Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add MCKRUZ/claude-code-sdlc/plugin install claude-code-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mckruz/claude-code-sdlc/sdlc-doctor)<a href="https://agentmods.dev/commands/mckruz/claude-code-sdlc/sdlc-doctor"><img src="https://agentmods.dev/badge/commands/mckruz/claude-code-sdlc/sdlc-doctor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00911 |
| Opus 5 | $0.00000 | $0.00456 |
| Sonnet 5 | $0.00000 | $0.00182 |
| Haiku 4.5 | $0.00000 | $0.00091 |
Grade A, and why
sdlc-doctor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sdlc-doctor — Day-1 Environment Check
Verify that the installed harness will actually run in this repo, and tell the developer exactly what to do about anything that won't.
The harness fails quietly. A hook registered with a missing interpreter, a rails script installed without its executable bit, a secret the gates read that nobody set — each leaves a repo that looks configured and has no working checking ladder. This command finds the failures that are invisible when they happen.
Run it after /sdlc-setup, when onboarding a second developer, and any time a gate behaves in a way nobody can explain.
Instructions
-
Run the check from the repo root:
uv run --project ${CLAUDE_PLUGIN_ROOT}/scripts ${CLAUDE_PLUGIN_ROOT}/scripts/doctor.pyAdd
--offlineto skip the checks that need the platform CLI —ghon GitHub installs (repo secrets, branch protection),azon Azure DevOps installs (variable groups, branch policies). Add--repo <path>to check a repo other than the current directory. -
Report the results verbatim. Each line is already
PASS/FAIL/WARNwith the fix attached. Do not summarise away the fix lines — they are the actionable part. -
Explain what each failure means, in plain terms, before offering to act. What matters is the consequence, not the check name:
- missing
pwsh— the hooks are registered but can never run, so an agent can finish a turn on a red build and nothing objects - script not executable — the gate shells out and gets
Permission denied; because the gates fail closed, this reads as a blocked merge with a confusing reason - missing secret (GitHub) / missing variable group (ADO) — the named workflows/pipelines fail closed on every PR
- no active ruleset (GitHub) / no branch policies (ADO) — the gates run and report, but a red PR can still merge
- missing
-
Offer to fix what is safely fixable.
chmod +xon the installed scripts is safe and mechanical — offer it. Providing a credential is not: it needs a real value from the human, so give them the platform-appropriate fix and let them run it — on GitHub the exactgh secret setcommand; on Azure DevOps the variable group to create and link (Key-Vault-backed, viaaz pipelines variable-group). Never invent a secret value.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 47 lines · 0 tokens per session scan A db1033fa51d3
sdlc-doctor is a command published in the GitHub repository MCKRUZ/claude-code-sdlc (4 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 911 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
monitor-ci
You are the orchestrator for monitoring Nx Cloud CI pipeline executions and handling self-healing fixes. You spawn the ci-monitor-subagent subagent to poll CI status and make decisions based on the results.
actions
Command "actions" from openclaw/crabbox, covering actions, subcommands, hydrate, register and dispatch.
dart-fix-ci
Command "dart-fix-ci" from dartsim/dart, covering required reading, workflow and output.
domains
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
access
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
check-release-health
Summarize the CI health of an OpenShift release using live data from the openshift-ci-mcp server.