TL;DR

ECC (affaan-m/ECC), the project many people still know as Everything Claude Code, is a large, MIT-licensed bundle of agents, skills, hooks, rules and a memory system that you install into a coding agent. It works best with Claude Code, has native plugin paths for Codex and Qoder, and ships thinner adapters for Cursor, OpenCode, Gemini, Zed, Copilot, Kimi, OpenClaw and others. Its pitch is a fixed engineering loop: plan → test → implement → review → verify → remember → improve.

Facts as of November 2, 2026:

  • 295,109 GitHub stars and 43,685 forks. The repo was created on January 18, 2026, and it is back on GitHub’s weekly trending list with 6,299 stars this week.
  • 78 open issues (issues only, not pull requests).
  • License: MIT. A paid hosted GitHub App, ECC Pro, covers private repos from $19 per seat per month.
  • Latest release: v2.2.3, published October 1, 2026, on GitHub and as the npm package ecc-universal.
  • The README counts 71 agents, 314 skills and 98 legacy command shims, plus hooks, rules, memory and the AgentShield config scanner (ecc-agentshield 1.6.0 on npm).

Our verdict: ECC is the biggest single collection of Claude Code workflow material you can install, and version 2.2 finally makes it installable with some care: a guided setup, dry runs, an install-state file, doctor, repair and uninstall. The installer and AgentShield worked in our test container. The catch is the one the community has raised since spring: every installed skill and agent adds its name and description to your context from the first token. Install a small profile, not the whole catalog.

Quick Reference

FieldValue
What it isAgents, skills, hooks, rules, memory and a security scanner for coding agents
Best supportedClaude Code (stable); Codex and Qoder (native plugins)
Other harnessesCursor, OpenCode, Copilot CLI (beta); Gemini, Zed, Kimi, OpenClaw and others (experimental)
Installnpx [email protected] setup or /plugin install ecc@ecc inside Claude Code
RequirementsNode.js 18+; for the Claude plugin also Git and Claude Code 2.1+
Catalog71 agents, 314 skills, 98 commands (per README)
Default MCP serversOne: chrome-devtools
PriceFree (MIT); ECC Pro GitHub App from $19/seat/month for private repos
Latest releasev2.2.3 (October 1, 2026)
LicenseMIT

What ECC Actually Is

ECC began as one developer’s Claude Code configuration. Affaan Mustafa published it in January 2026 as everything-claude-code, and it grew into what the README now calls “a coordinated engineering system and toolbox” for coding agents. It is not a new agent, and it does not call a model itself. It is files and scripts that your existing agent loads:

  • Agents: subagents for planning, architecture, code review, security review, build repair and language-specific review.
  • Skills: the main surface since 2.x: TDD, research, security, docs, frontend, data, ML, operations.
  • Commands: /ecc:plan, /code-review, /build-fix, /save-session and others, kept as shims while the project moves to skills.
  • Hooks: runtime enforcement, session summaries, “instincts” learned from earlier sessions, and context controls. Hooks are opt-in and the installer stops and asks before writing them.
  • Rules: always-loaded standards by language. Claude Code plugins cannot ship rules, so you copy only the packs you want.
  • Memory Vault (new in 2.2): one local Markdown format under .ecc/memory/ that Claude, Codex, Hermes, OpenClaw and Kimi can all read, for handoffs between harnesses.
  • AgentShield: a separate npm package that scans agent config (settings, hooks, MCP config, permissions, secrets, agent files) for risky setups.

If you have read our Superpowers review, the difference is scope. Superpowers is a tight methodology with a small set of skills. ECC is a catalog with a methodology on top.

ECC has been near the top of GitHub for most of 2026, but three things brought it back to the weekly trending list. The 2.2 line (August 25 to October 1) added guided, manifest-driven setup across Claude Code, Codex and Kimi Code, with install-state ownership so ECC removes only files it wrote. It added a native Antigravity install and a thin Pi adapter. And the June 2026 MCP audit replaced six default MCP connectors with a single one, which answered one of the loudest complaints about context bloat.

The project’s MCP connector policy says a default server must be universal and must need something only MCP gives, such as held-open session state. By that rule the GitHub MCP server gave way to the gh CLI in a skill, and only Google’s chrome-devtools server survived.

Key Features

A guided installer that can undo itself

The headline of 2.2 is the setup flow:

# Claude Code plugin: pick scope and hook profile
npx [email protected] setup

# Several harnesses in one reviewed flow
npx [email protected] install --guided

# Preview without writing anything
npx [email protected] install --guided --harness codex --dry-run

The wizard inventories existing Claude plugin scopes first and asks for one final confirmation; list-installed, doctor, repair and uninstall follow. The README’s main warning: do not stack install methods, or skills, commands and hooks get duplicated.

An advisor that picks components for you

Instead of installing 314 skills, you can ask which ones match your work:

npx [email protected] consult "security reviews" --target claude
npx [email protected] install --profile minimal --target claude --with capability:security

consult returns ranked components with install and preview commands. We ran it; see the hands-on section.

Profiles, a no-hooks path and context caps

Profiles include minimal, core, security and full. The minimal profile deliberately leaves out the hook runtime, and if a profile would install hooks and you pass neither --enable-hooks nor --no-hooks, the installer stops before writing. Environment variables cap what hooks inject: SessionStart extra context defaults to 8,000 characters (and can be turned off), and at most 6 learned instincts are injected by default.

AgentShield

AgentShield is a standalone scanner (npm install -g ecc-agentshield, then agentshield scan --path .). It scores categories such as hooks, MCP servers and agents, detects which harness a repo is set up for, and prints findings with a fix line. It works on its own. For auditing application code rather than agent config, see Cloudflare’s security-audit-skill.

Getting Started

The shortest sensible path for a Claude Code user (Node.js 18+, Git and Claude Code 2.1+ installed):

npx [email protected] consult "typescript tdd code review" --target claude
npx [email protected] install --profile minimal --target claude
# then, inside Claude Code:
/ecc:plan "Add rate limiting to the public API"

Then use the TDD skill for the build, /code-review for a fresh-context review, and /save-session at the end. Add the hook runtime later, once you know which hooks you want.

Hands-on test (November 2, 2026)

We ran ECC’s npm package in a fresh node:22-bookworm container on a GitHub-hosted runner (x86_64, 2 CPUs, 8 GB RAM, no GPU) against commit b38be6a7f635. We installed [email protected] and [email protected], asked the advisor what to install for security reviews, previewed a minimal Claude Code install as a dry run, and ran AgentShield on a deliberately bad config. The verdict is partial: 4 of 5 steps passed, in 6.2 seconds in total. The one failure was a version check we guessed at, not one the README documents.

StepResultTime
npm install -g [email protected] [email protected]”added 71 packages in 5s”5.2 s
npm ls -g then ecc --versionnpm listed both packages at the pinned versions; ecc --version failed with “Error: Unknown argument: —version” and printed the install.sh usage text (exit 1)0.5 s
ecc consult 'security reviews' --target claudeRanked 5 components: capability:security, agent:code-reviewer, skill:security-review, agent:fsharp-reviewer, agent:security-reviewer, each with Install and Preview commands; suggested the security and full profiles0.1 s
ecc install --profile minimal --target claude --dry-run in an empty git repoPrinted a file plan mapping sources to /root/.claude/skills/... (for example context-budget, git-workflow, codebase-onboarding, santa-method)0.2 s
agentshield scan --path . on a .claude/settings.json allowing Bash(*)Detected Claude Code (“strong”, from .claude/settings.json); 3 findings: 1 critical (“Overly permissive allow rule: Bash(*)”), 1 high (“No deny list configured”), 1 medium (“No PreToolUse security hooks configured”), each with a fix0.2 s

What worked: the package installs fast on a stock Debian image, and the advisor and dry run do what the README says, with no account and no API key. AgentShield caught all three problems we planted and gave specific fixes, such as replacing Bash(*) with Bash(git *), Bash(npm *), Bash(node *).

What failed or surprised us: there is no --version flag. The ecc binary passed the unknown argument through to the installer’s usage screen, so the quickest way to check your version is npm ls -g or npx [email protected] with a pinned tag. Both the usage screen and the dry-run output end with a “Compute:” paragraph promoting Itô, the project’s GPU sponsor. It says it is passive and does nothing, which matched what we saw, but sponsor text inside installer output is unusual.

What this test does not tell you: we did not install Claude Code, run a model, enable hooks or let ECC drive a real task, so we have not checked whether the plan → TDD → review loop produces better code, how much context the installed catalog costs, or how the instincts system behaves over weeks. We saw only the last 40 lines of the dry-run plan, so we cannot give a total file count for the minimal profile.

Things to Check Before You Adopt It

  1. Context cost at session start. Skill bodies load only when they fire, but every installed skill’s name and description is in context from the start. In an April 2026 r/ClaudeCode thread, one commenter measured ECC’s skill metadata at about 85,000 characters for 286 skills, roughly 21,000 tokens, plus about 5,000 more tokens of other metadata. The catalog has grown since. The README itself says to use a selective profile “when context footprint matters.” For most people that means always.
  2. Hooks run code on every tool call. That is the point of them, and ECC gates them behind an explicit choice. Read the hook list before you pass --enable-hooks.
  3. Parity is uneven. The README’s own support matrix labels Claude Code stable, Codex and Qoder supported, Cursor, OpenCode and Copilot CLI beta, and the rest experimental. Some continuous-learning and orchestration features need Bash or Python, and native Windows has open defects in the learning observer and memory-vault writes.
  4. One maintainer. The README says a single maintainer ships weekly across seven harnesses. That is a bus-factor question for something wired into your agent’s hooks.
  5. Install from official channels only. The README warns that third-party re-uploads of ECC exist and may contain malware. Use the GitHub repo, the ecc-universal and ecc-agentshield npm packages, the ecc@ecc plugin slug or ecc.tools.
  6. Some commands send code elsewhere. /astra-review sends Claude-written diffs to OpenAI through your local Codex CLI.

Who Should Use It

  • Claude Code users who want a ready process (plan, tests first, fresh-context review, session save and resume) and do not want to write their own skills.
  • Teams running several agents who want one memory format and one set of standards across Claude Code, Codex and Kimi.
  • Anyone who wants AgentShield for a quick audit of agent permissions. It works on its own.

Skip it if you already have a tuned CLAUDE.md and skills you trust, or run small local models with tight context. Take individual skills from the repo instead.

Alternatives

ToolFocusCompared with ECC
SuperpowersSmall, opinionated skill methodologyFar smaller context footprint; costs more at execution (subagent per task, review loops)
RufloSwarms, vector memory, MCP toolsMore orchestration machinery (swarms, federation)
oh-my-claudecodeMulti-agent orchestration modes for Claude CodeNarrower scope, orchestration-first
claude-memPersistent session memoryMemory only; ECC’s vault is one feature among many
context-modeShrinking tool output in contextComplements a lean ECC install

Community Reactions

ECC went wide in February via “someone just dropped this repo” posts on r/ClaudeCode and r/ClaudeAI, where supporters pointed to the practical material and the author’s Anthropic hackathon win. A March Medium piece by Ewan Mak called it the harness “that’s dividing the developer community,” and the split is mostly about size. A July r/ClaudeAI commenter summed up the recurring “Superpowers vs ECC” debate: Superpowers costs you at execution time, ECC costs you at session start.

FAQ

Is ECC the same as Everything Claude Code?

Yes. The repository was published as everything-claude-code in January 2026 and now lives at github.com/affaan-m/ECC. The npm package is ecc-universal and the Claude Code plugin slug is ecc@ecc.

Is ECC free?

The repository is MIT-licensed and free. ECC Pro is a hosted GitHub App for private repos that adds PR-triggered audits and AgentShield-backed scanning, from $19 per seat per month. You still pay your model provider for whatever agent you run.

Does ECC work with Codex, Cursor or OpenCode?

Codex has a supported native plugin. Cursor and OpenCode have beta adapters without full Claude Code parity; Gemini, Zed, Kimi, OpenClaw and others are experimental.

How do I keep ECC from filling my context window?

Install --profile minimal, add specific skills with --with, run consult first to find them, and set the SessionStart caps (or turn SessionStart context off) if you use local models. Avoid the full profile unless you have measured the cost.

How do I uninstall ECC?

Run npx [email protected] uninstall --dry-run from the install directory, then without --dry-run. It removes only files in its install-state. Plugin users remove the plugin inside Claude Code.

Bottom Line

ECC is no longer the sprawling config dump its early critics described. Version 2.2 gives it a careful installer, a dry run, a component advisor and a clean uninstall, and the June MCP audit shows a maintainer who takes context cost seriously. The catalog is still huge, and that size is the main risk: install a small profile, add skills on purpose, and treat hooks as code you have reviewed. AgentShield is worth running on any agent-configured repo today, whether or not you take the rest.

Sources