rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoSecurity
Plugin
trust-center
Turns raw evidence from cloud accounts, SaaS tools and code into framework-aligned findings, gap reports and remediation steps, so compliance checks become repeatable and easier to audit.
Plugin Signal88/100Strong
maintained100
capable100
documented75
adopted56
Claude Code
> /plugin marketplace add GRCEngClub/claude-grc-engineering
Codex
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a codex
Cursor
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a cursor
Gemini CLI
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a gemini-cli
GitHub Copilot
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a github-copilot
OpenCode
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a opencode
Windsurf
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion aws-inspector-expert aws-secrets-inspector-expert azure-inspector-expert crowdstrike-inspector-expert datadog-inspector-expert drata-inspector-expert gcp-inspector-expert github-inspector-expert okta-inspector-expert poam-automation-expert slack-inspector-expert snowflake-inspector-expert splunk-inspector-expert tenable-inspector-expert testssl-inspector-expert wiz-inspector-expert fedramp-ssp-expert au-apra-cps-234-expert ch-fadp-expert cis-expert cmmc-assessment-objectives cmmc-expert ccm-expert cyber-essentials-plus-expert dora-expert essential8-expert eu-nis2-expert fedramp-20x-expert fedramp-rev5-expert gdpr-expert glba-expert hitrust-expert ind-dpdpa-expert irap-expert ismap-expert iso-expert jp-appi-expert nist-expert nist-ai-rmf-expert nist-csf-20-expert nydfs-expert pbmm-expert pci-dss-expert sg-mas-trm-expert singapore-pdpa-expert soc2-expert stateramp-expert us-ccpa-expert us-export-expert us-finra-expert us-hipaa-security us-nerc-cip-expert us-sox-expert control-tester evidence-validator finding-generator drawio grc-audit-workflow-diagram grc-compliance-operating-model-diagram grc-control-map-diagram grc-data-flow-diagram grc-evidence-flow-diagram grc-framework-crosswalk-diagram grc-poam-diagram grc-raci-diagram grc-risk-treatment-diagram grc-shared-responsibility-diagram grc-system-boundary-diagram grc-third-party-risk-diagram access-review-triage audit-ready-pr-reviewer code-to-control-mapper evidence-artifact-collector interview-question-generator policy-as-code-generator risk-to-jira-transformer compliance-tracker policy-lifecycle risk-register-manager grc-portfolio-planner website-build website-cicd website-deploy website-infra website-preflight website-repo automation-coverage-analysis context-bootstrap exec-narrative-patterns program-portfolio-composition so-what-translation questionnaire-analyzer tprm-scorer vendor-assessor gcp-docs-expert oscal-expert control-explainer framework-tutor socratic-drill trust-center -a windsurf
In this plugin
- commands
- research
- collect
- setup
- status
- retrieve
- scan
- compliance-posture
- convert
- assess
- evidence-checklist
- scope
- control-check
- ig-select
- safeguard-list
- domain-guidance
- level-select
- practice-check
- caiq-generate
- map-framework
- incident-reporting
- pillar-guidance
- testing-plan
- maturity-level
- strategy-check
- ksi-check
- mas-review
- sync-docs
- vdr-assess
- baseline-select
- poam-review
- ssp-guidance
- breach-process
- dpia
- rights-check
- privacy
- risk-assessment
- safeguards
- control-map
- gap-analysis
- scope-select
- classification
- data-residency
- essential-8
- iso-mapping
- registration
- annex-a-deep-dive
- certification-roadmap
- isms-documentation-pack
- risk-treatment-plan
- soa-generator
- continuous-monitoring-setup
- control-tailor
- family-deep-dive
- overlay-apply
- select-baseline
- ssp-section-generate
- certification
- ciso-requirements
- pentest-plan
- cccs-guidance
- profile-select
- march-2025
- requirement
- roc-guidance
- saq-select
- gap-to-code
- generate-tsc-matrix
- map-controls
- service-auditor-prep
- type-ii-planner
- documentation
- impact-select
- state-specific
- compliance-matrix
- ear-assess
- itar-assess
- jurisdiction
- generate-workpaper
- review-evidence
- validate-control
- audit-workflow
- data-flow
- drawio
- evidence-flow
- framework-crosswalk
- operating-model
- poam
- raci
- risk-treatment
- shared-responsibility
- system-boundary
- third-party-risk
- collect-evidence
- find-conflicts
- frameworks
- gap-assessment
- generate-implementation
- generate-interview-questions
- generate-policy
- map-control
- map-controls-unified
- monitor-continuous
- optimize-multi-framework
- pipeline-status
- record-automation-metrics
- review-pr
- scaffold-framework
- scan-iac
- test-control
- transform-risk
- manage-risk
- track-compliance
- update-policy
- cancel
- evidence-sweep
- gap-burndown
- help
- build
- cicd
- deploy
- infra
- plan
- preflight
- repo
- automation-coverage
- board-brief
- exec-summary
- program-health
- analyze-questionnaire
- assess-vendor
- score-risk
- cite
- query
- validate
- control
- framework
- quiz
- role
- add-document
- init
- skills
- academic-research-companion
- aws-inspector-expert
- aws-secrets-inspector-expert
- azure-inspector-expert
- crowdstrike-inspector-expert
- datadog-inspector-expert
- drata-inspector-expert
- gcp-inspector-expert
- github-inspector-expert
- okta-inspector-expert
- poam-automation-expert
- slack-inspector-expert
- snowflake-inspector-expert
- splunk-inspector-expert
- tenable-inspector-expert
- testssl-inspector-expert
- wiz-inspector-expert
- fedramp-ssp-expert
- au-apra-cps-234-expert
- ch-fadp-expert
- cis-expert
- cmmc-assessment-objectives
- cmmc-expert
- ccm-expert
- cyber-essentials-plus-expert
- dora-expert
- essential8-expert
- eu-nis2-expert
- fedramp-20x-expert
- fedramp-rev5-expert
- gdpr-expert
- glba-expert
- hitrust-expert
- ind-dpdpa-expert
- irap-expert
- ismap-expert
- iso-expert
- jp-appi-expert
- nist-expert
- nist-ai-rmf-expert
- nist-csf-20-expert
- nydfs-expert
- pbmm-expert
- pci-dss-expert
- sg-mas-trm-expert
- singapore-pdpa-expert
- soc2-expert
- stateramp-expert
- us-ccpa-expert
- us-export-expert
- us-finra-expert
- us-hipaa-security
- us-nerc-cip-expert
- us-sox-expert
- control-tester
- evidence-validator
- finding-generator
- drawio
- grc-audit-workflow-diagram
- grc-compliance-operating-model-diagram
- grc-control-map-diagram
- grc-data-flow-diagram
- grc-evidence-flow-diagram
- grc-framework-crosswalk-diagram
- grc-poam-diagram
- grc-raci-diagram
- grc-risk-treatment-diagram
- grc-shared-responsibility-diagram
- grc-system-boundary-diagram
- grc-third-party-risk-diagram
- access-review-triage
- audit-ready-pr-reviewer
- code-to-control-mapper
- evidence-artifact-collector
- interview-question-generator
- policy-as-code-generator
- risk-to-jira-transformer
- compliance-tracker
- policy-lifecycle
- risk-register-manager
- grc-portfolio-planner
- website-build
- website-cicd
- website-deploy
- website-infra
- website-preflight
- website-repo
- automation-coverage-analysis
- context-bootstrap
- exec-narrative-patterns
- program-portfolio-composition
- so-what-translation
- questionnaire-analyzer
- tprm-scorer
- vendor-assessor
- gcp-docs-expert
- oscal-expert
- control-explainer
- framework-tutor
- socratic-drill
- trust-center
- MCP
What's inside
101 Skills
/academic-research-companionGuide a research project through the full academic lifecycle — from raw idea to concrete research question, literature grounding, methodology, writing, feedback, and publication. Use this skill whenever the user shares a research idea, asks to "flesh out" a topic, wants sources/aws-inspector-expertExpertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret aws CLI output./aws-secrets-inspector-expertUse when interpreting AWS Secrets Manager connector output, deciding between inspector and retrieve modes, drafting SCF-mapped controls for rotation / KMS / public-access / inactive-access findings, or troubleshooting an aws-secrets-inspector run.
- /azure-inspector-expert
- /crowdstrike-inspector-expert
- /datadog-inspector-expert
- /drata-inspector-expert
- /gcp-inspector-expert
- /github-inspector-expert
- /okta-inspector-expert
- /poam-automation-expert
- /slack-inspector-expert
- /snowflake-inspector-expert
- /splunk-inspector-expert
- /tenable-inspector-expert
- /testssl-inspector-expert
- /wiz-inspector-expert
- /fedramp-ssp-expert
- /au-apra-cps-234-expert
- /ch-fadp-expert
- /cis-expert
- /cmmc-assessment-objectives
- /cmmc-expert
- /ccm-expert
- /cyber-essentials-plus-expert
- /dora-expert
- /essential8-expert
- /eu-nis2-expert
- /fedramp-20x-expert
- /fedramp-rev5-expert
- /gdpr-expert
- /glba-expert
- /hitrust-expert
- /ind-dpdpa-expert
- /irap-expert
- /ismap-expert
- /iso-expert
- /jp-appi-expert
- /nist-expert
- /nist-ai-rmf-expert
- /nist-csf-20-expert
- /nydfs-expert
- /pbmm-expert
- /pci-dss-expert
- /sg-mas-trm-expert
- /singapore-pdpa-expert
- /soc2-expert
- /stateramp-expert
- /us-ccpa-expert
- /us-export-expert
- /us-finra-expert
- /us-hipaa-security
- /us-nerc-cip-expert
- /us-sox-expert
- /control-tester
- /evidence-validator
- /finding-generator
- /drawio
- /grc-audit-workflow-diagram
- /grc-compliance-operating-model-diagram
- /grc-control-map-diagram
- /grc-data-flow-diagram
- /grc-evidence-flow-diagram
- /grc-framework-crosswalk-diagram
- /grc-poam-diagram
- /grc-raci-diagram
- /grc-risk-treatment-diagram
- /grc-shared-responsibility-diagram
- /grc-system-boundary-diagram
- /grc-third-party-risk-diagram
- /access-review-triage
- /audit-ready-pr-reviewer
- /code-to-control-mapper
- /evidence-artifact-collector
- /interview-question-generator
- /policy-as-code-generator
- /risk-to-jira-transformer
- /compliance-tracker
- /policy-lifecycle
- /risk-register-manager
- /grc-portfolio-planner
- /website-build
- /website-cicd
- /website-deploy
- /website-infra
- /website-preflight
- /website-repo
- /automation-coverage-analysis
- /context-bootstrap
- /exec-narrative-patterns
- /program-portfolio-composition
- /so-what-translation
- /questionnaire-analyzer
- /tprm-scorer
- /vendor-assessor
- /gcp-docs-expert
- /oscal-expert
- /control-explainer
- /framework-tutor
- /socratic-drill
- /trust-center
140 Commands
/researchStart or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing/collectQuery AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract./setupInstall the frdocx-to-froscal-ssp Python pipeline and verify its dependencies. Idempotent.
- /status
- /retrieve
- /scan
- /compliance-posture
- /convert
- /assess
- /evidence-checklist
- /scope
- /control-check
- /ig-select
- /safeguard-list
- /domain-guidance
- /level-select
- /practice-check
- /caiq-generate
- /map-framework
- /incident-reporting
- /pillar-guidance
- /testing-plan
- /maturity-level
- /strategy-check
- /ksi-check
- /mas-review
- /sync-docs
- /vdr-assess
- /baseline-select
- /poam-review
- /ssp-guidance
- /breach-process
- /dpia
- /rights-check
- /privacy
- /risk-assessment
- /safeguards
- /control-map
- /gap-analysis
- /scope-select
- /classification
- /data-residency
- /essential-8
- /iso-mapping
- /registration
- /annex-a-deep-dive
- /certification-roadmap
- /isms-documentation-pack
- /risk-treatment-plan
- /soa-generator
- /continuous-monitoring-setup
- /control-tailor
- /family-deep-dive
- /overlay-apply
- /select-baseline
- /ssp-section-generate
- /certification
- /ciso-requirements
- /pentest-plan
- /cccs-guidance
- /profile-select
- /march-2025
- /requirement
- /roc-guidance
- /saq-select
- /gap-to-code
- /generate-tsc-matrix
- /map-controls
- /service-auditor-prep
- /type-ii-planner
- /documentation
- /impact-select
- /state-specific
- /compliance-matrix
- /ear-assess
- /itar-assess
- /jurisdiction
- /generate-workpaper
- /review-evidence
- /validate-control
- /audit-workflow
- /data-flow
- /drawio
- /evidence-flow
- /framework-crosswalk
- /operating-model
- /poam
- /raci
- /risk-treatment
- /shared-responsibility
- /system-boundary
- /third-party-risk
- /collect-evidence
- /find-conflicts
- /frameworks
- /gap-assessment
- /generate-implementation
- /generate-interview-questions
- /generate-policy
- /map-control
- /map-controls-unified
- /monitor-continuous
- /optimize-multi-framework
- /pipeline-status
- /record-automation-metrics
- /review-pr
- /scaffold-framework
- /scan-iac
- /test-control
- /transform-risk
- /manage-risk
- /track-compliance
- /update-policy
- /cancel
- /evidence-sweep
- /gap-burndown
- /help
- /build
- /cicd
- /deploy
- /infra
- /plan
- /preflight
- /repo
- /automation-coverage
- /board-brief
- /exec-summary
- /program-health
- /analyze-questionnaire
- /assess-vendor
- /score-risk
- /cite
- /query
- /validate
- /control
- /framework
- /quiz
- /role
- /add-document
- /init
1 MCP server
Links
Badges
README
claude-grc-engineering
Open-source GRC Engineering resource for Claude.
claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
It is built for the Claude ecosystem: Claude Code plugin installs first, with Claude Desktop and Claude Cowork usage supported through the same Markdown skills, command runbooks, schemas, and repository files.
It is maintained by the GRC Engineering Club for people who want compliance work to behave more like engineering work: repeatable, testable, versioned, and easy to extend.
Not affiliated with Anthropic. Claude, Anthropic, and related marks are property of their respective owners.
What it does
The toolkit is a Claude Code plugin marketplace. The same plugin skills and command runbooks are also useful in Claude Desktop and Claude Cowork when you add this repository as project context or a shared workspace. Install the pieces you need:
grc-engineer: the core automation hub for gap assessment, IaC scanning, evidence collection, remediation generation, policy generation, PR review, continuous monitoring, and multi-framework optimization.- Persona plugins: workflows for auditors, internal GRC teams, third-party risk, reporting, learning, and iterative GRC automation.
- Framework plugins: reference guidance for SOC 2, NIST 800-53, ISO 27001, FedRAMP, PCI DSS, CMMC, HITRUST, CIS Controls, GDPR, DORA, HIPAA Security, regional privacy/security regimes, and more.
- Connector plugins: thin wrappers around tools such as AWS CLI, GitHub CLI, gcloud, Azure CLI, Okta, Slack, Datadog, CrowdStrike, Drata, Splunk, Tenable, Snowflake, and POA&M automation.
- Diagram plugins: editable draw.io system boundaries, evidence flows, control maps, risk treatment, audit workflows, framework crosswalks, TPRM, POA&M, data flows, RACI, and operating model visuals.
- OSCAL and bridge plugins: tooling for FedRAMP/OSCAL workflows and integrations with external GRC systems.
The common path is:
connectors collect evidence
↓
findings match schemas/finding.schema.json
↓
grc-engineer maps findings through SCF
↓
reports, remediation, evidence packages, OSCAL outputs
The Secure Controls Framework (SCF) crosswalk is used as the control backbone: 1,468 controls mapped to 249 frameworks. The toolkit references control IDs and implementation guidance; it does not reproduce copyrighted standards text.
Install in 60 seconds
Inside Claude Code:
/plugin marketplace add GRCEngClub/claude-grc-engineering
/plugin install grc-engineer@grc-engineering-suite
For a first run without cloud credentials, use GitHub as the evidence source:
/plugin install github-inspector@grc-engineering-suite
/plugin install soc2@grc-engineering-suite
/github-inspector:setup
/github-inspector:collect --scope=@me
/grc-engineer:gap-assessment SOC2 --sources=github-inspector
Full walkthrough: docs/QUICKSTART.md.
Using Claude Desktop or Claude Cowork instead of Claude Code? Start with docs/CLAUDE-COWORK.md. Anthropic's security and compliance posture is documented at trust.anthropic.com, and the Claude Cowork third-party platform guide is here: Claude Desktop on third-party platforms.
Common workflows
| Goal | Command |
|---|---|
| Run a gap assessment against one or more frameworks | /grc-engineer:gap-assessment |
| Scan Terraform, CloudFormation, or Kubernetes for compliance issues | /grc-engineer:scan-iac |
| Validate a control end to end | /grc-engineer:test-control |
| Generate remediation code, scripts, or policy | /grc-engineer:generate-implementation, /grc-engineer:generate-policy |
| Map one control across frameworks | /grc-engineer:map-controls-unified |
| Find conflicting requirements across frameworks | /grc-engineer:find-conflicts |
| Optimize a multi-framework control plan | /grc-engineer:optimize-multi-framework |
| Collect evidence from cloud/SaaS/code systems | connector-specific setup, collect, and status commands |
| Build audit workpapers or evidence packages | /grc-auditor:generate-workpaper, /grc-engineer:collect-evidence |
| Generate OSCAL SSP/SAP/SAR/POA&M outputs | /oscal:*, /fedramp-ssp:* |
| Draft leadership updates and automation coverage reports | /report:exec-summary, /report:automation-coverage |
| Create editable GRC diagrams | /grc-diagrams:drawio, /grc-diagrams:system-boundary, /grc-diagrams:evidence-flow, /grc-diagrams:control-map |
| Learn a framework, control, or GRC role | /teach-me:framework, /teach-me:control, /teach-me:role, /teach-me:quiz |
| Run an academic research project end-to-end | /academic-research-companion:research |
Every command has a reference page in its plugin's commands/ directory.
Plugin map
Use /grc-engineer:frameworks to discover framework coverage and plugin depth.
High-level categories:
| Category | Examples |
|---|---|
| Engineering hub | grc-engineer |
| Persona/workflow plugins | grc-auditor, grc-internal, grc-tprm, grc-reporter, grc-loop, teach-me, academic-research-companion |
| Diagram plugin | grc-diagrams for editable draw.io GRC diagrams |
| Framework plugins | soc2, nist-800-53, iso27001, fedramp-rev5, fedramp-20x, pci-dss, cmmc, hitrust, cis-controls, gdpr, dora, us-hipaa-security, and others |
| Connector plugins | aws-inspector, github-inspector, gcp-inspector, azure-inspector, okta-inspector, slack-inspector, datadog-inspector, crowdstrike-inspector, drata-inspector, splunk-inspector, tenable-inspector, snowflake-inspector |
| Dashboards, knowledge sources | compliance-posture-dashboard, gcp-docs |
| OSCAL/FedRAMP tooling | oscal, fedramp-ssp, POA&M automation plugins |
The marketplace manifest lives at .claude-plugin/marketplace.json.
Data contract
Every connector emits Findings that match schemas/finding.schema.json. A Finding is one resource with one or more control evaluations.
That contract keeps connectors small: each connector only needs to collect and normalize evidence. grc-engineer handles framework expansion, reporting, remediation, and downstream workflows.
For the full architecture and schema example, see docs/ARCHITECTURE.md.
Documentation
- docs/QUICKSTART.md: first gap assessment in about 10 minutes
- docs/ARCHITECTURE.md: pipeline model, data contract, plugin categories, extensibility
- docs/FRAMEWORK-COVERAGE.md: generated coverage for SCF-mapped frameworks
- docs/FRAMEWORK-PLUGIN-GUIDE.md: scaffold and level up framework plugins
- docs/GRC-DATA.md: user-owned
grc-data/contracts for metrics, risks, vendors, exceptions, and policies - docs/ENTERPRISE-DEPLOYMENT.md: AWS Bedrock, Claude Platform on AWS, and Google Vertex AI guidance
- docs/CLAUDE-COWORK.md: Claude Desktop and Claude Cowork file-oriented usage, including third-party platform handoff notes
- Anthropic Trust Center: Anthropic security, compliance, and trust resources
- Claude Desktop on third-party platforms: official Cowork platform guidance
- docs/CONTRIBUTING.md: how to contribute connectors, framework guidance, and docs
- docs/SCF-ATTRIBUTION.md: SCF licensing and attribution
Contributing
Contributions are welcome from GRC practitioners, auditors, security engineers, platform teams, framework experts, and commercial GRC vendors.
The highest-value contributions are:
- New connector plugins
- Improvements to existing connectors
- Framework plugin guidance and evidence patterns
- Real-world remediation examples
- Documentation that helps practitioners learn GRC engineering
First-time contributors follow the issue → vouch → PR flow described in docs/CONTRIBUTING.md and GOVERNANCE.md.
Security-sensitive reports should use the private advisory process described in SECURITY.md.
Status
Pre-1.0. The Finding schema is versioned, and breaking changes are documented in CHANGELOG.md.
Star History
License
MIT for original code, copyright © GRC Engineering Club contributors. Exceptions are documented in LICENSE. The CIS Controls plugin is CC BY-SA 4.0 per upstream terms. SCF data is CC BY-ND 4.0 and redistributed verbatim.
Stars on GitHub
Momentum
- stars in total
- 432
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills44k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about trust-center.
Install it with the command on its page. It includes academic-research-companion, aws-inspector-expert, aws-secrets-inspector-expert. Its skills do not fire on their own yet. Free and open source.
- What is trust-center?
- grcengclub/claude-grc-engineering is an open-source plugin of skills, commands, and MCP servers that turns cloud, SaaS, code, and security tool evidence into framework-aligned findings and remediation guidance. Use it for compliance evidence collection, control testing, and OSCAL workflows.
- How do I install trust-center?
- Run these in Claude Code: /plugin marketplace add GRCEngClub/claude-grc-engineering. Then prompt normally.
- Does trust-center auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is trust-center free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use trust-center's skills?
- trust-center installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it