ECC Engineering Harness
A cross-harness engineering workflow system for planning, testing, review, memory, and agent-configuration security.
Per-dimension scores and reasoning
Evidence shows: README and SECURITY.md emphasize official sources, avoiding third-party mirrors; install wizard requires user confirmation; SECURITY.md provides secrets handling guidance and local port checks; CI workflows use minimal permissions and pinned SHAs; rollback/repair scripts exist; source attribution is clear (GitHub, npm, GitHub App). Deductions: no actual permission audit or runtime verification, user confirmation mechanism not directly shown in code, dependency security only via npm audit and IOC scan in CI, no detailed reports.
Evidence shows: README and package.json descriptions are consistent, CI workflows cover multiple platforms and package managers, test scripts exist; dependency versions are pinned, with overrides and resolutions; failure messages are reflected in CI by uploading test artifacts. Deductions: no actual run results, specific failure message content not shown in source, dependency availability not actually verified.
Evidence shows: README provides multi-language docs and multiple install paths, supports multiple harnesses; capability boundaries are described in README (e.g., Claude Code best, others limited); trigger precision via install wizard and command options; environment fit via CI matrix and platform support matrix. Deductions: no actual run verification, capability boundaries may be overly optimistic, trigger precision not directly verified in code.
Evidence shows: README structure is clear, provides install instructions, examples, FAQ links; naming is stable (ecc@ecc, ecc-universal); known limitations are mentioned in README; MIT license is explicit; version numbers in package.json and VERSION file; maintenance responsibility via SECURITY.md and contribution guide. Deductions: no changelog file, version history unclear, maintenance responsibility not explicitly assigned to a single maintainer.
Evidence shows: README describes outputs as usable skills, agents, and commands; marginal value via providing 67 agents and 284 skills; cost-benefit via free open-source and sponsorship model. Deductions: no actual use cases or performance data, marginal value may be exaggerated, cost-benefit not actually evaluated.
Evidence shows: README claims have some support (e.g., agent and skill counts), CI workflows provide validation steps; cross-source corroboration via multiple docs and tests; fact vs inference distinguished in README (e.g., support status matrix). Deductions: no actual test results, claims not fully traceable, fact vs inference distinction not clear enough.
- The repository contains a large number of skills and agents, but no actual run verification is provided, and claims may be overly optimistic.
- Dependency security is only reflected via npm audit and IOC scan in CI, with no detailed reports.
- User confirmation mechanism is not directly shown in code, needs further verification.
What does this agent do, and when should you use it?
ECC is an engineering workflow and configuration system for Claude Code, Codex, and several other agent harnesses. It packages 67 specialized subagents, 281 on-demand skills, 94 maintained command shims, selective rules, runtime hooks, and AgentShield scanning. Its stated workflow moves from planning through testing, implementation, fresh-context review, verification, memory, and improvement. Delivery is through a Claude Code plugin, a Codex sync flow, and adapters for other editors and CLIs, with the repository root serving as the source of truth. ECC runs on top of an existing harness and project workspace rather than replacing the underlying model, terminal, or source-control workflow.
ECC can create an implementation blueprint through /ecc:plan, then pair it with tdd-workflow to capture RED→GREEN→REFACTOR evidence; /code-review, /build-fix, and /security-scan expose review, build-repair, and security workflows. Its installers—install.sh, install.ps1, and npx ecc—install selected skills, rules, commands, and platform configuration, while scripts/sync-ecc-to-codex.sh merges ECC AGENTS.md, skills, prompts, agents, and reference configuration into ~/.codex. ecc memory creates, searches, reads, and checks Markdown memory in .ecc/memory/ or ~/.ecc/memory/; the optional ecc-memory-mcp exposes only memory_save, memory_search, memory_read, and memory_doctor. AgentShield scans prompts, hooks, MCP configuration, permissions, secrets, and agent files.
- A Claude Code team building a feature can start with
/ecc:plan "Add authentication"and usetdd-workflowto run a test-first implementation cycle. - A Codex App or CLI user can synchronize ECC skills, prompts, agents, and reference configuration into an existing
~/.codexsetup. - An engineer preparing a change for merge can run
/code-reviewfor a fresh-context review and/security-scanto audit the agent configuration surface. - A maintainer of a multilingual repository can install
rules/commonplus only the language pack used by that project. - A team handing work between Claude, Codex, Hermes, OpenClaw, or Kimi can keep searchable Markdown handoffs in the Memory Vault.
What are this agent's strengths and limitations?
- It connects planning, TDD, review, and verification through named workflow surfaces such as
/ecc:plan,tdd-workflow, and/code-review. - It provides a Claude Code plugin, a documented Codex sync flow, and target adapters for Cursor, OpenCode, Gemini CLI, Zed, and more.
- Selective rules and on-demand skills provide a documented way to limit always-loaded context.
- AgentShield explicitly treats prompts, hooks, MCP configuration, permissions, secrets, and agent files as scan targets.
- The Memory Vault uses an inspectable local Markdown format for handoffs across the listed harnesses.
- Installation methods must not be stacked: duplicate installs can duplicate skills, commands, hooks, or configuration and may require cleanup.
- The full workflow depends on a shell, Git, Node.js, filesystem access, and an existing target harness rather than operating as a standalone hosted agent.
- The Codex marketplace plugin is labeled experimental because shared repository content may not be copied into Codex's install cache; the project recommends sync when all skills are needed.
- Memory Vault entries are explicitly unreviewed context, so they cannot be treated as executable policy or verified knowledge.
- The
multi-*commands require a separately installed and initializedccg-workflowruntime.
How do you install or deploy this agent?
For Claude Code, run inside Claude Code:
/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@eccFor the documented Codex sync flow:
git clone https://github.com/affaan-m/ECC.git
cd ECC
npm install
bash scripts/sync-ecc-to-codex.shUse one ECC installation path per harness. Do not combine the Claude plugin with a full manual Claude install, or Codex sync with the Codex marketplace plugin. Before using the memory CLI or optional MCP server, install its separate runtime with npm install -g ecc-universal.
How do you use this agent?
For a feature, start with /ecc:plan "describe the feature", confirm the plan, and activate tdd-workflow; after implementation, run /code-review and the repository's build, lint, type-check, and test commands. Use /build-fix for a failing build, and /security-scan or npx -y ecc-agentshield scan --path . to audit agent configuration. For durable handoffs, run ecc memory init --scope project, then search with ecc memory search "authentication migration" --target-harness codex; important recalled claims still require verification against authoritative sources.
How does this agent compare with similar options?
ECC distinguishes itself from a prompt-only configuration by separating selective always-loaded rules, task-loaded skills, out-of-context hooks, and scoped subagents for planning and review. Within its own delivery choices, the repository contrasts the recommended Codex sync flow with its experimental Codex marketplace plugin and advises against using both in the same harness.
FAQ
Is ECC free to use?
Can I use ECC with both Claude Code and Codex?
Does the plugin automatically enable every MCP server?
chrome-devtools as the one default connector; other MCP setup is opt-in.