Content
<div align="center">
# Panoply
***panoply*** *(n.) — a complete and impressive collection.*
**Slash commands and MCP servers for AI agents, written once and compiled everywhere.**
One canonical source compiles out to Claude Code, opencode, Cursor, or plain copy-paste. Twelve commands today — a code review that files its own issues, a spec that survives a compacted context, a repo map that stops re-reading the tree, a debug loop that keeps a ledger, plus onboarding, handoffs, commits, test generation, and CI fixes — and room for whatever you add next.
[](LICENSE)
[](https://github.com/fordaaaa/panoply/stargazers)
</div>
---
## Contents
- [Install](#install)
- [What you get](#what-you-get)
- [What it won't do](#what-it-wont-do)
- [Configuration](#configuration)
- [MCP servers](#mcp-servers)
- [Agents](#agents)
- [Skills](#skills)
- [Contributing](#contributing)
## Install
```bash
npx panoply init --global # every project on the machine
```
Or `npx panoply init` inside one project to scope it there. Either way it detects Claude Code, opencode, or Cursor, installs there, never overwrites a command you wrote yourself, and **configures nothing by default** — everything starts in local mode.
In Claude Code you can install as an updatable plugin instead:
```
/plugin marketplace add fordaaaa/panoply
/plugin install panoply@panoply
```
Using something else? Open [`prompts/`](prompts/), copy a file, replace `{{ARGUMENTS}}`, paste it in.
## What you get
```
> /cr-run standard
Reviewing 84 files with 3 subagents (correctness · performance · security).
Estimated ~180k input tokens. Continue? y
🔴 src/auth/session.ts:142 Session token compared with ==, not timing-safe
→ use crypto.timingSafeEqual
🟠 src/api/upload.ts:67 Unbounded read into memory; 2GB upload OOMs the worker
→ stream to disk, cap at configured limit
🟡 src/db/pool.ts:23 Pool never drained on SIGTERM; deploys drop in-flight queries
Verified 3 of 5 reported — dropped 2 I couldn't confirm at the cited line.
Local mode: nothing filed. Want me to fix any of these, or start filing?
```
### Review
| Command | What it does | What it leaves behind |
|:--|:--|:--|
| **`/cr-run`** `[quick\|standard\|deep]` | Parallel read-only subagents review your code. Every finding is re-verified against the actual file before it survives. | GitHub issues, or an on-screen report |
| **`/cr-fix`** `<issue#…\|all>` | Fixes filed issues on one branch, proves the fix by running it, opens a PR. **This one edits code.** | a branch, commits, a PR |
### Plan, verify, debug
| Command | What it does | What it leaves behind |
|:--|:--|:--|
| **`/map`** `[refresh]` | Parallel subagents map the repo once, stamped with the commit. Refreshes only what moved. | `.panoply/map.md` |
| **`/spec`** `[what you want \| resume]` | Turns a request into acceptance criteria + a checklist, then works it one task at a time, ticking boxes on disk. | `.panoply/specs/<slug>.md` |
| **`/verify`** `[spec-slug \| diff]` | Grades the diff against criteria written *before* the work, with four parallel checkers. Runs the suite itself. | a verdict in the spec |
| **`/debug`** `[symptom]` | Every hypothesis gets a falsifying experiment and a recorded result. Nothing is tested twice. | `.panoply/debug/<slug>.md` |
| **`/prompt`** `[what you want]` | Compiles a half-formed request into a structured prompt + plan. Runs on the cheapest model, so it costs ~nothing. | a prompt you can edit |
### Ship
| Command | What it does | What it leaves behind |
|:--|:--|:--|
| **`/commit`** `[<files…>]` | Verifies the diff with the repo's own checks, then commits on the current branch. Never pushes. | a local commit |
| **`/test-gen`** `[<files…>\|diff]` | Finds changed lines with no coverage, generates tests in the repo's framework, proves them green. | new test files |
| **`/ci-fix`** `[<run-id\|pr>]` | Pulls the failing Actions logs, reproduces locally, fixes minimally. Never touches workflows. | uncommitted fix |
### Orient
| Command | What it does | What it leaves behind |
|:--|:--|:--|
| **`/onboard`** `[<path>]` | Lands in an unfamiliar repo, reuses `/map`, detects the real stack, records verified build/test commands. | `.panoply/onboard.md` |
| **`/handoff`** `[save\|resume\|status]` | Snapshots branch, diff, open items, and next actions so a compacted session resumes clean. | `.panoply/handoff.md` |
**The idea:** the repo is the memory; context is disposable. Every command writes or reads a durable artifact, so nothing dies when context compacts or you switch tools. They compose through files (`/map` → `/spec` → `/verify`, `/cr-run` → `/cr-fix`) and still work standalone.
**Make it yours:** drop a markdown file in `commands/` (or `agents/`, or `skills/`), run `node build.mjs`, and it exists in every agent. The bar in [CONTRIBUTING.md](CONTRIBUTING.md): each addition must beat a plain prompt through *structure* — parallel subagents, a durable artifact, a verification loop, or a cheaper model.
## What it won't do
Worth knowing before you install something that can open pull requests.
- **Won't merge without earning it.** `autoclose` defaults off; even on, five conditions must hold at once. Never passes `--admin`.
- **Won't treat your repo as instructions.** Issue bodies and source text are data; fixes never touch CI config, workflows, lockfiles, or credentials.
- **Won't publish your vulnerabilities.** Security findings stay on screen, with an offer of a private advisory.
- **Won't spend without asking.** `/cr-run deep` prints a cost estimate and waits — and above 1500 files it refuses outright rather than taking a bare "yes".
- **Won't assume.** Not tests, not `main`, not a clean tree, not where `gh` points.
Findings carry a severity (🔴 Critical · 🟠 High · 🟡 Medium · 🟢 Low · ⚪ Trivial). Subagents self-score confidence 1–10 and report only 8+; every cited `file:line` is re-checked and unconfirmable findings dropped.
## Configuration
Two questions, asked the first time you want something filed, saved to `.panoply/config.md` (`filing: local | high-only | all`, `autoclose: off | on`). Until then everything runs in local mode: report only, nothing filed, committed, or pushed. Say *"reconfigure"* or edit the file to change it.
## MCP servers
| Server | Profile | Why it's here |
|:--|:--|:--|
| `github` | default | Files issues and opens PRs. Pinned to `issues,pull_requests,repos` (~5–7k tokens vs ~15–25k unpinned). `gh` is the supported fallback. |
| `context7` | default | Version-accurate library docs — stops `/cr-fix` inventing APIs (~400 tokens). |
| `playwright` | default | Drives a real browser so `/verify` can confirm a UI renders (or hooks into live Chrome/Edge via `PANOPLY_BROWSER_CDP`). |
| `gh-cli` | opt-in | Full `gh` surface the default server lacks: Actions, Releases, **Projects v2**, labels, search, plus a raw passthrough. Reuses your `gh auth` session. |
| `opencode-bridge` | opt-in | Delegates prompts to your local `opencode` CLI (`ask_opencode`, `list_opencode_models`, `zen_chat`) on your own login and quota. |
| `brig` | opt-in | Deterministic code-graph index so agents fetch exact slices instead of reading files. Needs your brig checkout path. |
| `showcase` / `caveman` | opt-in | Session screen-recordings / measured usage signal for the compression hook. |
Opt-ins pull in with `npx panoply init --with <name>`. Everything comes from [`mcp/servers.json`](mcp/servers.json), rendered into `.mcp.json`, `.cursor/mcp.json`, and `opencode.json`. The GitHub server authenticates via `GITHUB_MCP_TOKEN` — see [`docs/mcp-auth.md`](docs/mcp-auth.md) (or skip it and just use `gh`).
## Agents
opencode-only (Claude Code/Cursor have no equivalent): `plan` investigates read-only and writes a plan file; `build` executes it 1–2 files at a time with green tests and receipt lines. Sourced from `agents/*.md`, rendered into `opencode.json`'s `agent` block without touching agents you defined yourself. Starting template for your own repos: [`templates/AGENTS.md`](templates/AGENTS.md).
## Skills
Claude Code only (opencode/Cursor have no equivalent) — sourced from `skills/*/SKILL.md`, rendered to `.claude/skills/`.
| Skill | What it does |
|:--|:--|
| `polyglot` | Detects the stack in the touched files and names the right build/test/lint commands. Ends verification with a checkable `[polyglot: …]` line. |
| `caveman` | Compresses subagent and scratch output to a dense register to cut tokens. Self-reports an estimated reduction so the claim is checkable. |
| `brig-investigator` / `brig-builder` / `brig-reviewer` | Index-first investigate → plan-only execution → diff-vs-plan review, each with a checkable output format. |
## Running in CI / AWS
- **CI:** [`templates/github-workflows/panoply-review.yml`](templates/github-workflows/panoply-review.yml) runs `/cr-run` on every PR (never `/cr-fix`). Setup and cost notes in [`docs/ci-trigger.md`](docs/ci-trigger.md).
- **AWS:** [`templates/docker-compose.floci.yml`](templates/docker-compose.floci.yml) gives `/verify` and `/cr-fix` a local AWS emulator instead of skipping cloud paths as N/A. See [`docs/aws-testing.md`](docs/aws-testing.md).
## Contributing
Edit **`commands/`**, **`skills/`**, **`agents/`**, and **`mcp/servers.json`** only; everything else is generated by `node build.mjs`. See [CONTRIBUTING.md](CONTRIBUTING.md) for the house style.
```
commands/ ← the files you edit
├── _bootstrap.md ← shared partials, pulled in via {{INCLUDE:_name.md}}
├── _preflight.md
├── _severity.md
├── _untrusted.md
└── cr-run.md, cr-fix.md ← review
map.md, spec.md, verify.md, ← plan, verify, debug
debug.md, prompt.md
commit.md, test-gen.md, ← ship
ci-fix.md
onboard.md, handoff.md ← orient
skills/*/SKILL.md ← Claude-Code-only, no opencode/Cursor equivalent
(caveman, polyglot)
agents/*.md ← opencode-only, rendered into opencode.json's agent block
(plan, build)
│
│ node build.mjs
▼
.claude/commands/ .opencode/commands/ .cursor/commands/ prompts/
.claude/skills/
.mcp.json opencode.json .cursor/mcp.json
```
## Credits
The parallel-subagent review structure and the severity/confidence scoring grew out of Anthropic's MIT-licensed [`claude-code-security-review`](https://github.com/anthropics/claude-code-security-review).
<div align="center">
<br>
**MIT** · [Changelog](CHANGELOG.md) · [Report an issue](https://github.com/fordaaaa/panoply/issues) · ⭐ if it saved you a code review
</div>
Connection Info
You Might Also Like
No recommendations available