v1.9.0
v1.9.0 — Selective Install, ECC Tools Pro, 12 Language Ecosystems
Added
- ECC Tools Pro tier with Stripe billing at $19/seat/month for private repo analysis with 50 analyses/month
- Selective install with --with and --without flags to install only specific agent and skill component families
- Nine new agents: typescript-reviewer, pytorch-build-resolver, java-build-resolver, java-reviewer, rust-reviewer, flutter-reviewer, harness-optimizer, kotlin-build-resolver, and kotlin-reviewer
- Fifteen new skills including pytorch-patterns, nuxt4-patterns, codebase-onboarding, architecture-decision-records, agent-eval, documentation-lookup, bun-runtime, and nextjs-turbopack
- Six new language rule packs for C#, Rust, Java, C++, Perl, and Flutter/Dart
- Agent description compression with lazy loading
- Skill inspection logic for recurring failure pattern detection
- Governance event capture hooks
- MCP health-check hook with auto-reconnect
- SQLite state store for session, skill, and decision tracking
- Session adapters for canonical snapshots
- AgentShield v1.4.0 with CVE database containing 25+ known MCP vulnerabilities
- MCP tool description poisoning detection with 5 new rules in AgentShield
- Continuous scanning with --watch mode in AgentShield
- Runtime monitoring daemon for tool calls in AgentShield
- Supply chain verification for MCP npm packages in AgentShield
- PR security gate with baseline comparison in AgentShield
- Organization-wide security policy enforcement in AgentShield
- CLAUDE.md filesystem permission check in AgentShield
- GitHub OAuth checkout flow for ECC Tools App
- Auto-analysis skip list for managed repos in ECC Tools App
Changed
- Codex sync now merges AGENTS.md instead of replacing it
- ECC Tools App push cooldown increased to 7 days
- Free tier remains at 10 analyses/month for public repos
- ECC Tools App now includes duplicate PR prevention with idempotency
Fixed
- AgentShield false positive issue where deny rules and block hooks were flagged as threats
- Windows CI with all 38 matrix jobs now passing
- SessionStart ANSI escape code sanitization
- Observer memory explosion with throttling
- Catalog count validation
- Plugin root auto-detection fallback
- Analyzer quality improvements with 7 greptile findings fixed in ECC Tools App
Highlights
ECC Tools Pro is live. The GitHub App now has Stripe billing with a Pro tier ($19/seat/month) for private repo analysis, 50 analyses/month, and AgentShield-backed scanning. Free tier remains at 10 analyses/month for public repos. Install at github.com/apps/ecc-tools, upgrade at ecc.tools/pricing.
Selective install is here. Install only what you need with --with and --without flags. ecc install --profile developer --with lang:typescript --with agent:security-reviewer --without skill:continuous-learning. Agent and skill component families are now in the install manifest.
12 language ecosystems. C#, Rust, Java, Kotlin, C++, Go, Python, TypeScript, Perl, PyTorch, Nuxt 4, and Flutter now have dedicated rules, agents, or skills.
AgentShield v1.4.0 ships alongside. False positive scanning fixed. CVE database with 25+ known MCP vulnerabilities. Supply chain verification. Runtime monitoring. Watch mode. PR security gate. Org-wide policy enforcement.
https://github.com/user-attachments/assets/eece2c76-7eb9-4865-a58b-f11247fd774e
What's New
Agents (28 total, +9 new)
typescript-reviewer— TypeScript/JavaScript code reviewpytorch-build-resolver— PyTorch build error resolutionjava-build-resolver— Maven/Gradle build resolutionjava-reviewer— Java code reviewrust-reviewer— Rust code reviewflutter-reviewer— Flutter/Dart code reviewharness-optimizer— Cross-harness optimizationkotlin-build-resolver— Kotlin build resolutionkotlin-reviewer— Kotlin code review
Skills (116 total, +15 new)
pytorch-patterns— PyTorch best practicesnuxt4-patterns— Nuxt 4 frontend patternscodebase-onboarding— Onboarding new contributorsarchitecture-decision-records— ADR workflowagent-eval— Head-to-head coding agent comparisondocumentation-lookup— Doc retrieval patternsbun-runtime— Bun runtime patternsnextjs-turbopack— Next.js Turbopack patterns- Plus 7 more language-specific skills
Rules (6 new language packs)
- C# (coding-style, patterns, security, testing, hooks)
- Rust, Java, C++, Perl language rules
- Flutter/Dart rules
Infrastructure
- Selective install with
--with/--withoutCLI flags - Agent description compression with lazy loading
- Skill inspection logic for recurring failure pattern detection
- Governance event capture hooks
- MCP health-check hook with auto-reconnect
- SQLite state store for session/skill/decision tracking
- Session adapters for canonical snapshots
- Codex sync merges AGENTS.md instead of replacing
Bug Fixes
- Windows CI fully green (all 38 matrix jobs passing)
- SessionStart ANSI escape code sanitization
- Observer memory explosion with throttling
- Flaky observer bash test on Windows skipped
- Catalog count validation fixed
- Plugin root auto-detection fallback
ECC Tools App
- Stripe billing live (Pro $19/seat, Enterprise contact)
- GitHub OAuth checkout flow
- Analyzer quality improvements (7 greptile findings fixed)
- Duplicate PR prevention with idempotency
- Auto-analysis skip list for managed repos
- Push cooldown increased to 7 days
AgentShield (v1.4.0)
- False positive fix: deny rules and block hooks no longer flagged as threats
- CVE database with 25+ known MCP vulnerabilities
- MCP tool description poisoning detection (5 new rules)
- Continuous scanning with config drift detection (--watch mode)
- Runtime monitoring daemon for tool calls
- Supply chain verification for MCP npm packages
- PR security gate with baseline comparison
- Organization-wide security policy enforcement
- CLAUDE.md filesystem permission check
- 1,609 tests passing
Stats
- 219 commits since v1.8.0
- 30+ contributors
- 88K+ GitHub stars
- 1,540+ tests passing across all platforms
Install / Upgrade
npx claudepluginhub affaan-m/everything-claude-code --plugin everything-claude-code
Or install manually in Claude Code.