ECC — A Meta-Framework That Redesigns Claude Code's Defaults

TL;DR

• ECC (affaan-m/everything-claude-code) is a meta-framework built by Affaan Mustafa, winner of the Anthropic × Cerebral Valley hackathon (2026-02). About four months after its v1.0 release on 2026-01-22: 181.6k★, 28k forks, 1,900+ merged PRs, 150+ contributors. The decisive difference from the other three in its category: it has a commercial-platform plane — hosted SaaS (ECC Tools Pro), a GitHub App (150+ installs), two separate npm packages (ecc-universal, ecc-agentshield), and Free/Pro/Enterprise marketplace tiers.
• The mechanism in one line: it has opinions about how the harness itself is run. Token optimization (default model sonnet, MAX_THINKING_TOKENS=10000, CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=50), memory persistence (auto save/restore of context via SessionStart/Stop hooks), instinct-based continuous learning (confidence scores in continuous-learning-v2), security scanning (AgentShield with 1,282 tests, 102 rules), and parallelism (git worktrees, cascade). Five axes that tear up Claude Code's execution environment itself.
• Category evolution: v1.5 (2026-02-11) "Universal Edition" branched installs across 10+ harnesses (Claude Code, Codex, Cursor, OpenCode, Gemini, Kiro, Qwen, Trae, CodeBuddy). v1.8 (2026-03-05) introduced the "Harness Performance" tagline — the moment the prior "language rule pack" identity was retroactively repositioned. v1.10 (2026-04-05) entered the enterprise vertical with "ECC 2.0 Alpha" and the addition of the operator-workflow library.
• The actual scale has outgrown what the README advertises as "16 agents, 65 skills, 40 commands." As of the 2026-05-14 main branch: 60+ agents, 220+ skills, 75+ commands. The README numbers are frozen at the v1.6 mark, and the catalog has been expanding through weekly fix-wave PRs ever since.
• Used alone, it's strong at honestly tuning Claude Code's execution environment. Mixed with Superpowers/GSD/gstack, it collides at the five conflict surfaces of §6 — especially quadruple SessionStart hook injection and the point where a vertical skill's description matching bypasses another framework's process gate.

1. Introducing ECC

1.1. What It Is

affaan-m/everything-claude-code — a performance-optimization system for AI agent harnesses built by Affaan Mustafa. The v1.10 README's own self-positioning:

"This is not just a collection of config files. It's a complete system spanning skills, instinct, memory optimization, continuous learning, security scanning, and research-first development. It includes production-level agents, hooks, commands, rules, and MCP configurations that I've refined over 10+ months of daily, intensive use while building real products." — README (ko-KR)

The core is the negative self-description: "not just a collection of config files." That negation is close to true because it's not dotfiles you carbon-copy in, but an environment framework with opinions on five directional axes (token optimization, memory persistence, continuous learning, security, parallelism). Where Superpowers opines on process gates, GSD on context isolation, and gstack on role personas, ECC opines on how the harness itself is operated.

1.2. The Creator — Affaan Mustafa and Zenith.chat

Affaan Mustafa is the founder of zenith.chat (an AI chat-interface startup). ECC's emergence timeline is bound up with his other work:

• 2026-01-22 — ECC v1.0 released ("Official Plugin Release"). Formally registered in the Claude Code plugin marketplace.
• 2026-02 — won the Cerebral Valley × Anthropic hackathon. The winning entry was AgentShield — a tool that scans Claude Code configurations for security vulnerabilities, misconfigurations, and injection risks. 1,282 tests, 98% coverage, 102 static-analysis rules.
• 2026-02-24 — ECC v1.6 "Codex Edition + GitHub App". AgentShield split out and published as the npm package ecc-agentshield, plus marketplace entry via a GitHub App (github.com/marketplace/ecc-tools). Free/Pro/Enterprise three tiers.
• 2026-03-05 — ECC v1.8 "Harness Performance & Cross-Platform Reliability." The moment the tagline itself was made explicit as "Harness Performance."
• 2026-03-21 — ECC v1.9 "Selective Install, ECC Tools Pro, 12 Language Ecosystems." Launch of the hosted SaaS (ECC Tools Pro). 12 language-ecosystem patterns (Python, TypeScript, Go, Java, C++, Rust, Swift, Kotlin, Dart, PHP, Perl, C#).
• 2026-04-05 — ECC v1.10 "Surface Refresh, Operator Workflows, and ECC 2.0 Alpha." The operator-workflow library joined — enterprise vertical (healthcare, logistics, finance, customs) skill families. ECC 2.0 alpha arrived in the ecc2/ directory.

The core of viewing ECC on the same plane as the other three is Affaan's incentive. Superpowers' Jesse Vincent is a solo maintainer, GSD's TÂCHES leads a small team, gstack's Garry Tan has a YC recruiting lure — but the tools themselves are non-commercial. ECC is a category entrant with a commercial platform from the start. The hosted SaaS, the GitHub App, the tier split are not marketing byproducts but design intent. This is the critical-reading point of §7.5.

1.3. Strengths

• It cuts token cost by default. The one block the README recommends for ~/.claude/settings.json:
  • model: sonnet (default Opus → Sonnet, ~60% cost reduction, can handle 80%+ of coding work)
  • MAX_THINKING_TOKENS: 10000 (default 31,999 → 10,000, ~70% cut in hidden thinking cost)
  • CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: 50 (default 95 → 50, compacts earlier to hold quality over long sessions) These three settings alone shrink the cost surface most users were paying without noticing. The other three in the category have no opinion on model choice, thinking budget, or autocompact timing — they run on a Max-plan premise. For ECC, budget awareness is a first-class citizen.
• Memory crosses between sessions. hooks/memory-persistence/ auto-restores the prior session's summary, decisions, and blockers on SessionStart entry, and writes the session summary to disk at the Stop stage. Similar in intent to GSD's .planning/ disk state, but applied by default to every workflow at the hook level. Superpowers and gstack opine on gates and personas within a session and leave cross-session continuity to the user.
• continuous-learning v2 — instinct-based learning with confidence scores. Recurring patterns in a session are auto-extracted and stored as Instincts. Each instinct carries a confidence score: check it with /instinct-status, pull in someone else's with /instinct-import <file>, export yours with /instinct-export, and /evolve to cluster related instincts into a reusable skill. Where gstack's /learn is per-project accumulated markdown, ECC's instinct is cross-session auto-extraction + confidence weighting + a skill-promotion pipeline. The most automated learning mechanism in the category.
• AgentShield — the only integrated security stack of the four. Split out as a separate npm package (ecc-agentshield) yet integrated with the ECC core. /security-scan scans six surfaces — CLAUDE.md, settings.json, MCP config, hooks, agent definitions, skills — across five categories: secret detection (14 patterns), permission audit, hook-injection analysis, MCP-server risk profiling, and agent-config review. The design running three Claude Opus 4.6 agents (redteam, blueteam, auditor) as a pipeline via the --opus flag is a precision unseen elsewhere in the category.
• Branched install across 10+ harnesses. Claude Code, Codex CLI, Cursor, OpenCode, Gemini, Kiro, Qwen, Trae, CodeBuddy, Antigravity. Language selection + harness selection in one command, as in ./install.sh typescript. Every hook and script is written in cross-platform Node.js — Windows, macOS, Linux alike.
• Operator-workflow library. v1.10's Operator Workflows: healthcare-cdss-patterns, hipaa-compliance, customs-trade-compliance, inventory-demand-planning, logistics-exception-management, returns-reverse-logistics, production-scheduling, email-ops, finance-billing-ops, and more. The other three in the category cover developer workflows only and never set foot in operator work in non-development domains. ECC is the first framework to enter the vertical.

1.4. Installation

Setup done in under two minutes (README claim):

Step 1 — install the plugin (marketplace path):

# Inside Claude Code
/plugin marketplace add https://github.com/affaan-m/everything-claude-code
/plugin install ecc@ecc

Step 2 — manually install the rules (required):

# The plugin system doesn't support automatic rule deployment, so do it manually
git clone https://github.com/affaan-m/everything-claude-code.git
cd everything-claude-code
./install.sh typescript    # or python · golang · several at once
# Cursor target: ./install.sh --target cursor typescript

Step 3 — use it:

/ecc:plan "add user authentication"    # marketplace mode
/plan "add user authentication"        # short form with manual install
/plugin list ecc@ecc                   # confirm installation

Requires Claude Code minimum version v2.1.0 (depends on hook-system changes). Note: do not add a "hooks" field to .claude-plugin/plugin.json — Claude Code v2.1+ auto-loads an installed plugin's hooks/hooks.json, so an explicit declaration triggers a duplicate-detection error.

Optional component install — the decisive difference from the other three is that partial install, not the whole plugin, is possible:

cp everything-claude-code/agents/*.md ~/.claude/agents/    # agents only
cp -r everything-claude-code/rules/common/* ~/.claude/rules/    # rules only

Each component is fully independent. It's not an all-or-nothing design like Superpowers' bootstrap hook or gstack's CLAUDE.md intrusion.

2. How It Works — the Five Axes of Harness Performance

2.1. The Token-Optimization Axis — model, thinking, autocompact defaults

ECC's recommended settings.json block is the first axis. It tears up Claude Code's default behavior itself to handle the same work at the same quality 60–70% cheaper.

Switch to /model opus temporarily only for deep architectural reasoning, debugging, and complex design. For everyday workflow, Sonnet + a reduced thinking budget + fast autocompact is the default.

This design is where ECC decisively differs from the other three. GSD puts fresh 200k context per phase at the heart of its design, so its token-cost surface is heavy (the "Max plan burned in 40 minutes" of Issue #1553). gstack adds load from its own system code — real browser, design-html, shotgun, and so on. Only ECC has an opinion that lowers Claude Code's baseline cost by default.

2.2. The Memory-Persistence Axis — SessionStart/Stop hooks

hooks/memory-persistence/ catches two triggers:

• SessionStart — auto-injects into context the prior session's summary, in-flight decisions, and unfinished work. Works even after /clear or /compact.
• Stop — at session end, writes the current state to disk as markdown. An explicit /save-session slash is also provided separately (commands/save-session.md, commands/resume-session.md).

The meaning of this design: the design assumption that the context window is volatile but work memory is persistent sets ECC apart from the other three. Superpowers focuses on gates and discipline within a session. gstack accumulates per-project markdown learning via /learn, but that's user-invoked, not auto-injected at session start. GSD's .planning/ markdown state flows at phase boundaries — the same disk-based persistence, but at the phase level, not the session-lifecycle level.

Only ECC embeds persistent memory into Claude Code's session lifecycle itself. This is where ECC's place in the category becomes clear.

2.3. The Continuous-Learning Axis — Instinct v2

skills/continuous-learning-v2/. The design in one line: auto-extract recurring patterns → assign confidence scores → promote to skills.

/instinct-status        # check learned instincts and their confidence
/instinct-import <file> # pull in someone else's instincts
/instinct-export        # export your instincts
/evolve                 # cluster related instincts into a skill

What sets Instinct apart from other mechanisms:

• gstack /learn: the user explicitly saves patterns. Markdown accumulation, no confidence scores.
• GSD .planning/SUMMARY.md: auto-writes that phase's summary at the phase boundary. No cross-cutting pattern extraction.
• Superpowers: no learning mechanism. Bootstrap and self-invocation discipline is the heart.
• ECC instinct: auto-extraction from the session itself + confidence-weighted + an instinct → skill auto-promotion pipeline + shareable via import/export.

The design that pulls in another user's instincts via /instinct-import is something unseen elsewhere in the category. Combined with the catalog/marketplace spirit, it's a layer where knowledge itself becomes an asset. But quality control on shared instincts has almost no tooling as of v2 — be conscious that since confidence scores come from the recurring patterns of my session, transplanting them straight into someone else's environment makes the confidence lose its meaning.

2.4. The Security Axis — AgentShield Integration

Deep dive in §5. Briefly: scanning the security vulnerabilities of Claude Code's configuration itself is an axis only ECC holds in the category. 1,282 tests, 102 rules, 5 categories (secret detection, permission audit, hook injection, MCP risk, agent config), plus the --opus 3-agent redteam/blueteam/auditor pipeline.

2.5. The Parallelism Axis — worktrees, cascade, instance scaling

The README spells this out as a separate item: Git worktrees, the cascade approach, and when to scale instances. Similar to gstack's parallel sprint via Conductor, but ECC has opinions about worktrees themselves (a judgment table for which work to spin up a worktree on, when to cascade, when to add instances). A whole chapter of The Longform Guide covers exactly this.

2.6. How the Five Axes Interact

The most subtle of ECC's design assumptions is that these five are mutually dependent. For example:

• Token optimization recommends MAX_THINKING_TOKENS=10000 → combined with autocompact=50, a long session re-enters with 10k-token thinking after 50% compaction → the memory-persistence hook injects the prior session summary at SessionStart → Instinct extracts patterns from that summary → the instinct propagates to the next parallel worktree.

In other words, the five axes mean something independently, but only when turned on together do they form ECC's core design. Install only part and you get cherry-pick's benefits but lose the synergy among the five axes. That systemic coupling unlike the other three is ECC's signature.

3. The Standout Designs

3.1. Actual Catalog Size — the gap between README and the main branch

Checked directly against the 2026-05-14 main branch:

The README numbers are frozen at the v1.6 mark (2026-02), and since then the catalog has been expanding fix-wave by fix-wave. Most of the 1,900+ merged PRs are a flow of batch-merged community contributions. So ECC's current surface area is ~3× the advertised surface. From the user's side, it's already reached a scale where holding every skill in memory is hard.

This scale determines ECC's place in the category. Against Superpowers' 14 skills, GSD's 86 commands (as of v1.41), and gstack's 30+ commands, ECC's surface area is overwhelmingly large. In its category, ECC is the heaviest framework.

3.2. The Operator-Workflow Library — entering the vertical

The skill family that joined in v1.10 "Operator Workflows." It opines not on developer workflows but on operator work in non-development domains:

• healthcare: healthcare-cdss-patterns, healthcare-emr-patterns, healthcare-eval-harness, healthcare-phi-compliance, hipaa-compliance, healthcare-reviewer
• logistics & trade: customs-trade-compliance, inventory-demand-planning, logistics-exception-management, production-scheduling, returns-reverse-logistics, quality-nonconformance
• finance & billing: finance-billing-ops, customer-billing-ops, carrier-relationship-management, energy-procurement
• operations ops: email-ops, messages-ops, automation-audit-ops, enterprise-agent-ops, google-workspace-ops, knowledge-ops, research-ops, terminal-ops, project-flow-ops, unified-notifications-ops
• homelab: homelab-network-readiness, homelab-pihole-dns, homelab-vlan-segmentation, homelab-wireguard-vpn, homelab-network-setup
• scientific: scientific-db-pubmed-database, scientific-db-uspto-database, scientific-pkg-gget, scientific-thinking-literature-review, scientific-thinking-scholar-evaluation

This cluster is the decisive difference from the other three. Superpowers/GSD/gstack are meta-frameworks for code work. ECC goes into non-coding operational work at equal depth — consistent with the fact that Affaan's incentive lies in an enterprise vertical marketplace. The ECC Tools Pro/Enterprise tiers sell the hosted version of this vertical skill family.

3.3. ECC Tools Pro and the Hosted Plane

ecc.tools is ECC's SaaS companion. The README claim:

"This repository contains only code. The guides explain everything."

A signal that core behavior is split between the open-source core and the hosted SaaS. The GitHub App's 150+ installs are a signal of organizational adoption — not individuals git-cloning, but organizations installing a GitHub App. The Free/Pro/Enterprise tiers gate hosted features (10k+ commit analysis, automatic PRs, team sharing).

As open source, ECC is fully free MIT. But catalog discovery, automatic analysis, and team-sharing features are where the hosted plane is the core. This dual plane is ECC's commercial identity in the category. For Superpowers/GSD/gstack, the open-source core is 100% of the thing.

3.4. The 8 Fix-Wave Pattern — a daily merge cycle

Look at the 2026-05-13~14 commit log and 10+ commits a day get merged. The pattern is regular:

• Sync ECC Tools hosted ... — syncing with the hosted SaaS
• docs: sync roadmap after AgentShield ... — reflecting AgentShield work back into the ECC repo
• docs: sync roadmap after ECC-Tools ... — syncing with ECC Tools Pro

In other words, the ECC main repo is becoming a reflection layer for changes originating in the hosted SaaS, AgentShield, and ECC Tools. A signal that core development is happening somewhere other than the open-source repo. This is both a long-term stability risk and a place that shows the depth of the hosted plane.

3.5. ECC 2.0 alpha — the ecc2/ directory

The ecc2/ that arrived alongside v1.10 is the core of the next version. The core design is changing. As of now it's alpha, so no operational guarantees. The phrase "Surface Refresh" in the v1.10 release notes makes explicit that work redefining the existing surface is underway.

If you're an ECC user, be conscious that a v1.x → v2 migration will happen within the next one to two quarters. The frameworks running a v2 alpha concurrently in the category are two: ECC and GSD (with its separate gsd-2 repo).

4. The Catalog — agents, skills, commands

Based on the measured numbers in §3.1 (60+, 220+, 75+), organized by category. (Full enumeration omitted — core clusters only.)

4.1. Agents by category (key items among 60+)

4.2. Skills by category (key clusters among 220+)

4.3. Commands by category (key items among 75+)

The /hookify command family is a meta-command that generates hooks themselves — the place where ECC generates a hook tailored to your workflow. A design unseen elsewhere in the category.

5. AgentShield Deep Dive

5.1. A Place Only ECC Holds in the Category

Where the other three in the category stay at meta-frameworks for code work, ECC enters the security surface of Claude Code's configuration itself. AgentShield is published as the separate npm package ecc-agentshield but is integrated with the ECC core. A design place only ECC holds in the category.

5.2. What It Scans

5 categories, 6 surfaces:

102 static-analysis rules, 1,282 tests, 98% coverage — no tool among the other three reaches this precision.

5.3. The --opus Flag — 3 agents, redteam/blueteam/auditor

"The --opus flag runs three Claude Opus 4.6 agents as a redteam/blueteam/auditor pipeline. The attacker hunts for exploit chains, the defender evaluates safeguards, and the auditor synthesizes both sides into a prioritized risk assessment." — README

This design is something unseen elsewhere in the category. Three personas look at the same code at once. The cost is exposed honestly — Opus 4.6 × 3 agents flow via streaming. The README calls npx ecc-agentshield scan --opus --stream "precision analysis with three Opus 4.6 agents."

5.4. GitHub Action Integration — a gate embedded in CI

- uses: affaan-m/agentshield@v1

It can be embedded in a CI pipeline as a GitHub Action. The other three in the category are centered on local developer tooling. ECC is the first framework to enter the CI-automation surface. At the point of organizational adoption, this surface is the one closest to governance.

5.5. AgentShield's Place vs. Existing Security Tools

AgentShield does not scan vulnerabilities in application code — the place of SAST/DAST tools (Snyk, Semgrep, Checkmarx) is untouched. AgentShield's place is the configuration surface of Claude Code's agent setup. That is:

• SAST/DAST: OWASP/CVE patterns in application code
• AgentShield: the configuration of how the agent handles that code

The two are complementary, not competitors. As organizations adopt AI agents, ECC builds an answer for a new surface the existing security stack doesn't cover. This is why ECC is positioned as part of the same movement as the AWS Agent Registry in the Agent Governance category — a governance layer emerging right after MCP standardization.

6. Where It Breaks When Used Alongside Superpowers/GSD/gstack

The points below aren't observed from running them together — they're read off each one's SessionStart hooks, README, definition files, and filed issues, listing only collisions that are structurally inevitable.

6.1. Quadruple SessionStart Hook Injection

ECC, Superpowers, GSD, and gstack all embed a SessionStart hook. Installing all three of the others was already summarized as triple nondeterminism in §6.1 (the GSD piece); add ECC and it's quadruple nondeterminism:

• Superpowers <EXTREMELY_IMPORTANT> bootstrap
• GSD gsd-update-banner.js
• gstack team-mode auto-update banner
• ECC hooks/memory-persistence/ SessionStart + other matchers in hooks.json

The Claude Code manual states that only identical handlers are deduped — since the four frameworks register different commands, all of them inject into context. Mitigation: make only one main framework global, and opt the rest in per project via .claude/settings.local.json.

6.2. ECC's Vast Description Matching vs. the Others' Process Gates

ECC has 220+ skills + 60+ agents + 75+ commands. Each can be auto-invoked by description matching. When multiple ECC skills match a user utterance, ECC has to decide internally which to call.

Superpowers triggers its brainstorming HARD-GATE first on code-change utterances. gstack is centered on explicit slash invocation. GSD's phase-start commands are explicit.

With ECC + Superpowers installed together: an ECC vertical skill (e.g. the feature-dev skill) can match before Superpowers' brainstorming description ("You MUST use this before any creative work") fires. That is, ECC's description-rich catalog can bypass Superpowers' process gate.

Mitigation: when using Superpowers and ECC together, specify in AGENTS.md that ECC's work-stage skills (plan, feature-dev, tdd, etc.) defer to Superpowers' equivalents (writing-plans, brainstorming, test-driven-development) being called first. ECC's vertical skills (healthcare, logistics, etc.) are in a domain Superpowers can't cover, so there's no conflict.

6.3. Memory Persistence vs. GSD's Fresh-Context

ECC's SessionStart memory injection and GSD's fresh 200k subagent context are orthogonal in their design assumptions:

• ECC: context is expensive, so inject the compressed summary of the prior session into the new one to secure continuity
• GSD: quality degrades as context fills up, so spin up a fresh 200k per phase to block contamination

With both assumptions in one environment: a GSD subagent starts with fresh context, so it can't see the message the ECC memory-persistence hook injected. Conversely, when the main session holds the prior session summary ECC injected, the executor GSD dispatches via /gsd-execute-phase ignores that summary — exactly as designed.

Mitigation: when using both, separate the layers — specify that ECC's memory-persistence applies only to main-session continuity. Don't expect it in a GSD subagent. Or use only one of them.

6.4. AgentShield's Conflict With Other Frameworks' Config

AgentShield scans the security vulnerabilities of Claude Code config, and config created by other meta-frameworks is in scope too. For example:

• If gstack embeds a gstack section in ~/.claude/CLAUDE.md, AgentShield scans the permission patterns of that section. Possible conflict.
• If Superpowers' SessionStart hook injects bootstrap messages into context, AgentShield evaluates it under the hook-injection-analysis category.
• If ECC applies GSD's --dangerously-skip-permissions recommendation and embeds it in settings.json, AgentShield may raise an over-broad-permission warning.

Mitigation: be conscious of false positives when running AgentShield in a multi-framework environment. As of v1.10, AgentShield has only a self-inspection mode, and the mechanism to whitelist other frameworks' intended config is unfinished. Conscious review is needed in operation.

6.5. ECC's Description Richness vs. gstack's Top-Level Slash Occupancy

gstack occupies top-level slashes like /review, /ship, /qa. ECC also has many top-level slashes like /code-review, /pr, /tdd. Install both and slash-name collisions are rare (different prefixes), but description matching overlaps. For example:

• gstack /review description: "Find the bugs that pass CI but blow up in production."
• ECC /code-review description: "Reviews code quality, security, and maintainability."

If the user says "run a review," both can match. Which gets called is nondeterministic.

Mitigation: specify a priority in the global AGENTS.md ("code review goes to gstack /review first, ECC /code-review is secondary"). Or operate by role clarification (gstack slashes for production bugs, ECC slashes for vertical work).

6.6. Conflict-Surface Summary

It becomes clear that the four frameworks each occupy a different surface within the category. ECC's place is a triple expansion: Claude Code's execution environment itself + non-development domains + a commercial plane. A place with more conflict surface in concurrent operation than combination potential with the other three.

7. Limitations and Trade-offs

7.1. The catalog is ~3× the advertised surface — learning burden

The gap of §3.1 — 16/65/40 advertised vs. 60+/220+/75+ measured. Install ECC whole and Claude Code's system-prompt surface becomes the heaviest in the category. Selective install (rules only, agents only, specific skills only) is effectively the recommended path. But the §2.6 trade-off — that selective install erodes the five-axis synergy — follows along.

7.2. The README numbers' retroactive inconsistency

The "16 agents, 65 skills, 40 commands" stamped at the v1.6 mark still sits in the README after v1.10 + the 2026 Q2 fix-wave. The gap between marketing consistency and actual surface is the largest in the category. From the user's side, you have to doubt the official document's numbers — running ls yourself is the answer.

7.3. ECC 2.0 alpha — migration risk

The ecc2/ covered in §3.5. A point where the v1.x → v2 migration path is unspecified. For production adoption, freezing on v1.x is recommended. It's unclear where v2's major design changes will collide with the existing five axes. GSD too has a separate gsd-2 repo in the category, but that's an explicit v1/v2 split, whereas ECC's is ecc2/ inside the same repo, so the boundary is ambiguous.

7.4. The commercial plane's incentive — hosted-plane depth

The ECC Tools Pro/Enterprise covered in §3.3. The open-source core is fully free MIT, but the hosted plane is growing into the core. Be conscious of the possibility that, over the next one to two quarters, some features move from the open-source core to hosted-only. The other three in the category have no commercial plane, so they carry no such risk.

7.5. fix-wave dependency — the share of sync commits

The 10+ daily commits syncing with the hosted SaaS seen in §3.4. As the ECC repo edges closer to being a reflection layer for the hosted SaaS, there's a risk that the open-source core's stand-alone usability weakens. How far a user can go with the ECC core alone, without the hosted plane, may grow less clear over time.

7.6. Quality control on vertical skills

The operator-workflow library of §3.2. That ECC ships skills for regulated domains like healthcare, logistics, and finance is something to watch carefully. Whether skills like hipaa-compliance and customs-trade-compliance accurately reflect actual regulatory requirements is quality-controlled in a one-person (Affaan) + community-PR mode. Domain-expert review is mandatory for production adoption — don't take ECC's own claims at face value.

7.7. The quality problem with instinct sharing

The /instinct-import covered in §2.3. The design that lets you pull in another user's instincts operates with no quality-verification mechanism as of now. The confidence score in my environment comes from my recurring patterns, while someone else's instinct comes from their recurrences — the same confidence isn't justified in my environment. In the category, this is the most ambitious knowledge-sharing mechanism but the thinnest quality control.

8. Synthesis — ECC Is a "Harness Performance" Framework (and More)

Boiled to three lines:

1. Not a process opinion, an environment opinion, or a role opinion — but a harness opinion. Superpowers forces how to work, GSD where to work, gstack who works. ECC opines on how to run Claude Code itself — five axes (token defaults, memory persistence, instinct learning, security scanning, parallelism) that tear up the harness baseline. The decisive difference from the other three.
2. The only one of the four with a commercial-platform plane. Hosted SaaS (ECC Tools Pro), a GitHub App (150+ installs), two npm packages, Free/Pro/Enterprise marketplace tiers, and even a non-development vertical skill family. The gap between the other three's non-commercial identity and ECC's commercial identity is a difference in design intent itself. That Affaan's incentive lies in enterprise vertical and hosted-plane growth is not a marketing byproduct but design intent.
3. The largest surface area in the category — ~3× the advertised number. 60+ agents, 220+ skills, 75+ commands. That the README's v1.6 numbers (16/65/40) aren't kept consistent retroactively shows the gap between commercial marketing and the open-source core. For the user, selective install is effectively the recommendation, and whole install is the heaviest place in the category.

Operational conclusion: for an environment that needs the harness baseline tuned plus a vertical skill family (enterprise adoption, concurrent multi-language ecosystems, an organization embedding even the CI-automation surface), ECC is the best fit of the three. For an individual user who just wants a single workflow discipline, Superpowers or gstack alone is lighter. When used alongside Superpowers/GSD/gstack: it collides at the five conflict surfaces of §6 — especially the quadruple SessionStart injection and ECC's description-rich catalog bypassing the other frameworks' process gates, the orthogonal memory model, and AgentShield's false positives. This is why third-party combination guides recommend separating the layer sequence.

One-line recommendation — if you've started to think about Claude Code's baseline, turn ECC on. For the user paying token cost without noticing, the user whose cross-session continuity keeps breaking and who rebuilds context every time, and the organization starting to ask whether the AI agent's own configuration carries security vulnerabilities, ECC is the most direct answer in the category. If the whole five-axis bundle is too much, you can start with common rules only via the one line cp -r everything-claude-code/rules/common/* ~/.claude/rules/. Cherry-pick only the vertical domains you need. Consider the hosted plane at the point of organizational adoption. AgentShield is worth one npx ecc-agentshield scan whether or not you install the others in the category — because it's a place only ECC holds within it.

References

Official primary

• affaan-m/everything-claude-code — v1.10 stable, 181.6k★ (as of 2026-05-14)
• README.md (en) · README.md (ko-KR)
• The Longform Guide — deep dive on token optimization, memory persistence, evaluation, parallelism
• The Shortform Guide — setup, basics, philosophy primer
• The Security Guide — AgentShield operations guide
• CHANGELOG.md — v1.0 → v1.10 timeline
• Release notes — v1.5 Universal, v1.8 Harness Performance, v1.10 ECC 2.0 Alpha

The separated commercial plane

• ECC Tools (ecc.tools) — hosted SaaS
• GitHub Marketplace — ecc-tools — GitHub App (150+ installs)
• npm — ecc-universal
• npm — ecc-agentshield
• affaan-m/agentshield — AgentShield's separate repo (incl. GitHub Action)

The creator

• Affaan Mustafa / @affaanmustafa
• zenith.chat — AI chat-interface startup
• Cerebral Valley × Anthropic Hackathon, 2026-02 — AgentShield, the winning entry

Other pieces in the series

• Agent Framework category overview — where Superpowers, GSD, gstack, and ECC stand
• Superpowers — the process-gate axis
• GSD — the context-isolation axis
• gstack — the role-division axis
• Agent Governance — AWS Agent Registry — a governance layer that emerged right after MCP standardization (the same movement as AgentShield)