Auditing ECC: 68 Agents, 293 Skills, and the 43 Kiro Copies Frozen Five Releases Ago

Sun, 04 Oct 2026 00:00:00 +0000

affaan-m/ECC is the largest agent-harness project to come out of 2026. It calls itself “the agent harness performance optimization system” and promises skills, instincts, memory, security and research-first development across Claude Code, Codex, OpenCode, Cursor, Gemini, Zed and a dozen other tools.

The numbers are not small. 272,248 stars, 40,652 forks, 371 contributors, 3,043 commits and 19 releases since the repository was created on 18 January 2026 — an average of 1,051 stars per day and 20 commits per day in the last week, 93 of the newest 100 commits from the maintainer alone. Its npm package has been downloaded 42,491 times in the last 30 days, and its separate security auditor, ecc-agentshield, 46,012 times — the scanner out-downloads the toolkit.

Auditing cursor/plugins: 96 Official Plugins, 9,320 Stars, 2.4% Config — and a CI Gate That Passed an Inline `curl | bash` Hook

Fri, 02 Oct 2026 00:00:00 +0000

Cursor’s plugin ecosystem lives in one repository: cursor/plugins, “Official Cursor plugins for popular developer tools, frameworks, and SaaS products.” I cloned it at commit 2eb7ed46 on 1 October 2026 and measured everything I could measure — every manifest, every mcp.json, every hook script, every licence file, and its own validation gate, which I ran locally and then deliberately attacked with four mutations. Some of what came back is normal for a young monorepo. Some of it is worth knowing before you click Install.

Here is the headline set: 96 plugins, 887 files, 6,381,913 bytes (6.09 MiB) excluding .git — of which 65.5% is images, 19.2% markdown and 2.4% JSON. 80 of the 96 plugins are remote MCP integrations to third-party SaaS vendors on 70 distinct hosts. The repository has 9,320 stars, 883 forks, 41 watchers, 433 commits and a stated MIT licence with no LICENSE file at its root (GitHub’s API reports license: null).

MCP Servers on SoloSoft

Auditing ECC: 68 Agents, 293 Skills, and the 43 Kiro Copies Frozen Five Releases Ago

Auditing cursor/plugins: 96 Official Plugins, 9,320 Stars, 2.4% Config — and a CI Gate That Passed an Inline `curl | bash` Hook