agentmods.dev

grc

A collection of governance, risk, and compliance guidance for security frameworks, controls, audits, evidence, continuous monitoring, and operational workflows. GRC means organizing how an organization manages rules, risks, and proof of compliance.

In plain words
What is it for?
Use it to look up controls, map requirements between frameworks, prepare audit evidence, review documents, and manage ongoing compliance activities.
Why use it?
It gives coding agents shared context for compliance work instead of requiring each task to start with a basic explanation of the relevant framework.

Plugin for Claude Code

180 29d ago A scan tokens not measured original MIT
View the source file mlunato47/claude-grc-plugin
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Claude Code
/plugin marketplace add mlunato47/claude-grc-plugin
agentmods
npx agentmods add plugins/mlunato47/claude-grc-plugin/grc
Clone the repo
git clone --depth 1 https://github.com/mlunato47/claude-grc-plugin

Made for: Claude Code.

Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

grc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

grc/.claude-plugin/plugin.json · 34 lines

What it actually says

{
  "name": "grc",
  "description": "GRC (Governance, Risk, and Compliance) domain knowledge — frameworks, controls, audits, evidence, ConMon, cross-framework mappings, document review, and operational workflows. Cloud-agnostic.",
  "version": "1.3.0",
  "author": {
    "name": "Mario Lunato",
    "url": "https://github.com/mlunato47"
  },
  "repository": "https://github.com/mlunato47/claude-grc-plugin",
  "license": "MIT",
  "keywords": [
    "grc",
    "compliance",
    "governance",
    "risk-management",
    "nist",
    "fedramp",
    "fedramp-20x",
    "ksi",
    "dod",
    "disa",
    "impact-levels",
    "itar",
    "export-control",
    "soc2",
    "iso27001",
    "pci-dss",
    "hipaa",
    "cmmc",
    "audit",
    "security"
  ]
}
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 34 lines scan A 6db7d9acaf0d

Subscribe to this mod's changes

grc is a plugin published in the GitHub repository mlunato47/claude-grc-plugin (180 stars, last pushed 29d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Legal and complianceSecurity
Related

Other plugins, from other repositories

corporate-legal

Runs M&A diligence at scale with cited tabular review, builds disclosure schedules and closing checklists, drafts board consents and minutes in house format, and tracks entity compliance deadlines across jurisdictions.

anthropics/claude-for-legal · not measured

agb-recht-pruefer

Gigantischer AGB-Rechtsprüfer und Klausel-Entwerfer für deutsches Recht: §§ 305 bis 310 BGB, UKlaG, B2C/B2B, Branchen-AGB, Redlining, Klauselrisiko und rechtssichere Entwurfsworkflows.

Klotzkette/claude-fuer-deutsches-recht · not measured

csrd

EU CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor — scope & threshold analysis (large PIEs, other large, listed SMEs, non-EU), double materiality assessment (DMA), ESRS gap assessment, ESRS E1–E5 environmental disclosures, ESRS S1–S4 social disclosures, ESRS G1 governance, Scope…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · not measured

eu-cra

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847. Covers product classification (Default/Class I/Class II), Annex I essential requirements gap analysis, conformity assessment (self-assessment vs Notified Body), CE marking, SBOM, vulnerability handling, 24/72-hour ENISA reporting, support…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · not measured

dora

DORA (Regulation (EU) 2022/2554) compliance advisor for EU financial entities — ICT risk management framework, incident classification and reporting, TLPT, ICT third-party risk, Register of Information, and all adopted RTS/ITS with article-level citations.

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · not measured

dpdpa

India's Digital Personal Data Protection Act, 2023 (DPDPA) and DPDP Rules, 2025 compliance advisor — gap analysis, notice and consent requirements, Data Principal rights, breach notification, children's data, Significant Data Fiduciary obligations, cross-border transfers, Data Protection Board proceedings, and GDPR…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · not measured