security-assessment

Agentic Dev Team

📖 Documentation

Three Claude Code plugins for engineering workflows. Install one or all.

• dev-team gives Claude Code a full persona-driven development team: an Orchestrator that routes tasks, specialist agents (engineer, QA, architect, reviewers…), skills that encode reusable knowledge, and the four-command feature workflow /specs → /plan → /build → /pr.
• security-assessment is the security companion. It adds a tool-first /security-assessment pipeline (SAST + AI judgment + false-positive filtering + executive report), a /cross-repo-analysis command for multi-repo attack chains, and an adversarial ML red-team harness (/redteam-model) for self-owned model endpoints.
• marketplace-dev is the plugin-author's toolkit. It scaffolds new plugins and marketplaces (/scaffold-plugin, /scaffold-marketplace, /init-plugin-eval), audits any plugin for structural compliance (/plugin-audit), advises on the markdown-vs-script agent decision (/agent-type-advisor), and ships the migrated agent/skill authoring toolkit (/agent-create, /agent-add, /agent-remove).

dev-team is the foundation: it owns the shared data contract (codebase-recon, ACCEPTED-RISKS.md, unified finding format) that security-assessment builds on, so install dev-team first and add security-assessment when you need it. marketplace-dev is independent — it has no hard dependency on dev-team and can be installed on its own to build or maintain plugins.

Plugins

Plugin	What it does	Key commands	Required tools	Optional tools
dev-team	Persona-driven development team, reviewer swarm, TDD-gated build loop	/specs, /plan, /build, /pr, /code-review, /triage	jq, gh	semgrep, playwright, hadolint/trivy/grype; auto-detected formatters and test/type/lint runners
security-assessment	Tool-first security assessment + red-team pipeline	/security-assessment, /cross-repo-analysis, /redteam-model, /export-pdf	dev-team, Python ≥ 3.10, tier-1 SAST (semgrep, gitleaks, trivy, hadolint, actionlint)	grype, PDF-export deps
marketplace-dev	Scaffold, audit, and maintain Claude Code plugins and marketplaces	/scaffold-plugin, /scaffold-marketplace, /plugin-audit, /agent-type-advisor, /agent-create	jq	git

Plugin names link to each plugin's README, where the full tool list and per-tool install commands live. Claude Code itself is assumed. First time here? Start with dev-team; add security-assessment only when you run full /security-assessment pipelines against target repos, and marketplace-dev when you're building or maintaining plugins.

Getting Started

New here? The Getting Started guide is the full walkthrough — installing each plugin, configuring a project, the day-to-day workflow, and the diagnostic commands.

Quick install of the core plugin:

claude plugin marketplace add bdfinst/agentic-dev-team
claude plugin install dev-team@bfinster

Then run /setup in your project. Optional plugins (security-assessment, marketplace-dev), self-hosted git hosts, install scopes, and the /upgrade flow are all covered in the Getting Started guide.

Dev team workflow

Four commands drive feature development from idea to pull request:

/specs  →  /plan  →  /build  →  /pr