vibe-thesis

Test analyzer and generator for vibe-coded apps. Classifies by app type and maturity tier, measures coverage honestly (no cherry-picked denominators), generates tests proportional to deployment risk — and catches the broken harnesses every other test tool assumes away.

Research feeder for vibe-thesis projects. Discovers cutting-edge thesis topics, gathers primary sources / opposing positions / methodological precedents across five research axes, and emits research notes + a Pandoc-ready BibTeX bibliography in vibe-thesis-shaped subdirectories ready to drop into ThesisStudio. Optional Smart Brevity blog adapter for BlogStudio.

The deep retrospective for your Claude Code work — the verbose /insights over your full history and every machine you code on. Coverage, where-was-I recall, token/cost (incl. the cache reveal), trends, how-you-work (tool mix, delegation, per-machine), ranked open-threads with prune candidates, decisions, languages, per-session friction/satisfaction/outcome, and a synthesized narrative read. Personal by default; optionally keep chosen sources or repos local-only (the privacy wall). Standalone engine; optional cc-logs extra keeps token numbers aligned with sibling tools. MCP-agnostic decisions overlay. No telemetry.

Plot your course from idea to shipped app. Vibe coding course correction delivered as Claude Code slash commands: onboard, scope, prd, spec, checklist, build, iterate, reflect, reconnect, evolve-cart, tend, vitals, friction, coder-voice.

AI-powered documentation gap analyzer. Scans your codebase, classifies your project, identifies missing technical documentation, and generates professional docs from your existing artifacts.

Take it with you. Capture a feature out of one repo as a portable bundle (architecture sketch, contract surface, AI prompts, verbatim source snapshot, gotchas); plant it into another with stack-aware adaptation. /vibe-taker:capture reads source autonomously and only fires the interview gate when WHY can't be derived from source alone. /vibe-taker:plant detects the target's stack and picks code-lift on high match, spec-driven re-implementation on low match, or declines on hard cross-language mismatch — always with a mandatory diff confirmation before any write. /vibe-taker:list surfaces what's on the cross-repo shelf with search and Jaccard near-duplicate hints. Local-only by default; ~/.vibe-taker/library/ is the single source of truth.

Bootstrap a 626Labs-pattern CLAUDE.md — the load-bearing structural file every agent decision in the repo rests on. Interviews the user for org, decision surface, voice rules, and persona before drafting, so the produced file reflects THEIR conventions, not 626Labs defaults baked in. Tenant-aware; adapts to repo type (code platform / marketing site / long-form writing / mixed). Use when starting a new repo or when an existing CLAUDE.md is stale.

Iterate on a shipped product, one PR at a time. First-run bootstrap identifies the app type and interviews you for competitors + framework pins. Recommends the right mode (feature-add, competitive, ux-polish, bug-bash) for the moment; ships with regression-aware, small-diff posture. Includes radar (digest what's new), rate (score an idea before committing), spy (single-URL competitor read), scan-releases (per-lib changes since last bump), upgrade (surgical lib bumps with codemods when available), ship (hand-written brief, no ingestion). Composes with vibe-cartographer when installed (heavy-iteration delegation). Self-evolves via session + friction logging — :evolve-iterate proposes improvements based on your usage patterns. No telemetry.

The 626 Labs plugin marketplace for Claude Code — a coordinated family of plugins for spec-driven building, iteration, docs, tests, security, and research. Paste this repo into Claude Code to install the whole Vibe ecosystem.

Security gap finder for vibe-coded apps — the tier-aware security audit and orchestration layer. Defers to gitleaks/OSV-Scanner/Semgrep/Trivy when present, falls back to an in-house baseline when absent, and owns the tier classification (mapped to OWASP ASVS), severity calibration, four-band report, confidence-routed fixes with destructive-action overrides, and threat-model synthesis. /vibe-sec:audit runs the full twelve-concern audit (secrets, deps, supply-chain, config, crypto/PII, auth-model, OWASP survey, rate-limiting, license-compliance, data-posture, threat-model, tier-scoring) — plus :scan, :deps, :gate (CI-safe), :posture, :fix, :threat-model, and :research. License compliance is distribution-model aware: GPL in a shipped binary flags high, the dual-license OR-trap doesn't flag at all. Validated on real Firebase apps.