claude-ops

mcp
Guvenlik Denetimi
Basarisiz
Health Uyari
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 5 GitHub stars
Code Basarisiz
  • rm -rf — Recursive force deletion command in claude-ops/.claude-plugin/plugin.json
  • execSync — Synchronous shell command execution in claude-ops/bin/ops-slack-autolink.mjs
  • rm -rf — Recursive force deletion command in claude-ops/bin/ops-slack-autolink.mjs
  • process.env — Environment variable access in claude-ops/bin/ops-slack-autolink.mjs
  • network request — Outbound network request in claude-ops/bin/ops-slack-autolink.mjs
Permissions Gecti
  • Permissions — No dangerous permissions requested
Purpose

This MCP server acts as a comprehensive business operating system for Claude Code. It provides a unified dashboard and autonomous agents to manage infrastructure, CI/CD, communications (WhatsApp, Email, Slack, Telegram), revenue, and pull requests directly from the AI interface.

Security Assessment

The overall security risk is High. The tool inherently requires access to highly sensitive data to function, including AWS infrastructure, Stripe revenue, and multiple communication platforms. The codebase contains several critical execution flags. It relies on synchronous shell command execution (`execSync`), which can be a vector for command injection if not handled perfectly. Additionally, the scan caught dangerous recursive force deletion commands (`rm -rf`) within both the plugin configuration and scripts. The tool also makes outbound network requests and heavily relies on environment variables to pass around API keys and credentials. While it claims to have safety hooks against `rm -rf`, the raw presence of these commands alongside active shell execution requires extreme caution. No hardcoded secrets were detected, but the broad system access demanded by the tool is a massive liability if compromised.

Quality Assessment

The project is actively maintained, with its most recent push occurring today. It uses the standard, permissive MIT license, and its repository is clearly documented with detailed descriptions and visual README formatting. However, community trust and visibility are very low. With only 5 GitHub stars, the tool has not been broadly tested or vetted by the open-source community. Because it acts as an autonomy layer capable of merging PRs and modifying infrastructure, the lack of peer review makes it a fragile dependency for production environments.

Verdict

Use with caution — while actively maintained, the combination of dangerous shell execution commands, broad sensitive system access, and almost zero community validation makes this tool too risky for production use without a thorough, manual line-by-line code review.
SUMMARY

Business operating system for Claude Code — 25 skills, 13 agents, smart daemon. Unified inbox (WhatsApp/Email/Slack/Telegram), autonomous PR merge, full-AWS monitoring, revenue (Stripe+RevenueCat), e-commerce (Shopify), marketing (Klaviyo/Meta/GA4), voice (Bland/ElevenLabs), APM (Datadog/NewRelic/OTEL), YOLO mode.

README.md

claude-ops

Business Operating System for Claude Code

Version
License: MIT
Claude Code Plugin
Skills
Agents
Integrations
Auto-fix
Safety
Models

One command. Sixty seconds. Your entire business, at a glance.

╭──────────────────────────────────────────────────────────────────────────────╮
│  /ops:go  ►  MORNING BRIEFING                              2026-04-12  09:03 │
├─────────────────────────────────┬────────────────────────────────────────────┤
│  INFRA    ████████████████  ok  │  ECS: 4/4 healthy  RDS: ok  Redis: ok     │
│  CI/CD    ████████████░░░░  75% │  3 passing  1 failing  (my-api #847)  │
│  INBOX    ░░░░░░░░░░░░░░░░  14  │  Slack: 9  Telegram: 3  Gmail: 2 unread   │
│  PRs      ████████████████  3   │  3 ready to merge  1 needs review          │
│  SPRINT   ████████████░░░░  67% │  Sprint 24  —  8 of 12 issues complete     │
│  REVENUE  ████████████████  $   │  $2,847 MTD  ↑12% vs last month           │
├─────────────────────────────────┴────────────────────────────────────────────┤
│  Next action: merge feat/user-profile  ·  fix my-api CI  ·  reply @alice    │
╰──────────────────────────────────────────────────────────────────────────────╯

Turn Claude Code into a complete business operating system — infrastructure health, CI/CD status, unified inbox, open PRs, sprint state, revenue snapshot (Stripe + RevenueCat + AWS), and autonomous C-suite agents that act on your behalf.


What's new in v2.0

v2 turns claude-ops from a briefing + comms surface into an autonomy layer for Claude Code itself. Purely additive — no v1 behaviour changes by default. See claude-ops/CHANGELOG.md and docs/migrating-from-v1.md.

Capability Skill Doc
Post-merge + build-failure auto-fix (PostToolUse hooks → headless Haiku fixer) /ops:deploy-fix deploy-fix.md
Pre-installed specialist agents + silent general-purpose → specialist routing (transparent) agents.md
Universal safety hooks: secret-scan, rm -rf anchor block, main push warn (always-on) safety-hooks.md
Recap marquee — multi-session digest in tmux status-right / statusLine /ops:recap recap.md
Multi-account Claude Max rotator with launchd daemon + AI-brain /ops:rotate, /ops:rotate-setup CHANGELOG
Periodic Task* tracking nudge (PostToolUse hook) CHANGELOG

Quick start for the auto-fix subsystem

# 1. Upgrade
/plugin update ops@lifecycle-innovations-limited-claude-ops

# 2. Run the wizard (hits new steps 6.5a–6.5d for v2 toggles)
/ops:setup

# 3. Map your repos to their deploy URLs
/ops:deploy-fix configure
# (opens ~/.claude/config/post-merge-services.json)

# 4. From now on, every `gh pr merge` you run from Claude Code will:
#    - poll the deploy workflow
#    - curl /health on success
#    - verify /version returns the merged SHA
#    - on failure: auto-rerun transients, OR dispatch a Haiku deploy-fixer
/ops:deploy-fix          # see status / budget / live runs

Per-repo budget caps (default 3/hour), single-flight locks, and content-hash dedup prevent runaway spending. Notifications route via macos/ntfy/pushover/discord/telegram/none. Every toggle is spacebar-toggleable in /plugins settings.


Quick Start

# 1. Add the marketplace
/plugin marketplace add Lifecycle-Innovations-Limited/claude-ops

# 2. Install the plugin
/plugin install ops@lifecycle-innovations-limited-claude-ops

# 3. Run the guided setup wizard
/ops:setup

[!TIP]
The wizard installs the background daemon EARLY (Step 2c). While you're still answering "connect Slack? [OAuth/Skip]" questions, briefing-pre-warm is already running every 2 minutes — pre-fetching ECS health, git state, PRs, CI, and unread counts. By the time setup finishes, your first /ops:go briefing loads in <3 seconds from warm cache instead of ~30s cold.

Local development:

git clone https://github.com/Lifecycle-Innovations-Limited/claude-ops.git
claude --plugin-dir ./claude-ops/claude-ops

Commands

All 30 skills, grouped by category:

🧭 Navigation 📊 Daily Ops
/ops — pixel-art dashboard /ops:go — morning briefing
/ops:dash — same + hotkeys /ops:next — priority next action
/ops:setup — guided wizard /ops:inbox — deep-context inbox zero
/ops:uninstall — clean removal /ops:comms — send/read any channel
/ops:merge — autonomous PR pipeline
🛠️ Project & Eng 💰 Business
/ops:projectsportfolio dashboard /ops:revenueStripe + RevenueCat + AWS
/ops:linear — sprint board /ops:ecom — Shopify operations
/ops:triage — cross-platform issues /ops:marketing — Klaviyo/Meta/GA4/GSC
/ops:fires — incidents + all AWS /ops:gtmcross-channel GTM planner
/ops:deploy — ECS/Vercel/Actions /ops:voice — Bland AI/ElevenLabs/Whisper
/ops:monitor — Datadog/New Relic/OTEL /ops:package — carrier-agnostic shipping
🤖 Automation 🧰 Maintenance
/ops:orchestrate — parallel engine /ops:speedupGPU/ANE + power hogs + OS actions
/ops:yolo — 4 parallel C-suite agents /ops:doctor — plugin auto-repair
/ops:integrate — add external service /ops:daemon — launchd background brain
/ops:whatsapp-biz — catalog/orders /ops:status — plugin + daemon health

Skill routing

flowchart TD
    U["User"] --> O["/ops"]
    O --> D["Dashboard"]
    D --> Daily["Daily Ops"]
    D --> Eng["Project & Eng"]
    D --> Biz["Business"]
    D --> Auto["Automation"]
    Daily --> go["/ops:go"]
    Daily --> inbox["/ops:inbox"]
    Daily --> merge["/ops:merge"]
    Eng --> projects["/ops:projects"]
    Eng --> linear["/ops:linear"]
    Eng --> fires["/ops:fires"]
    Biz --> revenue["/ops:revenue"]
    Biz --> ecom["/ops:ecom"]
    Biz --> marketing["/ops:marketing"]
    Auto --> yolo["/ops:yolo"]
    Auto --> orchestrate["/ops:orchestrate"]

Before / After

┌────────────────────────────────────────────┬──────────────────────────────────────────────┐
│  WITHOUT claude-ops                        │  WITH claude-ops                             │
├────────────────────────────────────────────┼──────────────────────────────────────────────┤
│  Open 6+ tabs every morning                │  /ops:go  ——  one command, done              │
│  Context-switch between Slack/Telegram/    │  /ops:inbox  ——  unified view, all channels  │
│  email                                     │                                              │
│  Manually review and merge PRs one by one  │  /ops:merge  ——  autonomous pipeline         │
│  SSH into servers to check health          │  /ops:fires  ——  terminal dashboard          │
│  Forget to track AWS spend                 │  /ops:revenue  ——  automatic cost snapshot   │
│  Switch between Linear and GitHub          │  /ops:linear + /ops:projects  ——  unified    │
└────────────────────────────────────────────┴──────────────────────────────────────────────┘

Integrations (22 services)

Most integrations offer two paths — MCP (zero-config OAuth) or CLI (fuller feature set). The setup wizard lets you choose per-integration.

SERVICE MCP CLI WHAT YOU LOSE WITHOUT CLI
GitHub gh (auto) EVERYTHING — CI logs, PR merge, triage all require gh
AWS aws (auto) EVERYTHING — 17+ services probed by infra-monitor
Stripe API key Required for /ops:revenue MRR — web + desktop subs
RevenueCat API key + project ID Required for mobile-app subscription MRR
Linear OAuth via Claude.ai (12 tools) Nothing — fully covered
Vercel OAuth via Claude.ai Nothing — deploy status, build + runtime logs
Slack OAuth via Claude.ai local bot token MCP covers most. Token adds: unlimited search, private ch
Gmail OAuth (read) gog (send+archive) MCP = read-only. CLI = full autonomous inbox
Calendar OAuth via Claude.ai gog (read-only) MCP has more features — either works
Sentry OAuth via Claude.ai sentry-cli MCP covers triage. CLI adds source maps + releases
WhatsApp wacli EVERYTHING — no MCP exists
Telegram bundled MCP server EVERYTHING — plugin ships its own MTProto server
Shopify Admin API + template Store ops, order mgmt, inventory via /ops:ecom
Klaviyo API key Email/SMS campaigns via /ops:marketing
Meta Ads API token Paid-social reporting via /ops:marketing
GA4 service account Analytics via /ops:marketing
GSC service account Search Console via /ops:marketing
Bland AI API key Outbound voice via /ops:voice
ElevenLabs API key TTS + cloning via /ops:voice
Whisper API key Transcription via /ops:voice
GSD auto-detected Optional — roadmap state; degrades gracefully
Doppler @dopplerhq/mcp-server (MCP) doppler CLI (fallback) Secrets manager; MCP server provides direct tool access

[!NOTE]
infra-monitor now covers every AWS service you have IAM for — ECS, EC2, RDS, Lambda, S3, CloudFront, ALB/NLB, API Gateway, SQS, SNS, DynamoDB, ElastiCache, Route 53, ACM, CloudWatch, Budgets, IAM. Probes run in parallel; services you can't access are silently skipped.


Architecture

flowchart TB
    CC[Claude Code] --> S[Skills · 22]
    CC --> A[Agents · 12]
    CC --> H[Hooks]
    S & A & H --> RC[Runtime Context]
    RC --> P[preferences.json]
    RC --> M[memories/]
    RC --> SEC[Doppler · PW Mgr · Keychain · env]
    CC <--> D[ops-daemon<br/>launchd · 7 services]

All skills use pre-execution shell blocks (! fences) that gather data before model context loads — zero extra latency, minimal token overhead. The ops-daemon pre-warms briefing data so /ops:go hits warm cache.

Why the nested claude-ops/claude-ops/ directory? Claude Code's plugin marketplace system requires a two-level layout: the repo root acts as a marketplace container (with .claude-plugin/marketplace.json pointing "source": "./claude-ops"), while the inner directory is the actual plugin root (with .claude-plugin/plugin.json, skills, agents, etc.). This is how Claude Code resolves and caches plugins — it cannot be flattened.

claude-ops/                        ← marketplace root (this repo, this README)
├── .claude-plugin/
│   └── marketplace.json           # points to ./claude-ops as plugin source
├── README.md                      # ← you are here
│
└── claude-ops/                    ← plugin root (Claude Code loads from here)
    ├── .claude-plugin/plugin.json
    ├── CLAUDE.md                  # 5 non-negotiable plugin rules
    ├── skills/                    # 22 slash commands
    ├── agents/                    # 12 autonomous agents (Opus/Sonnet/Haiku)
    ├── bin/                       # ops-gather · ops-shopify-create · gog fallback
    ├── hooks/                     # SessionStart health check
    ├── telegram-server/           # bundled MCP server (gram.js)
    ├── templates/                 # Shopify Admin + app scaffolding
    ├── tests/                     # bash validation · test-no-secrets.sh
    └── .mcp.json                  # MCP server declarations

Agent Teams

Every ops skill that spawns agents supports Claude Code Agent Teams — a coordination layer where agents share context, report progress, and accept mid-flight steering.

Enable: Set CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 in your environment.

How it works: When the flag is set, skills create a named team and dispatch agents into it. Agents within a team can share findings (e.g., an inbox agent discovers a Slack message referencing an email thread, so the email agent prioritizes it) and you can steer priorities via SendMessage.

TeamCreate("fire-fixers")
Agent(team_name="fire-fixers", name="fix-ecs", ...)
Agent(team_name="fire-fixers", name="fix-ci", ...)
SendMessage(to="fix-ecs", content="This is P0, prioritize over CI")

Without the flag: Skills fall back to standard fire-and-forget subagents — still parallel, but no coordination or steering.

Skill Team name Agents
/ops:go go-team infra-scanner, inbox-scanner, pr-scanner, sprint-scanner
/ops:inbox inbox-channels whatsapp-scanner, email-scanner, slack-scanner, telegram-scanner
/ops:merge merge-fixers fixer-[repo] per failing PR
/ops:fires fire-fixers fix-[service] per active incident
/ops:triage triage-fixers fix-[issue-id] per active issue
/ops:yolo yolo-csuite ceo, cto, cfo, coo
/ops:orchestrate orchestrate-team per-project agents (hybrid auto-select)
/ops:monitor monitor-probes datadog-probe, newrelic-probe, otel-probe
/ops:doctor doctor-fixers fix-manifest, fix-permissions, fix-registry
/ops:marketing marketing-team email-metrics, ads-metrics, analytics-metrics, seo-metrics
/ops:ecom ecom-team orders-scanner, inventory-scanner, fulfillment-scanner
/ops:deploy deploy-team ecs-checker, vercel-checker, ci-checker
/ops:projects projects-team project-[alias] per registered project
/ops:dash dash-team infra-loader, comms-loader, projects-loader, business-loader
/ops:next next-team fires-checker, comms-checker, prs-checker, sprint-checker
setup setup-hunters hunt-[service] per credential deep hunt

Compliance enforced by CI: tests/test-agent-teams.sh audits every skill for Agent Teams support — any skill with Agent in its allowed-tools must have TeamCreate/SendMessage, a documentation section, the feature flag check, and a fallback path.


Privacy & Security

[!IMPORTANT]
Transparency matters. claude-ops reads from your AWS, GitHub, Linear, Sentry, WhatsApp, Email, Slack, Telegram, Shopify, Stripe, RevenueCat, and more. You should know exactly what it touches.

Credential resolution chain (in order): Doppler MCP → Doppler CLI → 1Password/Dashlane/Bitwarden → macOS Keychain → env vars → Claude Code's encrypted userConfig (~/.claude.json).

Setup auto-scan sources (only during /ops:setup): env, shell profiles, Doppler, 1Password, Dashlane, Bitwarden, macOS Keychain, Claude Code's ~/.claude.json, Chrome history URL list (never page content), Slack Playwright profile (only if chosen).

The plugin does NOT:

  • Phone home. No telemetry. No analytics. No crash reports.
  • Upload data to any third party you haven't configured.
  • Access clipboard, camera, microphone, or SSH keys.
  • Perform disk-wide scans — every scan is a targeted path.

Background daemon services (only those you enable):

  • briefing-pre-warm every 2 min — parallel ops-gather for ECS/git/PRs/CI/unread. Local only.
  • wacli-sync continuous — WhatsApp Web protocol, same as standalone wacli.
  • memory-extractor every 30 min — Haiku summarizes local chats to memories/.
  • inbox-digest every 4h — aggregates for your configured Telegram bot (if any).
  • store-health daily 9am — Shopify Admin API, read-only.
  • competitor-intel weekly — your configured competitor feeds.
  • message-listener continuous — local polling, never sends outbound on its own.

Security measures: umask 077 on preferences.json · credentials in Claude Code's encrypted userConfig · registry/preferences gitignored · tests/test-no-secrets.sh pre-commit · Rule 5 blocks destructive actions without confirmation · append-only shell profile writes.

Your rights: /ops:uninstall removes everything · memory files are plain markdown · MIT licensed, source is public and auditable.

See the Privacy & Security wiki page for the full scan inventory and threat model.


Requirements

Just Claude Code 1.0+. Everything else is installed automatically by /ops:setup via Homebrew (macOS), apt (Linux), or winget (Windows). /ops:speedup auto-detects macOS / Linux / WSL / Windows and applies host-appropriate tuning (no manual flags needed).


What's New in v1.7.0

  • /gtm — cross-channel go-to-market planner (NEW skill). Strategy layer on top of /ops:marketing that generates plans across paid, unpaid, sales, and AI-automation avenues and hands launchable items to /marketing via the Skill tool.
  • /ops:projects portfolio dashboard — every project in the GSD registry with active phase, task count, dirty-file count, and open-PR status. Backed by the gsd-registry-sync daemon service.
  • ops-speedup v2 parity--gpu (Neural Engine + GPU util via powermetrics), --power (energy hogs from top -o pmem), --os-actions (cross-platform kernel_task / WindowServer restarts + launchd/systemd masking behind an allowlist). Hardened against 9 review findings including a SEV-9 eval shell-injection and a SEV-8 RETURN-trap race.
  • ops-memory-extractor Claude Code OAuth support — prefers the OAuth token stored in the macOS Keychain (Claude Code-credentials) so memory extraction is billed against the Claude Max subscription instead of the API credit. Falls back to ANTHROPIC_API_KEY. The OAuth token is never exported to the shell.
  • Persistent WhatsApp --followwacli-keepalive.sh no longer tears down the follower within 5-20 min of start. INITIAL_BACKFILL_DELAY=30 lets the follower stabilize before the first --once sweep, and a reentrant guard prevents overlapping sweeps.
  • MCP auto-reconnectPreToolUse hook kills and respawns any disconnected MCP server without user prompting.
  • 30 skills, 14 agents — up from 21/12 in v0.6.0. Full list in claude-ops/README.md.
  • Models: C-suite on Opus 4.6, scanners/monitors/fix agents on Sonnet 4.6, memory extractor on Haiku 4.5.

Contributing

PRs welcome — see CONTRIBUTING.md for the full guide, branch rules, and PR workflow.

Branch strategy: main is the only long-lived branch. All work goes through feature branches → PR to main. Branch protection is enforced at repo and org level — no direct pushes, no force pushes, no branch deletion.

# Development mode — load plugin from local directory
claude --plugin-dir ./claude-ops/claude-ops

# Reload after changes
/reload-plugins

See claude-ops/README.md for detailed documentation on each skill, agent, and integration. Full guides, troubleshooting, and the threat model live on the wiki.


License

MIT — built by Lifecycle Innovations Limited.

v1.7.0 · MIT · github.com/Lifecycle-Innovations-Limited

Yorumlar (0)

Sonuc bulunamadi