OpenFluxGate

Fluxmirror — Security skill for Claude Code

Security community

Multi-agent activity audit for Claude Code, Gemini CLI, Qwen Code, and Claude Desktop MCP.

How to install Fluxmirror

This entry records only its repository, not the path inside it, so there is no exact command to give. Open OpenFluxGate/fluxmirror and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Fluxmirror does

Multi-agent activity audit for Claude Code, Gemini CLI, Qwen Code, and Claude Desktop MCP.

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Pocketpaw — Your AI agent in 30 seconds 775 ★
Agent Skills Guard — 一款提供Agent Skills安全扫描和可视化管理的桌面应用 A desktop application that provides security scanning and visual management fo 389 ★

README

fluxmirror

Multi-agent activity audit. Logs every tool call from Claude Code, Gemini CLI, and Qwen Code to a SQLite database — separated by agent. Optionally audits Claude Desktop's MCP traffic via the same binary running as a long-running stdio proxy that writes to the same DB.

A set of `/fluxmirror:*` slash commands (installed by the Claude Code / Qwen Code plugin and the Gemini CLI extension) turns the SQLite data into daily, weekly, or per-agent reports.

**Two binaries.** Phase 1 + 2 shipped the `fluxmirror` binary — a single statically-linked Rust program with a kubectl-style subcommand surface (`fluxmirror hook`, `fluxmirror proxy`, `fluxmirror init`, `fluxmirror today`, `fluxmirror week`, `fluxmirror doctor`, …) and zero runtime dependencies (SQLite bundled). Phase 3 (in flight) adds a second, **opt-in** binary — `fluxmirror-studio`, a local web dashboard on `127.0.0.1:7090` that reads the same SQLite file in read-only mode. You can run capture only, dashboard only, or both; the only thing they share is the DB file. A small cross-shell wrapper layer (`wrappers/{shim.sh, shim.mjs, shim.cmd, router.sh}`) auto-downloads the per-arch capture binary on first invocation and execs it on every call — first call is one-time ~1-2 s, every call after is ~30 ms. The studio binary is installed and invoked directly by the user, never through the wrapper layer.

What FluxMirror produces

#	Output	Status	Notes
1	Nightly journal	✅ shipped	`/fluxmirror:today` and `fluxmirror today` produce a one-page activity report in your chosen language. Also available as HTML via `--html`.
2	Usage tracker	🟡 partial	Tool-call counts, per-agent and per-tool breakdowns shipped via `/fluxmirror:agents` and `/fluxmirror:week`. Estimated API cost lands in Phase 3 M6.
3	Weekly digest	✅ shipped	`/fluxmirror:week --html` produces the shareable HTML card with summary, daily breakdown, highlights, and insights.
4	Local web dashboa