halilneed
TREN

Tools for coding agents

Claude Code, Codex CLI and Gemini CLI already write every session to your disk. Five of these six plugins read those logs and report what happened, with no network calls. The sixth, painradar, reads public complaints on the web.

Plugins
6
Commands
18, three per plugin
Rules and checks
78, all in files you can open (26 in agent-blackbox, 26 in skillbench, 16 in scar, 10 in gardener)
Network calls
none in five of the six
Licence
MIT

The six plugins

What each plugin reports, its commands and its network use
Plugin What it reports Commands Network Source
agent-blackbox What the agent did, turn by turn, and what can still be undone timeline, risk, undo none GitHub
skillbench Whether a skill is written correctly and whether it ever fires lint, coverage, collide none GitHub
scar Failures that repeat across sessions, a rule or test for each, and whether it held mine, write, verify none GitHub
gardener What CLAUDE.md and its imports cost on every request audit, compliance, prune none GitHub
painradar Public complaints and verified revenue, grouped into themes with links scan, fit, launch public sources only GitHub
devpersona A developer profile built from your own agent history stats, analyze, advise none GitHub

Install

# once
> /plugin marketplace add halilneed/plugins

# then whichever you want
> /plugin install agent-blackbox@hailneed
> /plugin install skillbench@hailneed
> /plugin install scar@hailneed
> /plugin install gardener@hailneed
> /plugin install painradar@hailneed
> /plugin install devpersona@hailneed

# and try it
> /agent-blackbox:risk

The marketplace id is hailneed, which is why the install lines end in @hailneed.

Claude Code keys marketplaces by name, so a manifest shipped inside every plugin repo would overwrite the last one and the plugins could not coexist. A single manifest repository removes the clash. halilneed/plugins contains only that manifest.

  • Claude Code and Node.js 18 or newer.
  • No dependencies, no build step, no API key.
  • Each scanner also runs standalone. In the agent-blackbox repo: node scripts/blackbox.mjs --scan --days 30 --md
  • Optional, for painradar: GITHUB_TOKEN raises search limits and TRUSTMRR_API_KEY unlocks verified revenue.

How they are built

  1. Every finding cites its source. Reports name the transcript, the rule and the matched text, so each finding can be checked against the log.
  2. The scanners read local files. The data is already on your disk. The agent-blackbox scanner makes no network calls, and it masks anything shaped like a credential before a report is written.
  3. The rules are in files you can open. Risk classification is a list of patterns, with no model involved, and any rule can be switched off with a flag.
  4. Failures are reported. When a source is unreachable or a log will not parse, the report says so in its source note.

Cost

All six plugins are free and MIT-licensed, including for commercial use. Nothing is gated behind an account or a paid tier. painradar takes two optional keys of your own.

A hosted version for teams, called Cloud, is planned: session history that survives a machine swap, risk reports across a team, and trend lines that need more than a week of logs. It will be paid. The local plugins will keep working without it. To hear when it exists, subscribe on the writing page.

Questions

Are they free, or free for now?

Free. Every repo is published under MIT, and that cannot be taken back from a release that already exists. The worst case for you is a fork of the last good commit. The paid product will be Cloud, a separate hosted service, and the local plugins will keep working without it.

What is Cloud, and will it be paid?

Cloud is the hosted version, still being designed: session history that survives a machine swap, risk reports across a whole team instead of one laptop, and trend lines that need more than one week of logs. It will be paid, in single digits a month. To hear when it ships, subscribe on the writing page.

Does anything leave my machine?

Five of the six make no network calls at all. They read logs your agent already wrote to your disk, and agent-blackbox masks anything shaped like a credential before a report is written. The sixth, painradar, has to reach the public web to do its job, and its page says which sources it hits. There is no telemetry in any of them.

Can I use these at work, commercially?

Yes. MIT, including inside closed-source products and paid consulting work. Keep the licence file; there is nothing else to ask for and nobody to email.

Which agents can they read?

Claude Code, Codex CLI and Gemini CLI, since all three write their sessions to disk in a readable format. The plugins are packaged for Claude Code. The five log-reading scanners are also plain Node scripts that run without the plugin and read the other two agents as well, for example node scripts/blackbox.mjs in the agent-blackbox repo.

Other repositories

  • agentmemora
    A local dashboard that reads session transcripts, auto-memory and instruction files to show what your agents know, flag context at risk, and move context between sessions, machines and agents. On npm.
  • solostacks
    An MCP server that pulls live data from Reddit, GitHub Trending and Hacker News and recommends tools for solo developers.
  • hyperframes-agent-skill
    19 rule files that teach a coding agent to write correct HyperFrames (HTML-to-video) compositions.
  • promptrank
    A small browser quiz with five prompt scenarios, scored on clarity, creativity, technical depth and strategy. In Turkish, English and Spanish.
  • plugins
    The manifest that makes the six plugins installable side by side.