Everything Claude Code - Agent Harness Performance System

Open-source agent harness operating system for cross-harness coding agents. ECC packages skills, instincts, memory, security scanning, hooks, MCP inventory, worktree lifecycle, and rules across Claude Code, Codex, Cursor, OpenCode, Gemini, Zed, and related harnesses. It is the strongest public reference for how a serious agent setup becomes files, checks, and release gates.

Why It Matters

ECC is not a dotfile collection - it is a performance system with feedback loops. Instincts learn from sessions and evolve into skills. Hooks enforce quality gates at tool-call boundaries. Memory persists across sessions via SQLite. Security scanning runs red-team/blue-team adversarial pipelines. The compounding architecture is the real contribution, not the individual configs.

Scale

• Current source authority is affaan-m/ECC, not the older affaan-m/everything-claude-code path. GitHub redirects the repo and the current public release line is v2.0.0.
• v2.0.0 records 261 public skills, harness-neutral session adapters, normalized MCP inventory, worktree-lifecycle service, and an orch-* orchestrator family.
• Cross-platform: Claude Code, Cursor, Codex, OpenCode, Gemini, Zed, GitHub Copilot, VS Code, and related terminal-only workflows.
• AGENTS.md at root is the universal cross-tool file read by all harnesses
• DRY adapter pattern: Cursor reuses Claude Code hook scripts via adapter.js transform

Version snapshot, 2026-07-03: Git tag v2.0.0 resolves to 7d80c7433c4c914da9487138f185f2eab9b22073, default-branch HEAD resolves to 81af40761939056ab3dc54732fd4f562a27309d0, ecc-universal@2.0.0 is the npm latest release, ecc-universal@next is 2.0.0-rc.1, and ecc-agentshield@1.4.0 is the current standalone security scanner release. GitHub reports about 225K stars and 34.5K forks, so use "200K+" in prose. Source: GitHub affaan-m/ECC, 2026-07-03; npm registry, 2026-07-03

The May 2026 Reddit/X artifact is useful as adoption evidence: it framed ECC as the stack behind an Anthropic hackathon win and showed a selective install path with plugin marketplace commands and ecc install --profile developer flags. The visual artifact lists 38 agents, 156 skills, 72 commands, and 1,282 security tests; treat those as artifact-era counts, not current source authority. Source: X/@PrajwalTomar_, 2026-05-23

The April Om Patel artifact is earlier adoption evidence for the same repo class. Its reviewed screenshot shows the GitHub README for "Everything Claude Code," language tabs, MIT/security/contributing tabs, badges for 121K stars and 16K forks, package-download badges, and the visible tree for roughly 30 specialized subagents: planner, architect, TDD guide, code/security/build-error reviewers, doc updater, and language-specific reviewers. Keep it as proof that the public appeal was "preconfigured agent harness breadth"; the current affaan-m/ECC repo and npm packages remain the authority for counts and install decisions. Source: X/@om_patel5 and local artifact review, 2026-07-03

Ideas Worth Stealing

1. Strategic Compaction (adopted)

Compact at logical breakpoints instead of waiting for 95% auto-compact, which loses important state at the worst moment.

{ "env": { "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "50" } }

When to compact: After research (before implementation), after a milestone (before next), after debugging (before feature work), after a failed approach (before retrying). When NOT to compact: Mid-implementation - you lose variable names, file paths, partial state.

Kevin's wiki already implements this via session startup checks and state.json. The explicit 50% threshold is worth adopting in Claude Code settings.

2. Continuous Learning v2 - Instinct System

Sessions generate "instincts" - atomic patterns with confidence scores (0.0–1.0) that auto-extract from work sessions. Instincts cluster into skills when enough related patterns accumulate.

Lifecycle: Session → pattern extraction → instinct (pending, 0.3 confidence) → repeated observation → instinct (confirmed, 0.8+) → cluster → skill evolution.

Commands: /instinct-status, /instinct-import, /instinct-export, /evolve (cluster into skills), /prune (delete expired pending instincts after 30d TTL).

Kevin's wiki has the No One-Off Work Rule which covers the codification lifecycle. The instinct system adds automatic pattern extraction - Kevin doesn't have to notice recurring patterns, the system surfaces them. Worth watching but may be overengineered for a single-user wiki workflow.

3. Memory Persistence Hooks

Session lifecycle hooks that auto-save and auto-load context:

• SessionStart → session-start.js loads last session's state, project context, active instincts
• SessionEnd / Stop → session-end.js saves session summary, extracts patterns, updates state
• PreCompact → pre-compact.js saves state before compaction destroys it

Kevin's wiki uses state.json + check-freshness.ts on startup, which is conceptually similar but manually triggered. The hook-based approach is fully automatic.

4. Token Optimization Defaults

Context window management: Each MCP tool description eats tokens from the 200K window. Too many MCPs can shrink usable context to ~70K. Keep under 10 MCPs enabled and under 80 tools active. Use disabledMcpServers per-project to disable unused ones.

5. AgentShield - Security Scanning

NPM package (ecc-agentshield) that scans agent configs for vulnerabilities:

npx ecc-agentshield scan              # Quick scan
npx ecc-agentshield scan --fix        # Auto-fix safe issues
npx ecc-agentshield scan --opus       # Three-agent adversarial pipeline

What it scans: CLAUDE.md, settings.json, MCP configs, hooks, agent definitions, skills. Categories: secrets detection (14 patterns), permission auditing, hook injection, MCP server risk profiling, agent config review.

The --opus flag: Red-team agent finds exploit chains → blue-team evaluates protections → auditor synthesizes into prioritized risk assessment. Adversarial reasoning, not just grep.

Kevin already uses Brin - Agent Context Security for supply chain and Golf - MCP Agent Security for MCP governance. AgentShield adds config-level scanning - complementary, not redundant.

6. Hook Runtime Controls

Runtime flags to tune hook strictness without editing hook files:

export ECC_HOOK_PROFILE=minimal|standard|strict
export ECC_DISABLED_HOOKS="pre:bash:tmux-reminder,post:edit:typecheck"

Useful for temporarily disabling hooks during prototyping without losing the safety net permanently. Kevin's Cursor hooks are currently all-or-nothing.

7. Model Routing

/model-route command routes tasks to models by complexity and budget:

• Simple formatting, renames → haiku (cheapest)
• Standard coding tasks → sonnet (default)
• Deep architecture, debugging, multi-file reasoning → opus (expensive)

Kevin could adopt a similar heuristic in agent config rules.

8. Verification Loops

Two verification strategies:

• Checkpoint verification - save state at milestones, run eval suite, gate progress
• Continuous verification - run build/test/lint/typecheck/security on every change

ECC's /verify command runs a 5-layer check: build → test → lint → typecheck → security. The /quality-gate command runs quality gates for paths or entire repos.

Kevin's wiki has Frontend and Design Skills and the Layer 1–8 tooling stack in AGENTS.md. The explicit verification loop as a single command is a cleaner DX.

9. Subagent Orchestration - Iterative Retrieval

The "context problem" for subagents: they start with zero context and waste tokens rediscovering what the parent already knows. ECC's iterative retrieval pattern:

1. Parent sends focused query with minimal context
2. Subagent searches, returns candidates
3. Parent evaluates, sends refined query
4. Repeat until convergence

This beats dumping the entire context into a subagent prompt.

10. Cross-Harness Config Architecture

The DRY adapter pattern for Cursor hooks is elegant:

Cursor stdin JSON → adapter.js → transforms → scripts/hooks/*.js
                                               (shared with Claude Code)

15 Cursor hook events mapped to 8 Claude Code hook types. One implementation, two runtimes. Kevin's .cursorrules → AGENTS.md redirect already follows this principle for rules.

What Kevin Already Does Better

Installation

Not recommended to install wholesale. Cherry-pick ideas:

# Clone for reference
git clone https://github.com/affaan-m/everything-claude-code.git

# Read the guides (the real value)
# Shorthand: https://x.com/affaanmustafa/status/2012378465664745795
# Longform:  https://x.com/affaanmustafa/status/2014040193557471352
# Security:  ./the-security-guide.md

# AgentShield (standalone, worth running)
npx ecc-agentshield scan

Reputation

• 211K+ GitHub stars, 32K+ forks, and 230+ contributors are advertised in the current README, while GitHub's repo chrome shows the public star count above 220K. Use "200K+" in prose rather than freezing an exact count.
• Anthropic x Forum Ventures hackathon winner (Sep 2025)
• Author: @affaanmustafa (Affaan Mustafa)
• MIT license, 997+ internal tests
• v2.0.0 (Jun 2026) - latest verified release

---

Timeline

• 2026-07-03 | Deep-reviewed the Om Patel ECC artifact and refreshed source state: affaan-m/ECC still v2.0.0, default HEAD 81af40761939056ab3dc54732fd4f562a27309d0, ecc-universal@2.0.0, ecc-agentshield@1.4.0, and GitHub around 225K stars / 34.5K forks. Source: X/@om_patel5, 2026-04-11; GitHub/npm, 2026-07-03
• 2026-07-01 | Deep artifact review updated ECC from the older affaan-m/everything-claude-code path to affaan-m/ECC, recorded v2.0.0 release authority, and preserved the Reddit/X screenshot as historical adoption evidence for 38 agents, 156 skills, 72 commands, and 1,282 security tests. Source: GitHub affaan-m/ECC, 2026-07-01; npm registry, 2026-07-01; X/@PrajwalTomar_, 2026-05-23
• 2026-04-12 | Reviewed repo (v1.10.0). Cataloged 10 ideas worth stealing. Identified strategic compaction, token optimization defaults, AgentShield, and hook runtime controls as highest-value adoptions. Kevin already implements the core philosophy (persistent wiki > ephemeral memory, quality gates, cross-harness configs) but through different mechanisms. Source: Kevin, Cursor session