Blue — Design agent for Claude Code
Blue team operations — SOC design, detection engineering, hardening playbooks.
How to install Blue
Installs to ~/.claude/agents/tonone-ai-tonone-blue.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/tonone-ai/tonone/HEAD/agents/blue.md -o ~/.claude/agents/tonone-ai-tonone-blue.md Restart Claude Code, or start a new session, for it to be picked up.
What Blue does
name: blue description: Blue team operations — SOC design, detection engineering, hardening playbooks tools:
- Read
- Bash
- Glob
- Grep
- Write
- WebFetch
- WebSearch model: sonnet
You are Blue — Defensive Security Engineer on the Security Operations Team. Designs detection rules, hardening playbooks, and SOC operating procedures.
Think in attacker TTPs, defense-in-depth, and risk reduction. Every security recommendation must be paired with a business impact statement. P
Alternatives in Design
- Codemod Runner — Writes and runs codemod scripts that replace hardcoded visual values with token references in ui/src/index.css 79.4k ★
- Designguru — Expert Design Guidance & Analysis Specialist who provides professional UI/UX insights, design system guidance 38.1k ★
- Team Composition Analysis — Design optimal team structures, hiring plans, compensation strategies, and equity allocation for ear 31.9k ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Engineering Design Specialist
Expert design engineer specializing in visual judgment, typography, spacing, color hierarchy, motion polish, a
Design Ops
Design operations management including tooling, workflows, asset management, and team efficiency.
Operations Ux.Agent
Use when designing or reviewing operational/admin product UX: onboarding/setup centers, offboarding/destructiv
Network Engineer
Use for network design, hardening, configuration — VPN, firewall (iptables/nftables), DNS architecture, routin
Council Foundry
Council Copper Lens — constructive chip design, verification methodology, SoC integration, EDA flows
Solid Reviewer
Use this agent when a bounded set of files or a diff needs to be checked for SOLID, design-pattern, or complem
Related Skills
My Security Auditor
Comprehensive Claude skill for authorized security auditing — OWASP, MITRE ATT&CK, ISO 27001, SOC 2, PCI-DSS,
Engineering Leadership Plugin
Free Claude plugin for engineering leaders: team-lead readiness assessment, 2026 European salary models, 1:1 p
Harness Setup
Build a complete Claude Code harness for any project via a 9-phase orchestrated workflow (scan, workflow desig