ECC (everything-claude-code): an open-source engineering workflow for Claude Code

Once a model can write code, the gap moves to process: every session starts with you re-explaining that tests come first, changes need review, and secrets stay out of commits. ECC (everything-claude-code) is an open-source Claude Code configuration by Affaan Mustafa that turns that discipline into a resident system — 71 specialized subagents, 311 skills, 97 commands, plus hooks and a memory vault (counts checked against the README on October 11, 2026). The whole workflow compresses into one line: plan → test → implement → review → verify → remember → improve. Install it once and every session follows that order. Mustafa won first place at Anthropic’s hackathon with Zenith Chat; the repo was created in January 2026, had about 276,000 stars as of October 11, 2026, and shipped v2.2.3 on October 1 with commits landing daily since.

The hero above dates from v2.0, when the catalog counted 261 skills and 64 agents; two months later it reads 311/71/97. Fifty new skills in two months says the project is still iterating fast.

Core features

• 71 subagents with set roles: planning, code review, build repair, security and architecture each get a specialist. code-reviewer reviews work in a fresh context, build-error-resolver fixes compile errors, e2e-runner runs end-to-end checks, database-reviewer audits schemas against Supabase patterns.
• 311 skills loaded on demand: TDD, security, docs, frontend, data, ML and operations enter the context only when used. The README notes commands will gradually migrate to a skills-first surface.
• Hooks that enforce, not suggest: attached to tool events — batched format and typecheck runs, secret detection in prompts, dev-server guards. Four hook profiles are available on Claude Code.
• Memory vault and instincts: sessions distill into self-describing Markdown under .ecc/memory/ (user-level at ~/.ecc/memory/) that humans and other tools can read. Instincts learned from real sessions carry confidence scores; by default only those above 0.7 inject, six per session at most, tunable via ECC_INSTINCT_CONFIDENCE_THRESHOLD.
• AgentShield security scanning: a standalone CLI that audits prompts, hooks, MCP config, permissions and secrets; /security-scan is the workflow entry to the same checks.
• Seven harnesses: Claude Code is the primary target (2.1 or newer), Codex and Qoder get native plugin paths, and Cursor, OpenCode, Gemini, Zed, Copilot and others work through capability-limited adapters. Self-hosted models plug in through each tool’s normal configuration, including custom endpoints and model gateways.

Typical use cases

• You already code with Claude Code daily but orchestrate the process by hand and want a ready-made review-test-security loop.
• A solo developer wants engineering discipline by default: every feature goes through plan → test → implement → review without assembling your own scripts.
• A team wants standards enforced, not posted: hooks force formatting and block secrets, rules load per language.
• You switch between Claude Code, Codex and Cursor and want one configuration to carry over — checking the support matrix first, since adapter depth varies.

Quick start

You need Claude Code 2.1 or newer. Inside a Claude Code session:

/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc

Or use the cross-harness npm installer (Node 18+), which inventories your existing setup before changing anything; rerun the same command to update or change scope:

npx ecc-universal@2.2.3 setup

Reopen a session and /code-review or /security-scan should be live; add --profile minimal if you want a smaller install.

Summary

ECC fits developers who already work in AI coding tools but still drive everything through single conversations. If you only write the occasional script, or you have carefully tuned your own CLAUDE.md, a takeover of this size costs real adjustment time — the installer lets you pick capabilities instead. Windows native support has known defects (the continuous-learning observer daemon and memory-vault writes, issues #2489 and #2626); WSL follows the Linux paths and is unaffected. MIT-licensed, mostly JavaScript with Rust and Python components; the commercial ECC Pro is a hosted GitHub App for private repos, while the open-source core stays free. Compared with gstack, Garry Tan’s single-person take on the same idea, ECC is an industrial-scale system; compared with agency-agents, which ships hundreds of role-playing agents, it adds hook enforcement and memory. The most interesting part is /evolve: it clusters instincts that recur across your sessions into reusable skills, so the configuration keeps changing with how you work.