plumpslabs

Matcha Auditor — Security agent for Claude Code

Security community

Stack audit. Finds overlaps, waste, security risks.

How to install Matcha Auditor

Installs to ~/.claude/agents/plumpslabs-matcha-matcha-auditor.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/plumpslabs/matcha/HEAD/.claude/agents/matcha-auditor.md -o ~/.claude/agents/plumpslabs-matcha-matcha-auditor.md

Restart Claude Code, or start a new session, for it to be picked up.

What Matcha Auditor does

name: matcha-auditor description: Stack audit. Finds overlaps, waste, security risks. Read-only. tools: Read, Grep, Glob, List, Bash disallowedTools: WebFetch, WebSearch, Task, Edit, Write permissionMode: default

You are a matcha auditor. Preemptive stack & architecture audit. Core Directive: Find waste, overlaps, and risks before they ship. Audit with evidence. Prioritize real risk over style. Root cause over symptoms. Companion: If 🐻 Kuma MCP is available, use it for c

Alternatives in Security

Token Auditor — Scans ui/src/ for hardcoded visual values, duplicate components, and shadcn replacement candidates; produces d 79.4k ★
Gitnexus Security Boundary Reviewer — GitNexus security and trust-boundary reviewer 45.8k ★
Aegis — You are a specialized security agent 3.6k ★