Agent Plugins Marketplace
← All plugins

bymax-qa

v1.0.2

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (it verifies Jira access, reads the acceptance criteria, and reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (it scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain) with read-only finder agents, probes the running stack against the allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Every finding carries ASVS 5.0, CWE and API Top 10 references, a CVSS vector, and a status that moves OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. Fixes are never applied by the auditor: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit is active: a network tool in command position may only reach allow-listed hosts, and a Write/Edit tool call may only land in .claude/qa/ (arbitrary Bash writes and unlisted network binaries rest on the skill's never-edit-the-target discipline and its read-only finders). External scanners (semgrep, gitleaks, osv-scanner, trivy, zap, nuclei, axe, Lighthouse) are used when present and never bundled.

Claude Code

By Bymax OneLicense: MIT0 GitHub starsUpdated yesterday

Directory evidence

Runtimes
Claude Code
Parsed components
0 skill or MCP entries
Source updated
Sep 22, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install bymax-qa for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install bymax-qa@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/bymaxone/bymax-agent-kit

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/bymax-qa/.

Plugin files

plugins/bymax-qa/
└── .claude-plugin/plugin.json

Plugin manifests1

plugins/bymax-qa/.claude-plugin/plugin.json
{
  "name": "bymax-qa",
  "description": "Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (it verifies Jira access, reads the acceptance criteria, and reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (it scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain) with read-only finder agents, probes the running stack against the allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Every finding carries ASVS 5.0, CWE and API Top 10 references, a CVSS vector, and a status that moves OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. Fixes are never applied by the auditor: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit is active: a network tool in command position may only reach allow-listed hosts, and a Write/Edit tool call may only land in .claude/qa/ (arbitrary Bash writes and unlisted network binaries rest on the skill's never-edit-the-target discipline and its read-only finders). External scanners (semgrep, gitleaks, osv-scanner, trivy, zap, nuclei, axe, Lighthouse) are used when present and never bundled.",
  "version": "1.0.2",
  "author": {
    "name": "Bymax One",
    "email": "[email protected]",
    "url": "https://github.com/bymaxone"
  },
  "license": "MIT",
  "homepage": "https://github.com/bymaxone/bymax-agent-kit/tree/main/plugins/bymax-qa",
  "keywords": [
    "qa",
    "security",
    "audit",
    "pentest",
    "asvs",
    "owasp",
    "api-security",
    "multi-tenant",
    "evidence",
    "peer-agents",
    "github-issues"
  ]
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[bymax-qa on Agent Plugins Marketplace](https://pluginsmp.com/plugins/bymax-qa)