ECC Engineering Harness
A cross-harness engineering workflow system for planning, testing, review, memory, and agent-configuration security.
- Source repo
- affaan-m/ECC
- Stars
- ★ 298k
- Last updated
- 4d ago
- License
- MIT
- Primary language
- JavaScript
- FA score
- 66/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A Claude Code team building a feature can start with
/ecc:plan "Add authentication"and usetdd-workflowto run a test-first implementation cycle. - Not a fit if
- Teams needing fully offline or air-gapped installs
- Users who want one harness only, not multi-harness config
- Teams needing a stable Codex plugin; that path is experimental
- Source review
- 66/100 · Some gaps
What does this agent do, and when should you use it?
ECC is an engineering workflow and configuration system for Claude Code, Codex, and several other agent harnesses. It packages 67 specialized subagents, 281 on-demand skills, 94 maintained command shims, selective rules, runtime hooks, and AgentShield scanning. Its stated workflow moves from planning through testing, implementation, fresh-context review, verification, memory, and improvement. Delivery is through a Claude Code plugin, a Codex sync flow, and adapters for other editors and CLIs, with the repository root serving as the source of truth. ECC runs on top of an existing harness and project workspace rather than replacing the underlying model, terminal, or source-control workflow.
ECC can create an implementation blueprint through /ecc:plan, then pair it with tdd-workflow to capture RED→GREEN→REFACTOR evidence; /code-review, /build-fix, and /security-scan expose review, build-repair, and security workflows. Its installers—install.sh, install.ps1, and npx ecc—install selected skills, rules, commands, and platform configuration, while scripts/sync-ecc-to-codex.sh merges ECC AGENTS.md, skills, prompts, agents, and reference configuration into ~/.codex. ecc memory creates, searches, reads, and checks Markdown memory in .ecc/memory/ or ~/.ecc/memory/; the optional ecc-memory-mcp exposes only memory_save, memory_search, memory_read, and memory_doctor. AgentShield scans prompts, hooks, MCP configuration, permissions, secrets, and agent files.
- A Claude Code team building a feature can start with
/ecc:plan "Add authentication"and usetdd-workflowto run a test-first implementation cycle. - A Codex App or CLI user can synchronize ECC skills, prompts, agents, and reference configuration into an existing
~/.codexsetup. - An engineer preparing a change for merge can run
/code-reviewfor a fresh-context review and/security-scanto audit the agent configuration surface. - A maintainer of a multilingual repository can install
rules/commonplus only the language pack used by that project. - A team handing work between Claude, Codex, Hermes, OpenClaw, or Kimi can keep searchable Markdown handoffs in the Memory Vault.
How do you install or deploy this agent?
For Claude Code, run inside Claude Code:
/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@eccFor the documented Codex sync flow:
git clone https://github.com/affaan-m/ECC.git
cd ECC
npm install
bash scripts/sync-ecc-to-codex.shUse one ECC installation path per harness. Do not combine the Claude plugin with a full manual Claude install, or Codex sync with the Codex marketplace plugin. Before using the memory CLI or optional MCP server, install its separate runtime with npm install -g ecc-universal.
How do you use this agent?
For a feature, start with /ecc:plan "describe the feature", confirm the plan, and activate tdd-workflow; after implementation, run /code-review and the repository's build, lint, type-check, and test commands. Use /build-fix for a failing build, and /security-scan or npx -y ecc-agentshield scan --path . to audit agent configuration. For durable handoffs, run ecc memory init --scope project, then search with ecc memory search "authentication migration" --target-harness codex; important recalled claims still require verification against authoritative sources.
What are this agent's strengths and limitations?
- It connects planning, TDD, review, and verification through named workflow surfaces such as
/ecc:plan,tdd-workflow, and/code-review. - It provides a Claude Code plugin, a documented Codex sync flow, and target adapters for Cursor, OpenCode, Gemini CLI, Zed, and more.
- Selective rules and on-demand skills provide a documented way to limit always-loaded context.
- AgentShield explicitly treats prompts, hooks, MCP configuration, permissions, secrets, and agent files as scan targets.
- The Memory Vault uses an inspectable local Markdown format for handoffs across the listed harnesses.
- Installation methods must not be stacked: duplicate installs can duplicate skills, commands, hooks, or configuration and may require cleanup.
- The full workflow depends on a shell, Git, Node.js, filesystem access, and an existing target harness rather than operating as a standalone hosted agent.
- The Codex marketplace plugin is labeled experimental because shared repository content may not be copied into Codex's install cache; the project recommends sync when all skills are needed.
- Memory Vault entries are explicitly unreviewed context, so they cannot be treated as executable policy or verified knowledge.
- The
multi-*commands require a separately installed and initializedccg-workflowruntime.
How does this agent compare with similar options?
ECC distinguishes itself from a prompt-only configuration by separating selective always-loaded rules, task-loaded skills, out-of-context hooks, and scoped subagents for planning and review. Within its own delivery choices, the repository contrasts the recommended Codex sync flow with its experimental Codex marketplace plugin and advises against using both in the same harness.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| ECC Engineering Harness This agent | 66 · Some gaps | Agent plugin / skillFreemium | ★ 298k | 4d ago | JavaScript | Codex · Claude Code |
| Pilot Shell | 53 · Major gaps | CLIPaid | ★ 2.1k | today | Shell | Claude Code |
| Agent Skills — Production-Grade Engineering Skills for AI Agents | 71 · Some gaps | CLIFree + model costs | ★ 113k | 4d ago | JavaScript | Codex · Claude Code · OpenAI API |
| Sno Station | 53 · Major gaps | CLIFreemium | ★ 1k | 1d ago | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README and SECURITY.md emphasize official sources, avoiding third-party mirrors; install wizard requires user confirmation; SECURITY.md provides secrets handling guidance and local port checks; CI workflows use minimal permissions and pinned SHAs; rollback/repair scripts exist; source attribution is clear (GitHub, npm, GitHub App). Deductions: no actual permission audit or runtime verification, user confirmation mechanism not directly shown in code, dependency security only via npm audit and IOC scan in CI, no detailed reports.
Evidence shows: README and package.json descriptions are consistent, CI workflows cover multiple platforms and package managers, test scripts exist; dependency versions are pinned, with overrides and resolutions; failure messages are reflected in CI by uploading test artifacts. Deductions: no actual run results, specific failure message content not shown in source, dependency availability not actually verified.
Evidence shows: README provides multi-language docs and multiple install paths, supports multiple harnesses; capability boundaries are described in README (e.g., Claude Code best, others limited); trigger precision via install wizard and command options; environment fit via CI matrix and platform support matrix. Deductions: no actual run verification, capability boundaries may be overly optimistic, trigger precision not directly verified in code.
Evidence shows: README structure is clear, provides install instructions, examples, FAQ links; naming is stable (ecc@ecc, ecc-universal); known limitations are mentioned in README; MIT license is explicit; version numbers in package.json and VERSION file; maintenance responsibility via SECURITY.md and contribution guide. Deductions: no changelog file, version history unclear, maintenance responsibility not explicitly assigned to a single maintainer.
Evidence shows: README describes outputs as usable skills, agents, and commands; marginal value via providing 67 agents and 284 skills; cost-benefit via free open-source and sponsorship model. Deductions: no actual use cases or performance data, marginal value may be exaggerated, cost-benefit not actually evaluated.
Evidence shows: README claims have some support (e.g., agent and skill counts), CI workflows provide validation steps; cross-source corroboration via multiple docs and tests; fact vs inference distinguished in README (e.g., support status matrix). Deductions: no actual test results, claims not fully traceable, fact vs inference distinction not clear enough.
- The repository contains a large number of skills and agents, but no actual run verification is provided, and claims may be overly optimistic.
- Dependency security is only reflected via npm audit and IOC scan in CI, with no detailed reports.
- User confirmation mechanism is not directly shown in code, needs further verification.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
ECC 2.2.3 ECC 2.2.3 is a naming and release-reliability update. The project is called ECC everywhere it ships, starting with the pi/core profile, and the release workflow now waits long enough for npm to serve a freshly published version. Naming - pi/core no longer expands the project name: its README and the bundled blueprint skill refer to ECC only. The profile contents are otherwise unchanged: 123 curated skills and 24 prompt commands, 35,006 characters of skill description text. - Downstream packagers need no changes. The package is still ecc-pi-core, the …View on GitHub ↗ -
Release notes excerpt
ECC 2.2.2 ECC 2.2.2 adds pi/core, a curated Pi-native skills+prompts-only profile built for downstream packagers that mirror GitHub Releases, plus a set of packaging, memory, hooks, and Windows compatibility fixes. Pi core profile pi/core/ is a self-contained package (ecc-pi-core) that downstream mirrors of the release tarball can copy directly: no build step, no extensions, no hooks, no runtime downloads, and no network or SaaS dependencies. - 123 curated skills (language and framework patterns, testing/TDD, code review, …View on GitHub ↗ -
Release notes excerpt
ECC 2.2.1 ECC 2.2.1 is a bug and security patch for ECC 2.2. It keeps the published v2.2.0 history immutable. These notes describe the prepared patch; publication and signing evidence are tracked separately in the release checklist. Security and data protection - GateGuard and governance capture recognize destructive PowerShell commands, including the native PowerShell tool path. Dynamic command handling prevents later variable assignments from concealing earlier unresolved invocations ([#2961](https://github.com/affaan-m/ECC/pull/2961)). …View on GitHub ↗
FAQ
Is ECC free to use?
Can I use ECC with both Claude Code and Codex?
Does the plugin automatically enable every MCP server?
chrome-devtools as the one default connector; other MCP setup is opt-in.