents/ to customize agent behavior:
# Example: Customize enforcer agent
name: enforcer
maxComplexity: 40 # Only handle simple tasks
temperature: 0.2 # More precise responses
enabled: true
Edit .opencode/strray/features.json to enable/disable features:
{
"codexEnforcement": true,
"agentGovernance": true,
"analytics": true,
"webhooks": true
}
Edit .opencode/strray/config.json to adjust token limits:
{
"token_management": {
"maxPromptTokens": 20000,
"warningThreshold": 15000
}
}
See Configuration Reference for full options.
0xRay supports pinning versions for reproducible installations:
{
"version_pinning": {
"strray_ai": "^1.22.0",
"opencode": "^2.14.0",
"skills": {
"antigravity": "latest",
"impeccable": "latest",
"openviking": "latest",
"claude_seo": "latest"
}
}
}
Add to .opencode/strray/features.json to pin specific versions.
stringray/
├── src/
│ ├── __tests__/ # Test suites (unit, integration, performance)
│ ├── agents/ # Agent implementations
│ ├── analytics/ # Pattern analysis & learning
│ ├── cli/ # CLI commands
│ ├── circuit-breaker/ # Resilience patterns
│ ├── core/ # Core framework
│ ├── delegation/ # Task routing & delegation
│ ├── enforcement/ # Codex enforcement
│ ├── infrastructure/ # IaC validation
│ ├── integrations/ # External integrations
│ │ ├── base/ # BaseIntegration framework
│ │ └── openclaw/ # OpenClaw integration
│ ├── mcps/ # MCP server implementations
│ ├── monitoring/ # System monitoring
│ ├── orchestrator/ # Multi-agent orchestration
│ ├── performance/ # Performance optimization
│ ├── plugins/ # Plugin system
│ ├── postprocessor/ # Post-processing pipeline
│ ├── reporting/ # Report generation
│ ├── security/ # Security systems
│ ├── session/ # Session management
│ ├── test-utils/ # Test utilities and helpers
│ ├── validation/ # Agent config & estimation validators
│ └── jobs/ # Background job management
├── .opencode/ # OpenCode configuration
│ ├── agents/ # Agent configs (42 agents)
│ ├── strray/ # 0xRay config
│ │ ├── codex.json # 60-term development codex
│ │ ├── features.json # Feature flags
│ │ └── config.json # Token management
│ └── hooks/ # Git hooks
├── skills/ # 0xRay skills
├── docs/ # Documentation
│ ├── reflections/ # Deep technical reflections
│ └── research/ # Research documents
└── scripts/ # Build & utility scripts
# System design
@architect design database schema for e-commerce
# Security audit
@security-auditor scan for vulnerabilities
# Code review
@code-reviewer review authentication module
# Testing
@testing-lead create tests for payment system
0xRay integrates with your existing infrastructure via webhooks and APIs:
# CLI tool for integration
npx strray-integration --help
// Programmatic integration
import { StringRayIntegration } from 'strray-ai/integration';
const postProcessor = new PostProcessor(stateManager);
const integration = new StringRayIntegration(postProcessor);
// Express
app.use('/webhooks', integration.getWebhookApp());
app.use('/api/post-process', integration.getAPIApp());
// Fastify
fastify.register(integration.getWebhookRouter(), { prefix: '/webhooks' });
fastify.register(integration.getAPIRouter(), { prefix: '/api/post-process' });
Supported Webhooks:
0xRay ships with 44 framework skills and provides a registry of 10 curated community sources with 170+ additional skills.
Browse and install skills from verified GitHub repositories:
# Show starter packs and available sources
npx strray-ai skill:install
# Install a specific source
npx strray-ai skill:install agency-agents
npx strray-ai skill:install superpowers
npx strray-ai skill:install anthropic-skills
# Install from any GitHub repo (auto-detects format)
npx strray-ai skill:install https://github.com/user/skills-repo
# Manage the registry
npx strray-ai skill:registry list # Show all sources
npx strray-ai skill:registry add --name X --url Y --desc "..." --license MIT
npx strray-ai skill:registry remove --name X
| Pack | Sources | Skills | Best For |
|---|---|---|---|
| Minimal Viable Power | superpowers, anthropic-skills | 20+ | Solo devs, quick setup |
| Full Pro Setup | + agency-agents, impeccable, minimax | 200+ | Professional development |
| Agency/Team Mode | + gemini-skills, ai-web3-security | 220+ | Teams, security audits |
| Specialized | + vuejs-nuxt, ui-ux-pro-max | 230+ | Nuxt/Vue, UI/UX work |
| Source | Skills | License | Description |
|---|---|---|---|
| agency-agents | 170+ | MIT | AI agency agent definitions |
| superpowers | 14 | MIT | TDD, debugging, code review workflows |
| anthropic-skills | 10+ | MIT | Official Anthropic Claude Code skills |
| antigravity | 1300+ | MIT | Curated community skills |
| impeccable | 1 | Apache 2.0 | AI frontend design language |
| minimax | 20+ | MIT | Frontend, mobile, shader skills |
| gemini-skills | 10+ | Apache 2.0 | Official Google Gemini skills |
| ai-web3-security | 10+ | MIT | Web3 security auditing |
| vuejs-nuxt | 5+ | MIT | Vue.js 3, Nuxt 4+ skills |
| ui-ux-pro-max | 1 | MIT | Professional UI/UX design |
Impeccable is a design language skill that teaches AI coding assistants professional frontend design:
/audit # Find issues
/critique # UX design review
/polish # Pre-ship refinement
/typeset # Fix typography
/arrange # Fix layout & spacing
0xRay includes 30 core skills for orchestration, compliance, architecture, and more — installed to .opencode/skills/ automatically.
All community skill sources are properly licensed. License files are in licenses/skills/:
| Source | License | File |
|---|---|---|
| agency-agents | MIT | licenses/skills/LICENSE.agency-agents |
| superpowers | MIT | licenses/skills/LICENSE.superpowers |
| anthropic-skills | MIT | licenses/skills/LICENSE.anthropic-skills |
| antigravity | MIT | licenses/skills/LICENSE.antigravity |
| impeccable | Apache 2.0 | licenses/skills/LICENSE.impeccable |
| minimax | MIT | licenses/skills/LICENSE.minimax |
| gemini-skills | Apache 2.0 | licenses/skills/LICENSE.gemini-skills |
| ai-web3-security | MIT | licenses/skills/LICENSE.ai-web3-security |
| vuejs-nuxt | MIT | licenses/skills/LICENSE.vuejs-nuxt |
| ui-ux-pro-max | MIT | licenses/skills/LICENSE.ui-ux-pro-max |
If 0xRay helps you build better software, please consider:
MIT License - see LICENSE for details.
Built with precision for enterprise-grade AI orchestration
FAQs
⚡ 0xRay: Self-Healing AI Governance OS - Enterprise AI orchestration for OpenCode, Hermes, and OpenClaw
The npm package strray-ai receives a total of 951 weekly downloads. As such, strray-ai popularity was classified as not popular.
We found that strray-ai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.