/plugin marketplace add dshakes/compass/plugin install core@compassbrew install dshakes/tap/compasscompass quickstartgemini extensions install https://github.com/dshakes/compassgit clone https://github.com/dshakes/compass ~/compass && cd ~/compass && ./quickstart.shcurl | sh · fully reversible · asks firstEveryone ships the same models. The edge is configuration you can trust — and compass hands you the number a skeptic can reproduce in 30 seconds.
Usage trackers report spend. compass enforces it — COMPASS_MAX_USD=5 hard-stops the session before the next tool call. No $40 surprise while you're away.
Catastrophic commands and secret writes are denied before they run — and the policy is eval-gated in CI against a labeled corpus, not asserted. rm -rf / → denied; rm -rf ./build → allowed.
It reviews, security-checks, tests, cross-audits with a second model, and pushes its own fixes until green. The one thing it never does: press merge. That gate is yours, permanently.
No login, no tokens. Clone the repo and run any of these — the number prints on your own machine.
Then ask the agent to rm -rf / or write a .env → denied. rm -rf ./build → allowed.
A poisoned repo or web page can't quietly turn your agent against you — and you can measure how well that holds.
Blocked, not warned — before the next tool call. A per-day cap covers unattended fleet runs.
Cheap work goes to cheap models — ~62% cheaper than all-Opus at 96.9% routing accuracy. Run compass bench to reproduce it.
The budget cap really halts before the next tool call; the loop really pushes its own fixes until tests pass. Don't take the animation's word for it — reproduce both on your machine with export COMPASS_MAX_USD=5 and /review.
Cost climbs to the cap → the next tool call is blocked, not warned. Your $5 stays $5.
It drives a change to passing tests on its own — then stops at your merge.
A one-shot agent stops at its first wrong answer. compass loops — generate → test → critique → fix → repeat against a gate — so quality comes from iteration, not one lucky prompt.
The same closed loop runs at four scales — each until a gate says done, then it stops at a human:
generate → test → critique → fix — one change driven to green.stops when tests + review pass
review → auto-fix the Blocking findings → re-review, round-capped ×3.hands to a human if still red
the whole pipeline, scheduled across every repo you own, overnight, test-gated.a PR per repo — approve from your phone
parallel agents that fan out, fact-check each other, and converge.one synthesized answer
The whole toolkit — guardrails, the crew, the router, the CLI — is live the moment you install. The autonomous loops sit on top, opt-in.
The review → security → tests → cross-audit → auto-fix → re-review loop on every PR. Parallel reviewers, round-capped fixes, a second-model audit — then it stops at your merge.
09-sdlc →The loop, scheduled across all your repos through a test gate — overnight. Wake up to a PR per repo you can approve from your phone.
14-fleet →A hook layer that blocks disasters, catches secrets, auto-formats, and keeps a JSONL audit log.
16-hardening →Eval-gated defense vs prompt-injection, config poisoning, safety-override, MCP tool-poisoning, malware & insecure code.
17-red-team →Standalone, reusable: a deterministic keyword tier-picker (eval-gated 96.9%), with an opt-in 9-stage cost-aware engine. Measured, not vibes.
router/ →Cost-tiered expert subagents, slash-commands, and dynamic workflows that fact-check each other.
roster →compass gate — a localhost proxy that hard-caps spend for Codex, Gemini, and any SDK, not just Claude Code. The budget wall for every agent.
compass audit-plugin — vet a third-party plugin or marketplace (injection · tool-poisoning · unpinned MCP · fetch-and-execute hooks) before you install it.
onboard · impact · drift · scan · redteam · audit-plugin · gate · sandbox · verify · spend · dashboard
11-using →Claude Code · Codex · Gemini — plus Cursor/Windsurf/Copilot via the AGENTS.md standard.
12-every-agent →Every source outside the boundary — a pasted prompt, a fetched page, an MCP tool result, a cloned repo's CLAUDE.md — is decoded, normalized, and scored before it can steer the agent.
The cardinal rule holds underneath it all: external content is data, not instructions — and the human gate is what actually protects you.
CLAUDE.md · AGENTS.md · GEMINI.md are one file. A git pull updates them all at once.
plugin + marketplace
plugin · AGENTS.md
extension · GEMINI.md
AGENTS.md standard
All reversible, version-pinnable, no curl | sh. You need an AI assistant + git. No API keys for the guardrails, crew & CLI.
Own & edit your config — recommended. Previews every change, asks first, fully reversible.
git clone https://github.com/dshakes/compass ~/compass && cd ~/compass./quickstart.shManaged & versioned via Homebrew.
brew install dshakes/tap/compasscompass quickstartcompass quickstartNo terminal — ideal for a team. Run these inside Claude Code.
/plugin marketplace add dshakes/compass/plugin install core@compassFull control — preview, install, validate.
make dry-runmake install && make doctorAgents prepare; humans push, merge, deploy. Required checks + code-owner approval enforce it.
No curl | sh. The installer backs up what it replaces; make uninstall removes only what it added. Pin a tag, not main.
They reduce footguns. Keep least-privilege creds and review diffs. For untrusted code, compass sandbox is a real boundary.
No telemetry. Pinned MCP servers reach only the endpoints you'd expect; hooks are short, commented shell scripts you can disable.
Install once. Feel it in a minute — ask for a dangerous command (blocked), run /review on your diff, or route a task. No tokens, no signup.
git clone https://github.com/dshakes/compass ~/compass && cd ~/compass && ./quickstart.sh