AI agent set for cloud security purple teaming, runs inside Claude Code, Gemini CLI, and Codex.
Agent Claude Code
SCOPE audit orchestrator — single entry point for the full audit pipeline. Runs Python SCOPE runtime enumeration, chains attack-path reasoning, verification, defensive controls, post-processing, and dashboard generation. Invoke with /scope:audit .
Agent Claude Code
Controls orchestrator — dispatches six subagents in two waves (org-wide issues, detections, dashboard ideas, policy, remediation in parallel; then validate), assembles results.json. Dispatched by audit orchestrator or invoked via /scope:controls [run-dir].
Agent Claude Code
Red team operator — context-driven permission discovery, escalation path identification with real-world research, and narrative-first attack playbooks. Standalone by default, optionally leverages audit data via --audit flag. Invoke with /scope:exploit [--audit ].
Agent Claude Code needs its repo
SOC alert investigation assistant. Guides analysts through CloudTrail-based alert investigation in Splunk — step-by-step guided queries, investigation timelines, and IOC correlation. Invoke with /scope:investigate.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: