ECC

ECC ("Everything Claude Code") is an open-source collection of skills, agents, hooks, slash commands and rules for AI coding harnesses (Claude Code, Codex, Cursor, OpenCode) — packaged so a team doesn't have to write its own planning/review/testing/memory scaffolding from scratch. The core repo (github.com/affaan-m/ECC) is MIT-licensed, created 2026-01-18 and pushed to multiple times daily as of this check (last push 2026-08-19). It has 241,305 stars, 36,583 forks and 144 open issues, with commit activity, dependabot updates and a real multi-contributor issue tracker (source: https://api.github.com/repos/affaan-m/ECC, https://github.com/affaan-m/ECC/issues). ecc.tools is the hosted layer: a GitHub App that turns the same analysis into PRs and PR-triggered audits, with a paid tier for private repos.

A single-maintainer repo picking up 200k+ stars in seven months invites suspicion, so this was checked rather than taken on faith. Commit history shows activity multiple times per day up to the day of this check, releases progress on a real semver cadence (v1.9.0 in March, v2.0.0 in May/June, v2.1.0 in July 2026), there are 10+ non-bot contributors beyond the maintainer, and open issues describe specific, technical bugs (npm 12 compatibility, plugin install failures, frontmatter generation) rather than generic engagement bait (sources: https://api.github.com/repos/affaan-m/ECC/releases, https://api.github.com/repos/affaan-m/ECC/contributors, https://api.github.com/repos/affaan-m/ECC/issues). The two published npm packages also show real independent usage: ecc-universal had 16,884 downloads and ecc-agentshield 28,976 downloads in the 30 days to 2026-08-19 (source: https://api.npmjs.org/downloads/point/last-month/ecc-universal and /ecc-agentshield) — usage that npm download counts can't fake the way stars can.

A third-party security audit (published on DEV Community, whose author reviewed the repo directly) found no phone-home or exfiltration in the default install and concluded the official repo is not malicious. It also flagged architectural risk rather than malice: ECC registers roughly 28 command hooks across 7 lifecycle events that run automatically on nearly every Claude action, installed globally so they affect all sessions on a machine; it ships around 513 auto-loadable instruction files (skills/agents/commands/rules), which the auditor treats as a large prompt-injection surface; and updates happen via plain git pull with no commit-signature or version pinning (source: https://dev.to/joergmichno/we-audited-the-viral-213k-star-everything-claude-code-repo-and-found-a-malware-clone-in-the-wild-14hb). Separately, the same audit found a malicious clone circulating under an unrelated GitHub account (arabicapp/everything-claude-code) that replaces the real project with a page urging non-technical users to download and double-click a ZIP containing an obfuscated LuaJIT infostealer — not part of the real project, but a real risk for anyone who lands on the wrong repo. The project's own README carries an explicit warning to install only from github.com/affaan-m/ECC, the official npm packages, the GitHub App, or ecc.tools, and to treat any other mirror as unreviewed (source: https://github.com/affaan-m/ECC).

The OSS project itself is free forever (MIT licence, self-hosted). ecc.tools, the hosted GitHub App layer, has three tiers, all with real numbers published on the pricing page: Free ($0) covers public-repo analysis only, 10 analyses/month, 200 commits per run; Pro is $19 per active developer seat per month ($190/year), pooled at 50 analyses per seat with optional metered overage, unlocks private repos, PR-triggered audits, AgentShield scanning and 1,000 commits per run; Enterprise is quote-based with unlimited analyses, SSO/audit-log support and custom policy packs (source: https://ecc.tools/pricing). Billing is handled via GitHub identity + Stripe, with self-serve cancel-anytime — there's no separate ECC account system.

Independent commentary (Medium, Augment Code, an AI-news aggregator) is not unanimous. The most consistent criticism is over-engineering — commentators point to a large internal test suite and an orchestration layer that exceeds what most teams need for what is, at heart, a set of prompt/config files. Coverage also notes the project has grown almost entirely through organic star velocity (reported at roughly 1,250 stars/day at points) with limited mainstream press coverage, which is unusual for a project this size and worth knowing rather than treating the star count alone as a proxy for maturity.