security

Claude Power Pack

v7.3.0 - A productivity toolkit for Claude Code that adds workflow automation, MCP servers, security scanning, secrets management, and CI/CD integration.

What It Does

• Workflow commands (/flow:auto, /flow:start, /flow:eli5, /flow:finish) - Issue-driven development with worktrees, a pre-implementation ELI5 plan/necessity approval gate, quality gates, automated PR lifecycle, and CI verification. The necessity gate also ships standalone as eli5-gate - installable without CPP via /plugin marketplace add cooneycw/eli5-gate or npx skills add cooneycw/eli5-gate; CPP vendors its canonical core (file gate improvements there)
• MCP servers extending Claude Code's capabilities:
  • Second Opinion - Multi-model code review via external LLMs (Gemini, OpenAI, Anthropic), served by the external cooneycw/mcp-second-opinion repo and wired in through the root .mcp.json (streamable-http)
  • Browser automation - upstream @playwright/mcp server (npx/stdio, no container), registered by /cpp:init
• PowerPoint generation - Slide decks via the native Anthropic pptx skill (npx skills add anthropics/skills@pptx)
• Security scanning (/security:scan) - Native vulnerability detection with git history analysis
• Secrets management (/secrets:*) - Tiered credential storage (dotenv, env-file, AWS Secrets Manager) with audit logging and a web UI
• CI/CD integration (/cicd:*) - Framework detection, Makefile generation, health checks, and IaC scaffolding
• Woodpecker CI - Self-hosted pipeline (secret-scan, lint, test, typecheck, Dockerfile lint) with programmatic status polling
• Project scaffolding (/project:init) - Zero-to-GitHub-repo setup with Makefile, CI pipeline, and Docker config
• Skills ecosystem - Discover, install, and manage agent skills from skills.sh via native npx skills and the /plugin marketplace (the CPP /skills:* wrapper was retired in issue #437)
• Secret-masking hook - a PostToolUse hook masks secrets (connection strings, API keys, env vars) in Bash/Read output; bundled inside the secrets plugin (#479), so plugin installs get masking with no host script setup; destructive commands are handled by Claude Code's native git auto-blocking + OS sandbox

Requirements

• Python 3.11+
• uv package manager
• Docker (optional - only to run the external second-opinion server locally, or as the gitleaks fallback for make secret-scan)
• Claude Code CLI
• GitHub CLI (gh) for issue/PR workflows

Install

CPP ships as a plugin marketplace (ADR 0001, epic #417 Phase B). The command/skill/hook surface installs through Claude Code's /plugin, so there is nothing to clone and no symlink installer to run:

# In Claude Code, add the marketplace once:
/plugin marketplace add cooneycw/claude-power-pack

# Then install only the families you want (each is an independent plugin):
/plugin install flow@cpp
/plugin install cicd@cpp
/plugin install secrets@cpp
# ... browser, claude-md, codex, documentation, evaluate, github, project,
#     qa, second-opinion, security, self-improvement (15 in all), plus the
#     help-only cpp plugin.

/plugin handles versioning and updates for the installed surfaces. The secrets plugin bundles the PostToolUse secret-masking hook and the second-opinion plugin bundles its .mcp.json client pointer, so a plugin-only install gets masking and MCP wiring with no host setup.

Non-plugin setup (the fallback /plugin cannot cover)

A plugin install delivers commands, skills, hooks, and the MCP client pointer - but not the out-of-band infrastructure some families reach. Run /cpp:init in a target project for those steps (it is now the non-plugin infra installer, not the primary way to get commands):