ktg-plugin-marketplace/README.md

# ktg-plugin-marketplace

Open-source Claude Code plugins for AI-assisted development, security, and planning

Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo-maintained, AI-assisted, fork-and-own. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for what upstream provides and how this is meant to be used.

All code here is generated by Claude Code through a dialog-based process: I direct, review, test, and validate; Claude writes. Treat the plugins as AI-authored, human-curated.

## Install

```bash
claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
```

Then open Claude Code and type `/plugin` to browse and install — the command above only registers the marketplace, it installs nothing.

Each plugin keeps its own full README and CHANGELOG; this page is just the catalog.

## Non-goals

- **Not a host for plugin source or issues.** This repository holds the marketplace manifest and this catalog page. Code, issues and releases live in each plugin's own repository, linked from its entry below.
- **Not a third-party registry.** Only plugins maintained here are listed. There is no submission process.
- **No pull requests.** Issues are welcome as signals; PRs are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for the reasoning and the fork-and-own model.
- **No support commitment.** Bug fixes are best-effort, breaking changes happen and are documented in each plugin's CHANGELOG. Version-pin if you need stability.

---

## Plugins

### [LLM Security](https://git.fromaitochitta.com/open/llm-security) `v7.8.3`

Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and Google DeepMind's AI Agent Traps taxonomy.

- **Automated enforcement** — 9 hooks block prompt injection, secrets in code, destructive commands, and supply-chain risks in real time
- **Deterministic scanning** — 23 Node.js scanners for entropy, Unicode codepoints, typosquatting, taint flow, git forensics, AI-BOM, trigger/signature/AST-taint, and IDE-extension prescan (VS Code + JetBrains)
- **Advisory analysis** — 20 commands that scan, audit, and model threats with letter-graded reports and remediation
- **Enterprise governance** — EU AI Act / NIST AI RMF / ISO 42001 mapping, SARIF 2.1.0 output, policy-as-code, standalone CLI

Key commands: `/security posture`, `/security audit`, `/security scan`, `/security ide-scan`, `/security threat-model`

6 agents · 23 scanners · 9 hooks · 2013 tests · [Full documentation →](https://git.fromaitochitta.com/open/llm-security)

---

### [Config-Audit](https://git.fromaitochitta.com/open/config-audit) `v5.13.0`

Configuration intelligence for Claude Code. Claude reads instructions from 7+ file types across multiple scopes; this plugin tells you what's wrong, what's missing, what's silently conflicting, what's actually loaded, and where you're burning tokens.

- **Health** — 16 deterministic scanners catch broken imports, deprecated settings, conflicting rules, permission contradictions, plugin-hygiene collisions, and token waste
- **Opportunities** — context-aware recommendations for Claude Code features you're not using
- **Action** — auto-fix with mandatory backups, syntax validation, and rollback
- **Inventory + hotspots** — read-only view of active plugins, skills, MCP servers, hooks, and CLAUDE.md cascade, plus a ranked map of token waste
- **Plain-language UX** — output leads with prose and groups findings by impact and urgency (`--raw` and `--json` available)

Key commands: `/config-audit posture`, `/config-audit feature-gap`, `/config-audit fix`, `/config-audit whats-active`, `/config-audit tokens`

7 agents · 16 scanners · 21 commands · 1398 tests · [Full documentation →](https://git.fromaitochitta.com/open/config-audit)

---

### [Voyage](https://git.fromaitochitta.com/open/voyage) `v5.9.1`

A six-command planning pipeline with specialized agent swarms, adversarial review, and zero-friction multi-session resumption. Renamed from `ultraplan-local`/`/ultra*-local` to avoid collision with Anthropic's `/ultraplan` and `/ultrareview`. No cloud dependency.

- **`/trekbrief`** — capture intent through a quality-gated interview; emits a reviewable brief
- **`/trekresearch`** — deep multi-source research with triangulation and confidence ratings
- **`/trekplan`** — transform the brief into an executable, manifest-verified plan
- **`/trekexecute`** — disciplined execution with independent audit and bounded failure recovery
- **`/trekreview`** — independent post-hoc review; severity-tagged findings feed back into planning
- **`/trekcontinue`** — resume the next session from saved state in one command

Per-phase effort and model dialog; `/trekbrief`, `/trekplan`, and `/trekreview` render an operator-annotation HTML view you can mark up and copy back into Claude.

24 agents · 6 commands (+1 helper) · 7 hooks · 832 tests · [Full documentation →](https://git.fromaitochitta.com/open/voyage) · [Migration guide](https://git.fromaitochitta.com/open/voyage/src/branch/main/MIGRATION.md)

---

### [AI Psychosis](https://git.fromaitochitta.com/open/ai-psychosis) `v1.2.2`

Meta-awareness tools that counteract sycophancy, reinforcement loops, and compulsive AI interaction patterns. AI assistants are structurally optimized to be agreeable; this surfaces when that becomes a problem.

- **Behavioral instructions** — rules that modify Claude's behavior: no unearned affirmations, mandatory risk identification, pattern naming
- **Programmatic detection** — 4 hooks measure session duration, dependency language, rapid-fire bursts, edit ratios, and late-night usage, with progressive alerts
- **Interaction reports** — `/interaction-report` for aggregated session statistics (opt-in)
- **Contemplative references** — optional pointers when interaction flags are elevated (opt-in)

Research-informed thresholds. Alerts are progressive and never blocking. Privacy-first: prompt text is never logged.

1 skill · 1 command · 4 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ai-psychosis)

---

### [Graceful Handoff](https://git.fromaitochitta.com/open/graceful-handoff) `v3.1.0`

One deliberate command to end a session cleanly and hand it to the next. `/graceful-handoff` reaches a natural stopping point and overwrites the nearest `STATE.md` — the continuity artifact the following session reads at startup.

- **Stopping point first** — finishes the current logical unit and leaves the code working before it writes anything
- **Overwrites the nearest `STATE.md`** — a complete state-of-play in a fixed format, headed by a mandatory `👉 NESTE — START HER` block: where you are, the next concrete step, what to read
- **Remote-aware commit** — classifies the remote (private → tracked and committed, public → local-only), stages *only* `STATE.md`, never `git add -A`; push stays yours
- **User-initiated only** — `disable-model-invocation: true`, so the model cannot hand off on its own. A slim deterministic helper does the mechanical parts under a 60-second budget

v3.0 removed the auto-trigger hooks on purpose: a hook has no session context, so it could only ever write a poor snapshot — and would overwrite a good, model-written `STATE.md`.

Key command: `/graceful-handoff [--no-commit] [--dry-run]`

1 skill · 1 pipeline · 30 tests · [Full documentation →](https://git.fromaitochitta.com/open/graceful-handoff)

---

### [MS AI Architect](https://git.fromaitochitta.com/open/ms-ai-architect) `v1.17.0` `🇳🇴 Norwegian`

Microsoft AI solution architecture guidance for Norwegian public sector and enterprise, through Cosmo Skyberg — a structured architect persona who understands the problem before recommending technology.

- **Structured advisory** — 7-phase methodology from business need to architecture recommendation and optional diagram
- **Regulatory assessments** — ROS (NS 5814), DPIA/PVK, 6×5 security scoring, EU AI Act classification, cost in NOK (P10/P50/P90)
- **Norwegian public sector** — Digdir architecture principles, Utredningsinstruksen, NSM, Schrems II data residency, EU AI Act workflow
- **Grounded and current** — 389 reference documents, verified against live Microsoft Learn via MCP; `/architect:kb-update` refreshes the knowledge base
- **Playground** — single-file decision-builder and report viewer covering all 17 report types, light/dark, runs offline

Key commands: `/architect`, `/architect:ros`, `/architect:security`, `/architect:dpia`, `/architect:utredning`, `/architect:cost`

12 agents · 29 commands · 5 skills (389 docs) · 2 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ms-ai-architect)

---

### [LinkedIn Studio](https://git.fromaitochitta.com/open/linkedin-studio) `v0.8.0`

Build authentic LinkedIn authority through algorithmic understanding, strategic consistency, and AI-assisted content creation.

- **Long-form newsletter pipeline** — a multi-phase orchestrator (research → skeleton → prose → de-AI/voice scrub → fact-check → editorial and persona gates → visual assets → lock → delivery) with maintained edition state
- **Adversarial review** — cold headless content, language, and fact reviewers re-check a frozen draft with no drafting-session context; `/linkedin:pivot` re-opens cleared gates on major rewrites
- **Content engine** — Content Matrix (40+ ideas from one topic), voice training with drift detection, full ideation → publish → 48-hour monitoring
- **Honest analytics** — CSV-import pipeline with weekly/monthly reports and anomaly alerts. Adds an
  **optional, manually-entered `saves`** count (add a `Saves` column with the number read off native
  LinkedIn analytics; never auto-tracked, `unknown` ≠ 0, excluded from the engagement rate). `dwell`
  time stays **explicitly unmeasurable** — no fabricated metric or surface
- **Growth and monetization** — phase-specific guidance from 0 to 10K+ followers; topic-relevance profile optimization aligned to LinkedIn's 2026 ranking model

Key commands: `/linkedin:create` + `/linkedin:measure` (journey front-doors), `/linkedin:onboarding`, `/linkedin:post`, `/linkedin:newsletter`, `/linkedin:report`

20 agents · 30 commands (five journeys) · 6 skills · 9 hooks · [Full documentation →](https://git.fromaitochitta.com/open/linkedin-studio)

---

### [OKR for Public Sector](https://git.fromaitochitta.com/open/okr) `v1.8.2` `🇳🇴 Norwegian`

Turn strategy into measurable goals. An AI coach that learns your organization once, then builds on that knowledge so you spend time on strategy, not re-explaining context.

- **Strategy to OKR** — transform goals from virksomhetsplan or tildelingsbrev into well-structured OKR with quality checks and alignment scoring
- **Gap analysis** — `/okr:gap` compares strategy documents against current OKR: what's covered, what's missing, what to do
- **Cross-cycle learning** — `/okr:analyse` tracks score trends and recurring antipatterns across cycles with charts
- **19 antipattern detection** — catches sandbagging, activity-disguised-as-KR, set-and-forget, and 16 more
- **Built for norsk offentlig sektor** — 4-month tertials, DFO terminology, tillitsvalgt involvement, Riksrevisjon-ready documentation

Key commands: `/okr:skriv`, `/okr:kvalitet`, `/okr:gap`, `/okr:analyse`, `/okr:kaskade`, `/okr:governance`

7 agents · 14 commands · 3 hooks · [Full documentation →](https://git.fromaitochitta.com/open/okr)

---

### [Human-Friendly Style](https://git.fromaitochitta.com/open/human-friendly-style) `v1.1.0`

A shared Claude Code [output style](https://code.claude.com/docs/en/output-styles) used across this marketplace, so the conversation feels like dialog rather than a console dump.

- Explains what and why, not how — reserving technical detail for when you ask
- Hides noise by default — long paths, raw commands, JSON, and stack traces are summarized
- Always shows irreversible actions verbatim — deploys, deletes, force-push, migrations
- Matches your language (Norwegian or English) and is honest about uncertainty

Optional and works alongside every other plugin. Activate with `/config` → Output style → Human-Friendly.

1 output style · [Full documentation →](https://git.fromaitochitta.com/open/human-friendly-style)

---

### [Claude Design](https://git.fromaitochitta.com/open/claude-design) `v0.1.0`

End-to-end facilitator for prompting Claude Design (`claude.ai/design`). Walks you from raw idea through prompt drafting, delivery, and iteration coaching. The output is the prompt; the artifact gets built in Claude Design.

- **Eight-phase flow** — disambiguate → intent preset → audience and destination → DESIGN.md anchor → five-layer prompt → delivery → iteration coaching → ship-readiness
- **Evidence-graded references** — five foundation plus eight per-preset references, each carrying an Anthropic-domain citation
- **Complements Anthropic's official design plugin** — this covers idea → prompt → iterate; theirs covers critique → handoff, with zero command overlap (enforced by test)

1 skill · 13 reference files · 5 tests · [Full documentation →](https://git.fromaitochitta.com/open/claude-design)

---

### [repo-mailbox](https://git.fromaitochitta.com/open/repo-mailbox) `v0.20.2`

A local mailbox for coordination between Claude Code sessions in different repositories. Session A in repo X leaves a message for repo Y; the next session in repo Y gets it injected as context at startup. Local, private, no network, no SaaS.

- **Deliver until done** — directed messages re-inject at every session start (`/clear` never loses them) until replied to or archived; broadcasts deliver once per repo via a seen set. `reply-expected` distinguishes a question from a notice (`--fyi`); absence means expected
- **Untrusted by design** — message content is quote-prefixed and framed as untrusted data; send-side field sanitization blocks frontmatter injection. The obligation to answer is procedural, never substantive
- **`coord-send`** — natural-language sending: maps "tell repo-x the bug is fixed" to the right delivery — broadcasts, bounded multi-target loops, replies, retractions, and deferred sends
- **`board`** — read-only cross-repo attention board: which repos have a live next step, which are blocked and on whom, which owe a reply, and what each costs to move
- **`route`** — turns four scored traits of the next task into a model/effort row from a closed six-row rubric, with a pasteable startup command and a one-row-cheaper fallback

1 hook · 3 skills · 8 CLI scripts · 398 selftest checks · [Full documentation →](https://git.fromaitochitta.com/open/repo-mailbox)

---

### [repo-standard](https://git.fromaitochitta.com/open/repo-standard) `v0.2.2`

Per-repo gate for the open/ presentation standard: README first screen, install block, files required by the repo's class, and dead repo references.

- **Twelve checks** — first screen, install block and install truth, required headings, files required by the repo's class and traits, dead `open/<name>` references, relative links, licence claim, badge honesty, boilerplate, version consistency, description length
- **Two axes on every finding** — level (`ERROR`/`WARN`/`SKIP`/`OK`) and bucket (broken/missing/weakening); the output is grouped by bucket, which is the order the work gets done in
- **A `SKIP` is never a pass** — checks that could not run print under their own "NOT CHECKED" heading instead of counting as green
- **The class decides what is required** — plugin, catalog, shared-asset, standalone and org-profile each get their own install form and required files, so a five-line org profile is not measured against a plugin's bar
- **It records, it does not fix** — findings first, remediation afterwards

1 skill · 12 checks · 84 tests · [Full documentation →](https://git.fromaitochitta.com/open/repo-standard)

---

## Shared infrastructure

### [Playground Design System](https://git.fromaitochitta.com/open/playground-design-system) `v0.6.0`

Shared design system for plugin Playgrounds — the visual self-service UIs that complement terminal slash-commands. Aksel/Digdir-aligned, WCAG 2.1 AA, light + dark themes, print-ready. Used by `ms-ai-architect`, `okr`, `llm-security`, `voyage`, and `config-audit`.

- **Tokens and components** — self-hosted fonts (OFL 1.1), a deuteranopia-safe severity ramp, and Tier 1–3 components: radar, matrix-heatmap, findings-browser, AI Act pyramid and timeline, maturity-ladder, and more
- **Privacy-first** — all fonts self-hosted, zero CDN requests, works offline and behind air-gapped firewalls
- **Vendoring sync** — `scripts/sync-design-system.mjs <plugin>` keeps each plugin standalone; a SHA-256 manifest detects local drift

[Full documentation →](https://git.fromaitochitta.com/open/playground-design-system) · [Browse showcase](https://git.fromaitochitta.com/open/playground-design-system/src/branch/main/playground-examples/index.html)

---

## License

MIT