CoCo Super Intelligence
The orchestration layer that turns Claude Code, Cursor, or Codex into an engineering department: a 389-expert advisory board, 185 skills, 280 commands, and disk-persistent state — all local.
Per-dimension scores and reasoning
least_privilege: CI uses contents:read and SHA-pinned actions; installers symlink only into the cloned repo; no over-privileged defaults found — 2, not 3, since no per-command permission inventory exists. user_confirmation: bootstrap installer now pauses with [y/N] showing commit hash before running install.sh, with --yes escape hatch; YOLO mode is opt-in with /coco careful to revert — 2, though risk framing around approval-gate bypass is thin. data_flow_transparency: repeated 100% local / no telemetry claims and locally generated commands — 2; unverifiable statically and Brain's email/chat indexing flow is under-explained. sensitive_data_handling: the Brain bundle indexes email, chat, code into a local SQLite store with no stated encryption, retention, or purge policy — deducted to 1. dependency_security: pinned pyyaml, SHA-pinned actions, no bundled third-party plugins — 2; vendored third-party skills' licenses rest on a one-line CREDITS.md reference. external_effects: installers write to home dirs and the working tree; SECURITY.md assesses symlink behavior and CI syntax-checks install scripts — 2. rollback: disk-persistent state with atomic git commits, checkpoints, and /coco careful — 2; failure paths of the recovery flow are undocumented. source_attribution: CREDITS.md credits devildev (Apache-2.0) design with no code copied; personas carry cited URLs and a validation gate — 2.
self_consistency: multiple numeric contradictions — README badge says skills-149 while body/asset table say 185; package. description says 179 skills/279 commands vs README's 185/280; copyright year 2026 is odd — deducted to 1. dependency_availability: minimal deps (Python3+git, node>=14), pinned pyyaml in CI — 2. failure_messages: gate scripts exit non-zero and self-identify (fabricated arch paths name themselves); --no-arch gates report DISABLED, never a silent pass — 2.
audience_and_scenarios: explicitly targets engineering teams on Claude Code/Cursor/Codex; Before/After table covers decisions, development, auditing, debugging, context resets — 3. capability_boundaries: a dedicated 'What it does not do' section states structural-drift-only scope, non-work-allocation status, and unenforced currency checks — unusually honest, 3. trigger_precision: two-stage routing and greedy scorer are concretely specified, but keyword-based matching quality is unproven — 2. environment_fit: five adapters plus CI dry-run and a bundle-advertisement consistency gate per adapter — 3.
information_architecture: build-index.py generates multi-level INDEX files and CI fails if they drift — 3. install_notes: one-liner install, --systems/--dry-run/--list options, npm bin entry — 3; no uninstall instructions documented. naming_stability: check-command-refs.sh guards hyphen/colon naming drift and documents the installer mapping — 2; count metadata is unstable (see self_consistency). examples_and_faq: rich command examples, demo gif, full skill catalog, but no FAQ or troubleshooting section — 2. known_limitations: persona gate self-reports two limits (quotation authenticity unverified, home_team presence-only, NEEDS-TOPUP advisory only); four explicit non-promises for the arch gate — 3. license: NOASSERTION metadata; MIT/proprietary split stated in LICENSE but systems/superintelligence/LICENSE is not present in evidence and the badge oversimplifies the mixed licensing — 1. versioning_changelog: version 1.2.0 badge consistent with package. and CHANGELOG.md linked — 2; CHANGELOG content absent from evidence. maintenance_responsibility: SECURITY.md gives a 7-day response / 30-day fix SLA and coordinated disclosure; CI comments show active self-repair (suites previously unrun now wired in) — 2; publisher unverified, capped at 2.
output_usability: line-by-line attributed verdicts with named dissent, SSIM summary JSON, explicit BLOCK/UNVERIFIED verdicts — 2; actual output quality not executed-verified. marginal_value: 903 assets, verification gates, persistent state differentiate from a bare harness — 2; real utility of assets not statically provable. cost_benefit: zero-dependency core runnable with Python3+git; the proprietary SI tier is an unquantified hidden cost — 2.
claim_traceability: personas require per-stance evidence_url checked live by a validation gate; architecture claims map to checkable paths in .arch/index. — 2; the gate itself admits it verifies citation, not authenticity. cross_source_corroboration: skill/command counts conflict across README badge, README body, and package. (149/179/185; 279/280) — deducted to 1. fact_inference_separation: 'What it does not do' and NEEDS-TOPUP sections clearly separate facts from limits, but marketing phrasing ('389 world-class minds', 'Super Intelligence') is intermixed with verifiable claims — 2.
- Skill/command counts conflict across the README badge (149), README body (185), and package. description (179 skills/279 commands); verify actual asset counts before adoption.
- The Brain bundle indexes local email, chat, and code into SQLite with no stated encryption, retention, or purge policy — assess before pointing it at sensitive data.
- The core is MIT, but systems/superintelligence/ is proprietary and its license text was not present in the reviewed evidence; confirm licensing scope before commercial use.
- YOLO mode and /gsd-autonomous bypass approval gates for unattended execution; enable only in isolated environments.
- The persona validation gate confirms citations exist, not that quotations are authentic; do not treat the 389 'world-class experts' as authoritative fact sources.
- Publisher identity is unverified and installation is bootstrapped via curl|bash; review install.sh before running it.
What does this agent do, and when should you use it?
CoCo Super Intelligence is an open-core orchestration layer that installs into the AI coding tool you already use — Claude Code, Cursor, Codex CLI, or any AGENTS.md-compatible harness — rather than being a new model or agent runtime. It ships as Markdown and YAML assets injected via IDE adapters; your host tool runs the model and executes the agents. Its capabilities include a 389-persona expert advisory board (the proprietary Super Intelligence system), 185 skills, 280 slash commands, 34 specialized agents, and 15 cross-IDE rules. Four opt-in system bundles extend it: GSD project orchestration, Brain local knowledge graph, Team multi-agent pipeline, and Super Intelligence. State persists to disk across /clear, and architecture conformance is enforced through a commit-pinned .arch/index. plus a built-as-declared gate against ARCH-PLAN.. Installation takes about 90 seconds, runs 100% locally, and adds no telemetry.
At install, CoCo compiles its rules, skills, commands, and agent definitions into Markdown/YAML and symlinks them into the host tool. Commands like /SI-Decide assemble a 16–32-person expert panel via two-stage routing (team/cell scoring, then a greedy scorer: 0.40 domain + 0.30 cell-coverage + 0.30 conflict-pairing), support --debate reacting rounds, and return attributed verdicts with named dissent. /team:ship runs a 6-stage build pipeline with 7 hard verification gates and 2 architecture conformance gates; /team:verify detects structural drift against .arch/index.; /code-verification audits fresh code against 7 bug vectors. The /coco conversational router dispatches plain-English requests to subcommands; /coco yolo bypasses approval gates for unattended runs. State, decisions, and progress logs persist to disk with atomic git commits per step.
- An engineering lead facing a major decision like a database migration who wants /SI-Decide to convene a cross-department expert panel with attributed debate instead of relying on one model's opinion
- A solo developer in Claude Code who wants the /team:ship multi-agent pipeline to plan, build, test, and verify features in parallel build waves
- A team needing to catch architectural drift — cases where tests pass but components were quietly relocated or deleted — via the commit-pinned .arch/index. validators
- An engineer running a long migration who needs disk-persistent state to resume phase, decisions, and progress from any checkpoint after every /clear
- A product manager using prd-generator and pmstudio skills to produce PRDs and requirement docs inside the coding session
- A GRC reviewer running /SI-GRC-Review to check a customer onboarding flow for GDPR/SOC 2 compliance
What are this agent's strengths and limitations?
- Vendor-neutral: a pure Markdown/YAML asset layer whose workflows follow you across Claude Code, Cursor, Codex CLI, and any AGENTS.md tool
- 389-persona advisory board supports attributed debate with named dissent, every stance grounded in cited public-source evidence URLs
- Architecture conformance gates are enforced by Python scripts with real exit codes, catching structural drift that test suites miss
- 100% local with no telemetry; the remote bootstrap requires commit-hash confirmation before executing
- Disk-persistent state with atomic git commits lets long tasks resume across /clear and roll back bad design paths
- The Super Intelligence board (389 personas and 242 /SI-* commands) is proprietary, own-use only; only the core is MIT
- Not a model or agent runtime — every capability depends on a host harness; without one it does nothing
- Persona citations pass an anti-fabrication gate that verifies citations exist, not that quotations are authentic; home_team is presence-checked only
- Architecture index currency is enforced by prose convention, not scripts — a stale index degrades gates to UNVERIFIED
- GitHub reports license as NOASSERTION; adopters must review the MIT-core vs. proprietary boundary themselves
How do you install or deploy this agent?
Standard: git clone https://github.com/coco-research/coco.git && cd coco && bash install.sh (auto-detects your IDE/CLI, ~90 seconds). Enable bundles: bash install.sh --systems gsd,brain or --systems superintelligence. Force an adapter: bash install.sh --adapter claude-code|cursor|codex|generic. Via npm: configure the @coco-research GitHub Packages registry in ~/.npmrc, then npm install -g cocosuperintelligence && coco. One-line remote: bash <(curl -fsSL https://raw.githubusercontent.com/coco-research/coco/main/bin/coco-bootstrap.sh) — the script prints the cloned commit hash for verification before running. Requires Python 3 and git.
How do you use this agent?
Invoke slash commands in your host tool session: /SI-Decide "question" (optionally with --debate) for expert verdicts; /team arch build to map the repo into an architecture index; /team ship to declare intended architecture and verify the build matches; /team verify for verification including drift detection; /code-verification for code-integrity audits; /coco to open the conversational router; /coco yolo for unattended mode (/coco careful or /coco normal to revert). Edit skills at skills/<name>/SKILL.md and re-run bash install.sh to refresh symlinks. Disable update checks with COCO_NO_UPDATE_CHECK=1.
How does this agent compare with similar options?
The README positions CoCo as an enhancement layer over host tools like Claude Code, Cursor, and Codex rather than a competitor; it adapts engineering-discipline skills from obra/superpowers, the GSD bundle from gsd-build/get-shit-done, and architecture-gate design from lak7/devildev.