Find plugins

by Gürkan Süerdem

Evidence-backed recovery, handoff, and bounded repository context for reliable software delivery.

by voitta-ai

Tamarian mode: Claude speaks as the Children of Tama - meaning carried by metaphor and allusion (canon ST:TNG phrases plus ones coined from Earth culture), technical substance fully intact. /tamarian lite|full|ultra|off; hooks persist the level across sessions.

by voitta-ai

Diagnose and unwedge Kubernetes rollouts stuck because an AWS Load Balancer Controller TargetGroupBinding points at a target group no listener rule forwards to. Use when: (1) `helm upgrade` / a Deployment rollout times out with "context deadline exceeded" while every container in the new pods is healthy, (2) new pods show `Ready=False` with reason `ReadinessGatesNotReady` and a readiness gate named `target-health.elbv2.k8s.aws/<name>`, (3) `aws elbv2 describe-target-health` shows every target `unused` / `Target.NotInUse`, (4) a PodDisruptionBudget reports `ALLOWED DISRUPTIONS: 0` and node drains or consolidation (e.g. Karpenter) are blocked by a service that serves no traffic, (5) you staged a target group ahead of its listener rule "so it's ready for the cutover" and want to know why that wedges every future rollout. Core facts: the controller injects a target-health readiness gate into every pod a TargetGroupBinding matches; a target group attached to no load balancer listener keeps its targets permanently `Target.NotInUse`, so the gate can never pass. Unwedge with `kubectl delete targetgroupbinding`; durable fix is gating the binding separately from the target group and attaching the listener rule before the binding.

by voitta-ai

Make Terraform `check` blocks actually fail CI. Use when: (1) you wrote a check block to guard an invariant (e.g. a set of secret values must be pairwise distinct) and discovered `terraform plan` prints the failure as a Warning and exits 0, so the CI plan step stays green, (2) you are reviewing a PR that encodes a safety guard as a check block and need to know whether anything enforces it, (3) you need a guard over sensitive values whose failure message must name the offending items without leaking them. Core facts: check blocks are advisory by design - failed assertions never affect plan/apply exit status, so a guard written as one is silent by construction; the working CI gate is `set -o pipefail` + `tee` the plan output + grep for "Check block assertion failed" and exit 1; write the error_message to name offenders via nonsensitive() applied to KEYS only, never values. Proven end to end: a forced collision exits 1 and names the colliding pair with no values leaked; the passing path leaves plan behavior unchanged.

by voitta-ai

A terraform plan proposes `delete, create` (or "must be replaced") on a resource nothing in your diff touched, and the forcing attribute reads `(known after apply)`. Use when: (1) a plan shows `# forces replacement` on `name`, `bucket`, `identifier` or similar for a resource you did not edit, (2) the value is built from a `data` source such as `data.aws_region.current.id`, `data.aws_caller_identity.current.account_id` or `data.aws_availability_zones`, (3) the module declaring it has a module-level `depends_on`, (4) an apply already happened and a workload now fails with `The security token included in the request is invalid` or `The AWS Access Key Id you provided does not exist in our records` on a policy you can prove is correct. Covers why a module `depends_on` makes every data source inside it unknown at plan time, why that silently escalates to resource replacement, and why a replaced IAM role breaks running pods for up to an hour with errors that misdirect to IAM.

by voitta-ai

Tear down an ECS-on-EC2 capacity-provider stack when a single terraform apply deadlocks with ResourceInUseException: destroy order is the reverse of the dependency graph, so compute tears down before the workload; split into two sequential untargeted applies, workload first, infra second.

by voitta-ai

Apply terraform to production non-interactively when the repo's apply.sh/deploy.sh wrapper calls terraform apply without -auto-approve and hangs on the approval prompt. Covers why `echo yes | ./apply.sh prod` approves an unseen recomputed plan, the plan -out/apply <file> alternative that fails closed on stale state, reproducing a wrapper's auto-detected variables and init flags, and why a saved plan file is a secret.

by voitta-ai

Prove whether a terraform change was actually applied to an environment: census the versioned S3 tfstate objects over time (serial + resource-type counts) and cross-check CloudTrail, to tell a real apply from a reverted one, identify which variant of a stacked change ran, and separate untracked orphans from failed destroys.

by voitta-ai

Verify a pre-commit hook meant to refuse commits, without destroying the hook while testing it: the staged-vs-committed diff trap, safe test sequencing, and reflog recovery.

test-misplaced is an open-source Claude Code plugin indexed from GitHub. Review its manifest and source before installing.

by test

A valid test plugin for fixture tests. Includes 1 skill and 2 MCP servers.

by claude-contrib

tmux notifications for Claude Code — bell, display-message, and auto-focus

by Mantty

Build, run, debug, and design applications with tokamak.

by chock-core

trigger: large command output, broad searches, re-reading unchanged files, front-loading references. avoid: wasting context window on low-signal content.

by chock-core

trigger: large command output, broad searches, re-reading unchanged files, front-loading references. avoid: wasting context window on low-signal content.

by Serkan Korkut

Live token usage and cost dashboard for Claude Code and Codex

by severin-ye

Cross-device workspace sync for coding agents: backup, restore, and ecosystem update via a single CLI.

by voitta-ai

Verify quantitative claims about US federal grants and revenue against government open-data APIs.

by voitta-ai

A vendor console's confirm button silently does nothing and the required consent checkbox clears itself on every submit. Use when: (1) a submit button appears to work but the dialog just stays open, (2) a required checkbox visually ticks and then un-ticks on submit, (3) a click or value-set on a checkbox reports success yet the app behaves as if it is unchecked, (4) you are about to retry the same click a fourth time, (5) you need to know whether the request is even leaving the browser before blaming the UI. Two causes that imitate each other: a framework-controlled input that ignores synthetic clicks and needs a real Space keypress, and a server error the console renders nowhere. Covers telling them apart in one read-only step, reading the swallowed response body, and checking whether an earlier attempt half-succeeded.

by voitta-ai

Retrieve verbatim Truth Social and X posts, including deleted ones, for fact-checking.

by chock-core

Repo-local policy (this repo only, never published): run the fast deterministic catalog checks at commit time -- registry labels, README counts, quoted console output, workflow-trigger safety -- so a mismatch fails in seconds under the committer's hands instead of minutes later in CI. Each of these caught a real error from CI on 2026-08-16. CI remains the authority: it re-runs the same tools on the pinned engine plus everything too slow for a hook (evals, transcripts, the staged adopter). Skips with a warning when python is absent, because the backstop is what makes that honest.

by chock-core

Allowlist gate for new dependencies; no registry lookup is made. Reads Python, Node, Rust, Ruby, PHP, JVM, .NET, Go, Elixir, Dart and Swift manifests (read, never run); blocks an added name missing from .chock/dependency-allowlist.txt and asks on a lockfile-only addition. Not read: computed lists, sources, some pattern-read forms (see docs), versions. Opt-in: seed the allowlist, run in rollout observe, then `chock enable verify-dependency-exists`. Runs: commit, agent write, turn's end.

by chock-core

Allowlist gate for new dependencies; no registry lookup is made. Watches requirements.txt, pyproject.toml ([project] and poetry dependencies), package.json, go.mod; blocks an added name missing from .chock/dependency-allowlist.txt. Not read: -r/-e lines, requirements-dev.txt, poetry groups, [dependency-groups]. Opt-in: fill the allowlist, then `chock enable verify-dependency-exists`. Runs: commit, agent write (vs disk), turn's end (vs HEAD).

by chock-core

Gates MCP servers against .chock/mcp-allowlist.json, empty by default (name, launcher with exact args, or url host). Shell guard refuses `<agent> mcp add` and shell writes of MCP configs or the allowlist unless listed. Script gate (commit, tool use, turn end) reads 13 client configs: a server off the list, or with other command, args or url host, refuses; unpinned or shell launchers, http, literal credentials, old versions only warn. Misses: aliases, scripts, gitignored files, other clients.