alex2481kobe

Orca — Security skill for Claude Code

Security community

A local harness for the coding agents you already run: let Claude Code or Codex spawn and depend on subagents over MCP, with governed lanes, git-worktree isolation, an audit gate, and a private phone.

How to install Orca

This entry records only its repository, not the path inside it, so there is no exact command to give. Open alex2481kobe/orca and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Orca does

Alternatives in Security

Agent Memory Vault — Markdown-first shared memory vault for Claude Code and Codex with SQLite, Zvec, Git, closeout, and audit 314 ★
Security Health Check — Execute the security-health-inline skill for inline orchestration 172 ★
Public Skills Builder — Generate Claude Code bug bounty skills from public HackerOne reports and GitHub writeups — 18 vuln classes, no 155 ★

README

Orca

A local harness that lets the coding agents you already run spawn and depend on each other — and watch them from your phone.

Orca is a **local daemon**. It ships **no agent, no model, no API keys, and no chat UI**. You keep working in Claude Code, Codex, or any MCP-capable agent; Orca is the harness those agents register with so one of them can reliably **spawn a subagent, wait on it, and judge the result** — instead of you babysitting terminals.

[![license: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)

The Orca dashboard: a live node graph of orchestrator agents and their executor subagents

Status: in development, deliberately scaled back

Orca was built out **too aggressively before it was validated** — it grew a chat UI, an in-app composer, provider plumbing, and a pile of features that were never proven useful. So it was cut back on purpose.

What's left is the part that actually earns its place: **a harness around the CLI agents you already use.** Not a platform, not an agent, not another place to type prompts. If you want a different model or a different CLI, you change nothing here — Orca drives whatever you already run.

Expect rough edges and breaking changes. Validated on macOS with phone access. Windows/Linux are not validated yet.

What it does

You are already running coding agents. The hard part is making one agent lean on **another** — hand it a scoped task, wait for it to finish, and know whether the work is any good — without sitting in a terminal watching.

Agent spawns agent. An orchestrator agent registers with Orca for its working directory, then spawns executor subagents — same CLI or a different one. Full MCP passes through, and the contract is enforced by the server, not by prompt text. The orchestrator can wait on a subagent a