Audited 2026-10-18 · Sources: GitHub repo + README, npm package pages, ecc.tools, GitTrend. Tabletop audit — nothing downloaded or executed.
The card
| Repo | affaan-m/ECC ("Everything Claude Code") |
| Stars | 283k — #16 across all of GitHub, 167 days on trending |
| License | MIT |
| Born | January 2026 · ~745 stars/day for the last month |
| What it is | An "agent harness operating system": 71 specialized agents, 311 skills, 97 command shims, hooks, memory, and a security scanner (AgentShield) |
| Install surfaces | ecc@ecc plugin slug · npm ecc-universal / ecc-agentshield · GitHub App · free tier + $19/seat/mo private-repo tier (pricing checked 2026-10-18 — source) |
What problem it solves
A coding agent out of the box is smart but unstructured — it plans inconsistently, doesn't verify its own work, and forgets everything between sessions. ECC bolts on the operating discipline: plan → test → implement → review → verify → remember. It's the difference between hiring a clever intern and giving that intern a process.
Our gate findings
| Gate | Finding |
|---|---|
| Upstream identity | Verified — solo maintainer (Affaan Mustafa, Anthropic hackathon winner), official channels explicitly enumerated in the README, npm + GitHub App + plugin slug all named. The project warns about fake mirrors — which is what a mature project does when impersonation actually starts happening. |
| License | MIT — clean. |
| Install trust | Three surfaces, not one: the plugin (code inside your agent), the GitHub App (read/write on your repos — review its scopes before clicking), and npm packages (supply-chain entry point, though official and signed by npm provenance). |
| Security posture | Genuinely good — AgentShield scans agent configs for exposed secrets, malicious hooks, and MCP risks (102 static rules, ~1,280 tests claimed). A tool that audits your agent setup before you run it is a rarity. |
| Scope risk | 311 skills is also 311 instruction files shaping your agent's behavior. Adopting ECC means adopting someone's operating philosophy — read what a skill teaches before you let it teach. |
Verdict: CAUTION trending GO. The most mature project on the list — real security tooling, honest channel hygiene, MIT. What holds it back from a straight GO is pure size: three install surfaces plus hundreds of skills is a lot of trust to grant in one click. Install the GitHub App only after reading its permissions; start with AgentShield alone if you want a zero-commitment taste.
Best for
Teams already running Claude Code or Codex who want shared discipline — planning, self-review, memory — without building it themselves. Solo users should still start with the standalone AgentShield scan, which tells you what your current agent setup is already leaking.