# ktg-plugin-marketplace Open-source Claude Code plugins for AI-assisted development, security, and planning. Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo-maintained, AI-assisted, fork-and-own. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for what upstream provides and how this is meant to be used. All code here is generated by Claude Code through a dialog-based process: I direct, review, test, and validate; Claude writes. Treat the plugins as AI-authored, human-curated. ## Installation ```bash claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git ``` Then open Claude Code and type `/plugin` to browse and install — the command above only registers the marketplace, it installs nothing. Each plugin keeps its own full README and CHANGELOG; this page is just the catalog. --- ## Plugins ### [LLM Security](https://git.fromaitochitta.com/open/llm-security) `v7.8.3` Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and Google DeepMind's AI Agent Traps taxonomy. - **Automated enforcement** — 9 hooks block prompt injection, secrets in code, destructive commands, and supply-chain risks in real time - **Deterministic scanning** — 23 Node.js scanners for entropy, Unicode codepoints, typosquatting, taint flow, git forensics, AI-BOM, trigger/signature/AST-taint, and IDE-extension prescan (VS Code + JetBrains) - **Advisory analysis** — 20 commands that scan, audit, and model threats with letter-graded reports and remediation - **Enterprise governance** — EU AI Act / NIST AI RMF / ISO 42001 mapping, SARIF 2.1.0 output, policy-as-code, standalone CLI Key commands: `/security posture`, `/security audit`, `/security scan`, `/security ide-scan`, `/security threat-model` 6 agents · 23 scanners · 9 hooks · 2013 tests · [Full documentation →](https://git.fromaitochitta.com/open/llm-security) --- ### [Config-Audit](https://git.fromaitochitta.com/open/config-audit) `v5.13.0` Configuration intelligence for Claude Code. Claude reads instructions from 7+ file types across multiple scopes; this plugin tells you what's wrong, what's missing, what's silently conflicting, what's actually loaded, and where you're burning tokens. - **Health** — 16 deterministic scanners catch broken imports, deprecated settings, conflicting rules, permission contradictions, plugin-hygiene collisions, and token waste - **Opportunities** — context-aware recommendations for Claude Code features you're not using - **Action** — auto-fix with mandatory backups, syntax validation, and rollback - **Inventory + hotspots** — read-only view of active plugins, skills, MCP servers, hooks, and CLAUDE.md cascade, plus a ranked map of token waste - **Plain-language UX** — output leads with prose and groups findings by impact and urgency (`--raw` and `--json` available) Key commands: `/config-audit posture`, `/config-audit feature-gap`, `/config-audit fix`, `/config-audit whats-active`, `/config-audit tokens` 7 agents · 16 scanners · 21 commands · 1398 tests · [Full documentation →](https://git.fromaitochitta.com/open/config-audit) --- ### [Voyage](https://git.fromaitochitta.com/open/voyage) `v5.9.1` A six-command planning pipeline with specialized agent swarms, adversarial review, and zero-friction multi-session resumption. Renamed from `ultraplan-local`/`/ultra*-local` to avoid collision with Anthropic's `/ultraplan` and `/ultrareview`. No cloud dependency. - **`/trekbrief`** — capture intent through a quality-gated interview; emits a reviewable brief - **`/trekresearch`** — deep multi-source research with triangulation and confidence ratings - **`/trekplan`** — transform the brief into an executable, manifest-verified plan - **`/trekexecute`** — disciplined execution with independent audit and bounded failure recovery - **`/trekreview`** — independent post-hoc review; severity-tagged findings feed back into planning - **`/trekcontinue`** — resume the next session from saved state in one command Per-phase effort and model dialog; `/trekbrief`, `/trekplan`, and `/trekreview` render an operator-annotation HTML view you can mark up and copy back into Claude. 24 agents · 6 commands (+1 helper) · 7 hooks · 832 tests · [Full documentation →](https://git.fromaitochitta.com/open/voyage) · [Migration guide](https://git.fromaitochitta.com/open/voyage/src/branch/main/MIGRATION.md) --- ### [AI Psychosis](https://git.fromaitochitta.com/open/ai-psychosis) `v1.2.2` Meta-awareness tools that counteract sycophancy, reinforcement loops, and compulsive AI interaction patterns. AI assistants are structurally optimized to be agreeable; this surfaces when that becomes a problem. - **Behavioral instructions** — rules that modify Claude's behavior: no unearned affirmations, mandatory risk identification, pattern naming - **Programmatic detection** — 4 hooks measure session duration, dependency language, rapid-fire bursts, edit ratios, and late-night usage, with progressive alerts - **Interaction reports** — `/interaction-report` for aggregated session statistics (opt-in) - **Contemplative references** — optional pointers when interaction flags are elevated (opt-in) Research-informed thresholds. Alerts are progressive and never blocking. Privacy-first: prompt text is never logged. 1 skill · 1 command · 4 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ai-psychosis) --- ### [Graceful Handoff](https://git.fromaitochitta.com/open/graceful-handoff) `v3.1.0` One deliberate command to end a session cleanly and hand it to the next. `/graceful-handoff` reaches a natural stopping point and overwrites the nearest `STATE.md` — the continuity artifact the following session reads at startup. - **Stopping point first** — finishes the current logical unit and leaves the code working before it writes anything - **Overwrites the nearest `STATE.md`** — a complete state-of-play in a fixed format, headed by a mandatory `👉 NESTE — START HER` block: where you are, the next concrete step, what to read - **Remote-aware commit** — classifies the remote (private → tracked and committed, public → local-only), stages *only* `STATE.md`, never `git add -A`; push stays yours - **User-initiated only** — `disable-model-invocation: true`, so the model cannot hand off on its own. A slim deterministic helper does the mechanical parts under a 60-second budget v3.0 removed the auto-trigger hooks on purpose: a hook has no session context, so it could only ever write a poor snapshot — and would overwrite a good, model-written `STATE.md`. Key command: `/graceful-handoff [--no-commit] [--dry-run]` 1 skill · 1 pipeline · 30 tests · [Full documentation →](https://git.fromaitochitta.com/open/graceful-handoff) --- ### [MS AI Architect](https://git.fromaitochitta.com/open/ms-ai-architect) `v1.17.0` `🇳🇴 Norwegian` Microsoft AI solution architecture guidance for Norwegian public sector and enterprise, through Cosmo Skyberg — a structured architect persona who understands the problem before recommending technology. - **Structured advisory** — 7-phase methodology from business need to architecture recommendation and optional diagram - **Regulatory assessments** — ROS (NS 5814), DPIA/PVK, 6×5 security scoring, EU AI Act classification, cost in NOK (P10/P50/P90) - **Norwegian public sector** — Digdir architecture principles, Utredningsinstruksen, NSM, Schrems II data residency, EU AI Act workflow - **Grounded and current** — 389 reference documents, verified against live Microsoft Learn via MCP; `/architect:kb-update` refreshes the knowledge base - **Playground** — single-file decision-builder and report viewer covering all 17 report types, light/dark, runs offline Key commands: `/architect`, `/architect:ros`, `/architect:security`, `/architect:dpia`, `/architect:utredning`, `/architect:cost` 12 agents · 29 commands · 5 skills (389 docs) · 2 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ms-ai-architect) --- ### [LinkedIn Studio](https://git.fromaitochitta.com/open/linkedin-studio) `v0.8.0` Build authentic LinkedIn authority through algorithmic understanding, strategic consistency, and AI-assisted content creation. - **Long-form newsletter pipeline** — a multi-phase orchestrator (research → skeleton → prose → de-AI/voice scrub → fact-check → editorial and persona gates → visual assets → lock → delivery) with maintained edition state - **Adversarial review** — cold headless content, language, and fact reviewers re-check a frozen draft with no drafting-session context; `/linkedin:pivot` re-opens cleared gates on major rewrites - **Content engine** — Content Matrix (40+ ideas from one topic), voice training with drift detection, full ideation → publish → 48-hour monitoring - **Honest analytics** — CSV-import pipeline with weekly/monthly reports and anomaly alerts. Adds an **optional, manually-entered `saves`** count (add a `Saves` column with the number read off native LinkedIn analytics; never auto-tracked, `unknown` ≠ 0, excluded from the engagement rate). `dwell` time stays **explicitly unmeasurable** — no fabricated metric or surface - **Growth and monetization** — phase-specific guidance from 0 to 10K+ followers; topic-relevance profile optimization aligned to LinkedIn's 2026 ranking model Key commands: `/linkedin:create` + `/linkedin:measure` (journey front-doors), `/linkedin:onboarding`, `/linkedin:post`, `/linkedin:newsletter`, `/linkedin:report` 20 agents · 30 commands (five journeys) · 6 skills · 9 hooks · [Full documentation →](https://git.fromaitochitta.com/open/linkedin-studio) --- ### [OKR for Public Sector](https://git.fromaitochitta.com/open/okr) `v1.8.2` `🇳🇴 Norwegian` Turn strategy into measurable goals. An AI coach that learns your organization once, then builds on that knowledge so you spend time on strategy, not re-explaining context. - **Strategy to OKR** — transform goals from virksomhetsplan or tildelingsbrev into well-structured OKR with quality checks and alignment scoring - **Gap analysis** — `/okr:gap` compares strategy documents against current OKR: what's covered, what's missing, what to do - **Cross-cycle learning** — `/okr:analyse` tracks score trends and recurring antipatterns across cycles with charts - **19 antipattern detection** — catches sandbagging, activity-disguised-as-KR, set-and-forget, and 16 more - **Built for norsk offentlig sektor** — 4-month tertials, DFO terminology, tillitsvalgt involvement, Riksrevisjon-ready documentation Key commands: `/okr:skriv`, `/okr:kvalitet`, `/okr:gap`, `/okr:analyse`, `/okr:kaskade`, `/okr:governance` 7 agents · 14 commands · 3 hooks · [Full documentation →](https://git.fromaitochitta.com/open/okr) --- ### [Human-Friendly Style](https://git.fromaitochitta.com/open/human-friendly-style) `v1.1.0` A shared Claude Code [output style](https://code.claude.com/docs/en/output-styles) used across this marketplace, so the conversation feels like dialog rather than a console dump. - Explains what and why, not how — reserving technical detail for when you ask - Hides noise by default — long paths, raw commands, JSON, and stack traces are summarized - Always shows irreversible actions verbatim — deploys, deletes, force-push, migrations - Matches your language (Norwegian or English) and is honest about uncertainty Optional and works alongside every other plugin. Activate with `/config` → Output style → Human-Friendly. 1 output style · [Full documentation →](https://git.fromaitochitta.com/open/human-friendly-style) --- ### [Claude Design](https://git.fromaitochitta.com/open/claude-design) `v0.1.0` End-to-end facilitator for prompting Claude Design (`claude.ai/design`). Walks you from raw idea through prompt drafting, delivery, and iteration coaching. The output is the prompt; the artifact gets built in Claude Design. - **Eight-phase flow** — disambiguate → intent preset → audience and destination → DESIGN.md anchor → five-layer prompt → delivery → iteration coaching → ship-readiness - **Evidence-graded references** — five foundation plus eight per-preset references, each carrying an Anthropic-domain citation - **Complements Anthropic's official design plugin** — this covers idea → prompt → iterate; theirs covers critique → handoff, with zero command overlap (enforced by test) 1 skill · 13 reference files · 5 tests · [Full documentation →](https://git.fromaitochitta.com/open/claude-design) --- ### [repo-mailbox](https://git.fromaitochitta.com/open/repo-mailbox) `v0.18.0` A local mailbox for coordination between Claude Code sessions in different repositories. Session A in repo X leaves a message for repo Y; the next session in repo Y gets it injected as context at startup. Local, private, no network, no SaaS. - **Deliver until done** — directed messages re-inject at every session start (`/clear` never loses them) until replied to or archived; broadcasts deliver once per repo via a seen set. `reply-expected` distinguishes a question from a notice (`--fyi`); absence means expected - **Untrusted by design** — message content is quote-prefixed and framed as untrusted data; send-side field sanitization blocks frontmatter injection. The obligation to answer is procedural, never substantive - **`coord-send`** — natural-language sending: maps "tell repo-x the bug is fixed" to the right delivery — broadcasts, bounded multi-target loops, replies, retractions, and deferred sends - **`board`** — read-only cross-repo attention board: which repos have a live next step, which are blocked and on whom, which owe a reply, and what each costs to move - **`route`** — turns four scored traits of the next task into a model/effort row from a closed six-row rubric, with a pasteable startup command and a one-row-cheaper fallback 1 hook · 3 skills · 8 CLI scripts · 370 selftest checks · [Full documentation →](https://git.fromaitochitta.com/open/repo-mailbox) --- ## Shared infrastructure ### [Playground Design System](https://git.fromaitochitta.com/open/playground-design-system) `v0.6.0` Shared design system for plugin Playgrounds — the visual self-service UIs that complement terminal slash-commands. Aksel/Digdir-aligned, WCAG 2.1 AA, light + dark themes, print-ready. Used by `ms-ai-architect`, `okr`, `llm-security`, `voyage`, and `config-audit`. - **Tokens and components** — self-hosted fonts (OFL 1.1), a deuteranopia-safe severity ramp, and Tier 1–3 components: radar, matrix-heatmap, findings-browser, AI Act pyramid and timeline, maturity-ladder, and more - **Privacy-first** — all fonts self-hosted, zero CDN requests, works offline and behind air-gapped firewalls - **Vendoring sync** — `scripts/sync-design-system.mjs ` keeps each plugin standalone; a SHA-256 manifest detects local drift [Full documentation →](https://git.fromaitochitta.com/open/playground-design-system) · [Browse showcase](https://git.fromaitochitta.com/open/playground-design-system/src/branch/main/playground-examples/index.html) --- ## License MIT