Compos — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Compos (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Persistent architectural memory for your codebase — legible to humans, queryable by AI builders.
Compos tracks the components, relationships, constraints, risks, and decisions that make up your software system. Written by static analysis, updated by AI builders through an MCP server, reviewed by humans. The result: a map that stays in sync with your code, and gives AI tools the architectural context they need to make informed changes.
Status: Alpha. Free tier live on PyPI + Claude Code plugin marketplace. Actively looking for early testers — if you run it on a real codebase, we want to hear what's missing. See Feedback.
.compos/map.json, CLI commandsorientation, architectural-logging, preflight-check)compos push — sync local map to the team serverIn Claude Code, add the marketplace and install the plugin:
/plugin marketplace add fer46/compos-plugin
/plugin install compos@compos-pluginThis wires up the MCP server (compos-mcp via uvx, no pre-install) and three workflow skills into Claude Code. Prereq: uv.
uv tool install compos-cli
# or: pipx install compos-cli
compos --versionuv tool install compos-mcp
compos-mcp # stdio transportWire into your MCP client's config (Cursor, Zed, raw MCP) per their docs.
cd my-project
compos init # creates .compos/map.json
compos analyze # populates from static analysis
compos --helpOpen Claude Code in the project. The plugin auto-discovers .compos/ and the skills activate on relevant actions.
The map (.compos/map.json) is a JSON document with five object types:
| Type | Examples |
|---|---|
| Component | services, libraries, databases, frontends |
| Relationship | imports, HTTP calls, DB queries, event publishes |
| Constraint | invariants the system must preserve |
| Risk | known fragilities |
| Decision | ADR-style records tied to components |
Each field carries provenance (static-analysis / ai-annotated / human-input) and confidence. The merge engine enforces a trust hierarchy: human input overrides AI annotation, which overrides static analysis. Deletions are always soft.
Compos is in alpha. Two things would help enormously:
compos analyze, open Claude Code and exercise the MCP tools. Five minutes is enough to form an opinion.Channels, in order of preference:
If you're on LinkedIn or email and prefer to reply there, that also works — everything gets read.
MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.