sosa-compliance-checker — Claude Code plugin: features and setup
Audits Claude Code plugins and skills against the SOSA framework. It checks agent permissions, secret containment, and human-in-the-loop controls.
/plugin marketplace add anthropics/claude-plugins-community
/plugin install sosa-compliance-checker@claude-communityWhat sosa-compliance-checker does
This plugin scans your Claude Code setup against the four pillars of the SOSA methodology: Supervised, Orchestrated, Secured, and Agents. It parses configuration files and skill definitions without altering any workspace files.
The evaluation covers graduated supervision tiers from L0 to L4, prompt injection protections, and role separation across the software lifecycle. It also inspects whether your workflow follows the Plan-Code-Verify pattern and keeps credentials isolated from agent tools.
The tool runs entirely in read-only mode and needs no external credentials. You only need access to the Claude Code community marketplace to install and run the audit.
What it helps with
- audit Claude Code plugins for credential leakage
- evaluate agent role separation and boundaries
- verify human approval gates for critical code changes
- check skill configs for prompt injection defenses
Example prompts for the agent
- Run a SOSA audit
- Check SOSA for Code compliance
- Audit my plugins
How to install sosa-compliance-checker
Plugin marketplace
/plugin marketplace add anthropics/claude-plugins-community/plugin install sosa-compliance-checker@claude-communityStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about sosa-compliance-checker
How do I install sosa-compliance-checker in Claude Code?
First, add the community marketplace by running /plugin marketplace add anthropics/claude-plugins-community. After that, install the plugin using /plugin install sosa-compliance-checker@claude-community.
What does sosa-compliance-checker do?
It inspects plugins, skills, and coding agents against the SOSA standard. It validates code supervision levels, secret isolation, orchestration steps, and agent role definitions.
Can sosa-compliance-checker modify my project files?
No, it operates in a read-only mode. It only parses skill files and settings to assess compliance, making zero changes to your codebase.
Source text
sosa-compliance-checker · MIT
# SOSA™ Compliance Checker Audit your Claude plugins, skills, and coding agents against the SOSA™ methodology — Supervised Orchestrated Secured Agents. ## About the publisher [MSApps is Certified in the Claude Partner Network.](https://claude.com/partners) ## What it does Scans your entire plugin ecosystem and evaluates each component against the four SOSA pillars, covering both enterprise operations and AI-assisted software engineering (SOSA for Code): 1. **Supervised** — Are high-impact actions gated on human approval? Is the trust gradient active? Are code changes scored by impact (L0-L4)? Does each task maintain a living CLAUDE.md with institutional memory? 2. **Orchestrated** — Does the skill follow Plan→Act→Verify? For code: is merge serialization enforced? Are code context registries shared between planning and implementation agents? Are inline verification checkpoints running? 3. **Secured** — Are credentials safe? Are coding agents sandboxed with scoped repository permissions? Are secrets excluded from agent capability sets? Is external data scanned for prompt injection? 4. **Agents** — Is the role specification formal (R, T, M, P, K)? For coding agents: is the codebase knowledge model K populated and maintained? Are distinct roles (Planner, Implementer, Tester, Reviewer, Deployer, Monitor) enforced by the security layer? ## SOSA for Code This checker now includes full support for auditing AI coding agent governance: - **Graduated supervision levels** (L0 Auto → L4 Prohibited) for code changes - **Trust gradient** assessment: agents earn autonomy through verified performance - **Plan-Code-Verify** execution model validation - **Codebase knowledge model (K)** coverage and currency - **Role enforcement** across the SDLC (Planner, Implementer, Tester, Reviewer, Deployer, Monitor) - **Living CLAUDE.md** — adaptive institutional memory updated each run ## Usage Just say: "Run a SOSA audit", "Check SOSA compliance", "Audit my plugins", or "Check SOSA for Code compliance" ## Whitepaper Read the full SOSA™ methodology: [SOSA™: Supervised Orchestrated Secured Agents](https://msapps-mobile.github.io/claude-plugins/sosa-whitepaper) ## No setup required Read-only plugin — only reads skill files and configs to analyze them.
© MSApps-Mobile · MIT · MSApps-Mobile/claude-plugins
