ECC setup + deliver client projects faster and safer

ECC, short for Everything Claude Code, is made by Affaan Mustafa. It is MIT licensed and had 297,762 stars on GitHub on 6 November 2026. The README says he won the Anthropic x Forum Ventures hackathon in September 2025, and that a single maintainer ships it weekly.

Install it once. Make every client project run the same loop.

If you build apps for clients, the risky parts are always the same: no clear plan, no tests, nobody reviewing the code, and a security check you forgot. ECC puts those steps inside your agent, so they happen on every project, not only when you remember.

Read this guide: https://codewithnishant.dev/free/ecc-client-projects-faster-safer/ and the official ECC README at https://github.com/affaan-m/ECC. Help me install ECC into my Claude Code and run it once on a project of mine. First check that I have Claude Code 2.1 or newer, and Node.js 18 or newer and Git if I choose the guided setup. Check whether ECC is already installed so we do not stack two install methods. Then use the README's native plugin commands, /plugin marketplace add https://github.com/affaan-m/ECC and /plugin install ecc@ecc, or the guided setup, and confirm it with /plugin list ecc@ecc. Install only from the official affaan-m/ECC sources. Then run /ecc:plan on one small feature in this project and stop for my approval of the plan before any code is written. Do not change other files and do not touch client secrets. Tell me what is not working instead of guessing.

01. What ECC is

The README describes it as a coordinated engineering system for your agent, built around one loop: plan, test, implement, review, verify, remember, improve.

The reel called it Everything Claude Code. The README now uses ECC, and says older posts may show the former long name as a legacy alias.

The parts you will use on client work:

• Agents are scoped helpers with their own context: a planner, a tdd-guide, a code-reviewer, a security-reviewer and many more.
• Skills are reusable workflows like TDD, loaded only when the task needs them.
• Hooks are scripts that run on agent events, outside the model, for checks that should not depend on a reminder.
• Rules are standards that are always loaded, so you pick only the packs you need.
• Memory and instincts turn what keeps working into reusable skills over time.

02. Before you install

From the README's install section and requirements:

• Claude Code 2.1 or newer. Check with claude --version.
• Node.js 18 or newer and Git, for the guided setup.
• One install method per tool. The README says: "Do not stack install methods." Installing twice into the same tool can duplicate skills, commands and hooks.
• Official sources only: the affaan-m/ECC repository, the ecc@ecc plugin and the ecc-universal npm package. Re-uploads and look-alike repos are not the project.

ECC runs hooks and scripts on your machine, and the README itself says to treat hooks and MCP servers as executable configuration. Read what the installer will do before you confirm.

03. Install ECC

Two ways in Claude Code, pick one

Way A: two commands inside Claude Code

This is the install the reel showed. From the README's Claude Code details, run these inside Claude Code:

/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc

The README says this native path installs ECC's skills, agents, commands and plugin-managed hooks, and that if you choose it you should stop there and not add a manual install on top. If Claude Code reports that a marketplace, plugin or scope already exists, use the guided setup below instead of forcing it.

Way B: the guided setup (the README's recommended default)

Run this in your terminal:

npx [email protected] setup

The README says the wizard checks your existing ECC installs first, then installs, updates or moves ecc@ecc to the scope you choose. For a typical personal setup it suggests the Global user scope with Standard hooks. Run the same command again any time to update or change scope. The version in the command was current on 6 November 2026, so check the README for a newer one.

Check it worked

Start a new Claude Code session and run:

/plugin list ecc@ecc

You should see ecc@ecc enabled. For a fully custom or lower-context setup, the README documents a no-hooks profile and choosing single components.

Rules: add only what you need

Claude Code plugins cannot ship rules, so the README has you copy them yourself. Start with the common pack plus one pack for your stack:

git clone https://github.com/affaan-m/ECC.git
cd ECC
mkdir -p ~/.claude/rules/ecc
cp -R rules/common ~/.claude/rules/ecc/
cp -R rules/typescript ~/.claude/rules/ecc/  # replace with your stack

Rules are always loaded, so every extra pack costs context in every session. The README says to start small.

Using Codex instead?

The README lists a native Codex plugin path:

codex plugin marketplace add affaan-m/ECC
codex plugin add ecc@ecc

Claude Code and Codex can both have ECC at the same time, as long as each tool gets one install method.

Undo or reset

If you stacked methods or things look duplicated, the README's reset section gives the commands, run from the project folder you installed from:

npx [email protected] list-installed
npx [email protected] doctor
npx [email protected] uninstall --dry-run

04. The client project loop

This is how I would map the README's own workflow onto client work. The commands and skills come from its Start Using ECC table.

The README describes the result as a trail of evidence: the plan, the failing test, the passing test, the review findings and the final verification. That trail is the thing worth showing a client.

05. Faster: plan and test first

Steps 1 and 2 on a real client job

Step 1: Plan before you build

1. Write the client's request in plain words, with what is in and out of scope.
2. Run /ecc:plan "..." with that request. The planner agent writes the implementation blueprint.
3. Edit the plan, then confirm it. The README's flow has you confirm or edit the plan before any implementation starts.
4. Use the same plan to agree scope and timeline with the client, so surprises show up before you build, not after.

This is where the time is saved in practice: a clear plan means fewer rewrites. How much it saves depends on your project, and the README gives no measured number, so I will not invent one.

Step 2: Tests before code

1. Activate the tdd-workflow skill. The README says its tdd-guide agent enforces write-tests-first.
2. The loop is: define the interface, write a failing test (RED), write the minimum code to pass (GREEN), then clean up (IMPROVE).
3. For a bug in a client app, the README's order is: write a failing test that reproduces it, fix it, check the test passes, then run a review.

Each client feature then carries its own test. When the client asks for a change next month, those tests tell you what you broke. For a plain-language version of this idea, read my Red/Green TDD for AI coding prompts guide.

06. Safer: review and security

Steps 3 to 5, before you hand anything over

Step 3: A reviewer that did not write the code

Run /code-review. The README says it does a fresh-context review, because "the same context writes and reviews the code" is one of the problems ECC is built to fix. Fix the findings, and add a regression test for each real bug it finds. Then read the diff yourself. An AI reviewer is a second pair of eyes, not a replacement for yours.

Step 4: The security scan

The README's "Preparing for production" flow runs /security-scan, handled by the security-reviewer agent, for an OWASP Top 10 audit. It also lists e2e-testing for critical user flows and /test-coverage to check coverage.

Two things to know from the README:

• AgentShield scans your agent setup, not only your app: CLAUDE.md, settings, MCP configs, hooks, agent definitions and skills, for secrets, permissions and injection risks.
• It needs a scanner you have reviewed. The README says to use /security-scan with a reviewed scanner, or an installed agentshield scan --path ., and it documents where the official package comes from. Do not run a scanner you have not checked.

For the things a scan cannot see, pair it with my vibe coding safety checklist and 30 security holes your AI never checks.

Step 5: Verify, then hand over

1. Run the build, lint, type check and tests yourself. The README's TDD flow ends with this step.
2. Write a short handover note: what was built, how it was tested, what was reviewed, what the security scan covered, what is not covered.
3. Offer an ongoing check after launch. Apps change every week, and new features bring new holes.

New to finding clients? Start with my first client playbook. Once you have a client, a repeatable loop like this is what lets you take on a second and third one without dropping quality.

07. Where it goes wrong

• Stacking installs. Native plugin plus a full manual install can double your skills and hooks. One method per tool.
• Installing everything. Rules are always loaded and eat context. Start with rules/common plus one pack, and add more only when you miss them.
• Hooks twice. After a plugin install, do not copy hooks/hooks.json into your settings by hand. Modern Claude Code loads plugin hooks itself.
• Trusting the review blindly. The agents can be wrong. Read the diff, run the app, test it yourself.
• Client secrets and contracts. Keep keys and client credentials out of prompts, and check your client contract before their code goes through any AI tool.
• Windows limits. The README lists open issues for continuous learning and memory writes on native Windows. Check its platform table first.
• Expecting the same in every editor. Cursor, OpenCode, Gemini and the others are capability-limited adapters. Check the README's support matrix.
• Old install commands. The README changes often. Check the install section again before you copy a version number.

08. Copyable prompts

1. Plan a client feature

/ecc:plan "Client request: [paste it in plain words]. In scope: [list]. Out of scope: [list]. Stack: [your stack]. Give me the blueprint, the tests you would write first, the risks, and what I should confirm with the client before we start."

2. Tests first for the feature

Use the tdd-workflow skill for the approved plan. Write the failing tests first and show me they fail. Then write the minimum code to pass, show me they pass, and stop before refactoring so I can check the diff.

3. Pre-handover review

/code-review Review everything changed for this client project from a fresh context. List bugs, missing tests, and anything a senior engineer would block. Do not edit files, only report.

4. Security pass

/security-scan Check this project against the OWASP Top 10, and check for secrets in the code and config. Give each finding a severity, where it is, and the fix. Mark anything you could not check.

5. Client handover note

Write a one-page handover note for the client in plain words. Include: what was built, how it was tested, what the review found and fixed, what the security scan covered and what it did not cover, and what to watch after launch. Do not claim anything that was not actually checked.

FAQ

What is ECC?

ECC, short for Everything Claude Code, is a free, open source plugin by Affaan Mustafa. It gives Claude Code and other coding agents 71 agents, 314 skills and 98 legacy command shims, plus hooks, rules, memory and a security scanner called AgentShield, so the agent plans before it builds, writes tests, reviews its own work from a fresh context and checks security.

Is ECC free?

Yes. The repository is MIT licensed and the README says it stays free. ECC Pro is a separate paid hosted GitHub App for private repositories, and you do not need it to use the plugin. You still pay for your own Claude Code plan or API use.

How do I install ECC in Claude Code?

Inside Claude Code run /plugin marketplace add https://github.com/affaan-m/ECC and then /plugin install ecc@ecc. The README also recommends a guided setup, npx [email protected] setup. Pick one method only and do not stack installs.

What do I need to run ECC?

Claude Code 2.1 or newer. The guided setup also needs Node.js 18 or newer and Git.

Does ECC work with Codex, Cursor and other tools?

It works best with Claude Code. It has native plugin paths for Codex and Qoder, and capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot and others. The README tells you to check its support matrix before assuming every feature works everywhere.

How does ECC help me deliver client projects faster?

It turns each project into the same repeatable loop: plan the work first, write tests before code, get a fresh-context review, run a security scan and verify the build. A clear plan up front helps you scope the job, and the tests and review notes give you a record to hand the client. The speed gain depends on your project, and this guide does not claim a measured number.

Does ECC make client code safe?

No tool does that on its own. ECC adds a security review step based on the OWASP Top 10 and a scanner for your agent setup, which catch common problems. You still read what the agents change, test the app yourself and follow your client contract.

Is it safe to install ECC?

ECC runs hooks and scripts on your machine, so treat it like any code you install. Use only the official sources the README lists: the affaan-m/ECC repository, the ecc@ecc plugin and the ecc-universal package. Look at what it will install before you confirm, and install only what you need.

What I checked, and what I did not

On 6 November 2026 I read the official README and checked the repo on the GitHub API: 297,762 stars, 44,030 forks, MIT, last push 2 November 2026. Every command and number above comes from the README. I did not install or run ECC myself, so the setup steps are the maker's, not a test of mine. The README changes often, so check it again before you install. Thanks to Affaan Mustafa for building it in the open.

One loop for every client project: plan it, test it, review it, scan it, then hand it over.