agent-blackbox
Flight recorder
What your agent actually did — and what can still be undone.
timelineturn by turnrisk26 rulesundorecovery map
00 hailneed · Istanbul
Tools that show
what your agent
actually did.
Claude Code, Codex CLI and Gemini CLI already write every session to your disk. These plugins read it — and send nothing anywhere.
-
6Plugins
-
18Skills
-
78Readable rules
-
5Read only your disk
01 Field kit
Six modules.
One suite: show, do not tell.
The hailneed suite. Each module reads something that already exists — and cites where every claim came from.
skillbench
Skill lint & usage
Is the skill written right — and does it ever actually fire?
lint26 checkscoveragereal activationscollideoverlap & drift
scar
Closed loop
Failures that keep repeating, written down — then measured.
minewhat recurswriterule or testverifydid it hold?
gardener
Context hygiene
What CLAUDE.md costs you on every single request.
auditwhat loadscompliancefollowed?prunewhat to cut
painradar
Demand signal
Public complaints plus verified revenue — themes with links.
scanranked themesfitworth building?launchone channel
devpersona
Developer profile
Who you are as a developer, read from your own history.
statsnumbers onlyanalyzecharacter cardadvisewhat to build
02 Install
Add the marketplace once.
Install any of them.
# once > /plugin marketplace add hailneed/plugins # then whichever you want > /plugin install agent-blackbox@hailneed > /plugin install skillbench@hailneed > /plugin install scar@hailneed > /plugin install gardener@hailneed > /plugin install painradar@hailneed > /plugin install devpersona@hailneed # and try it > /agent-blackbox:risk
Claude Code keys marketplaces by name, so a manifest shipped inside every product repo would overwrite the last one and the plugins could not coexist. A single manifest repository removes the clash — that is all hailneed/plugins is.
- Claude Code and Node.js 18 or newer.
- No dependencies, no build step, no API key.
- Standalone works too —
node scripts/blackbox.mjs --scan --days 30 --md - Optional —
GITHUB_TOKEN,TRUSTMRR_API_KEYraise radar limits.
03 Support
Free, and staying free.
Pay only if it saved you a day.
Nothing on this page is gated. There is no tier that unlocks a command, no account to make, no key to paste. What the tiers below buy is maintenance time — that is the whole product being sold.
Every plugin, every command, every rule file — today, and after the next release. There is no second version of this page behind a login.
- Six plugins, 18 skills
- MIT — fork it, ship it, sell it
- No account, no API key
- Five of six run with the network off
The version of a GitHub star that pays for the Saturday morning someone spends on your bug report.
- Everything in Free — already everything
- One payment, nothing recurring
- Your issue read before the queue
For teams running these in CI who would rather they still work next quarter, and want a say in which rule gets written next.
- Everything in Coffee
- Name and link in the repo README
- Early access to the Cloud betas
- A direct line for bug reports
The plugins are not the paid product and never will be. The only thing that will ever carry a price is Cloud — the hosted half that keeps history across machines and reports across a team — and when it ships it will cost single digits a month, with everything local still working without it.
04 Also shipped
Everything else that is public.
plugins
Marketplace
The manifest that makes the six plugins installable side by side. One repo,
one marketplace.json, added once.
JSON · MIT
solostack-mcp
MCP server
Pulls live data from Reddit, GitHub Trending and Hacker News, then surfaces the tools that matter to solo developers from inside your assistant. Generic mode works out of the box; role-based mode tunes the sources to your job.
TypeScript · MCP
hyperframes-agent-skill
Agent skill
Teaches coding agents the HyperFrames composition contract so a render is correct on the first attempt: 19 rule files covering timing attributes, GSAP timelines, transitions, Lottie, 3D and the render pipeline.
19 rule files
promptrank
Static app
A terminal-style prompt quiz. Five scenarios scored on clarity, creativity, technical depth and strategy, ending in a shareable Prompt IQ card. Turkish, English and Spanish.
Vanilla JS · 3 languages
05 Method
Four rules the tools are built on.
01
Evidence over assertion.
A finding that cannot point at the line it came from does not ship. Reports cite the transcript, the rule and the matched text, so you can disagree with the specific thing rather than with the tool.
02
Local by default.
The data is already on your disk. Reading it should not require sending it anywhere. The blackbox scanner makes no network calls at all, and anything shaped like a credential is masked before a report is written.
03
Rules you can read.
Risk classification is a list of patterns in a file you can open, not a model judgement you have to trust. Disagree with one and switch it off with a flag.
04
Failure stays visible.
When a source is unreachable or a log will not parse, the report says so in its source note. Missing data never quietly becomes a confident number.
06 Dispatches
Notes from building this.
Long-form on Medium, indexed here. What the logs actually show, what the rules catch, and what the agent ecosystem still gets wrong.
07 FAQ
The questions that decide it.
01 Is it actually free, or free for now?
Free, and not revocably so. Every repo is published under MIT, which cannot be taken back from a release that already exists — the worst case for you is a fork of the last good commit. If a paid tier ever appears it will be Cloud, a separate hosted thing, and the local plugins will keep working without it.
02 So what does sponsoring actually buy?
Not a feature. It buys attention: your issue read first, your use case weighted when the next rule file gets written, and enough maintenance time that the suite still installs cleanly a year from now. If that is not worth $5 to you, install it free — that is a completely normal outcome and the licence says so.
03 What is Cloud, and will it be paid?
Cloud is the hosted half currently in design: session history that survives a machine swap, risk reports across a whole team instead of one laptop, and trend lines that need more than one week of logs. Yes, it will be paid, in single digits a month. Each product page has a waitlist form for its own Cloud.
04 Does anything leave my machine?
Five of the six make no network calls at all — they read logs your agent already wrote to your disk, and anything shaped like a credential is masked before a report is written. The sixth, painradar, has to reach the public web to do its job, and its page says exactly which sources it hits. There is no telemetry in any of them.
05 Can I use these at work, commercially?
Yes. MIT, including inside closed-source products and paid consulting work. Keep the licence file; there is nothing else to ask for and nobody to email.
06 Which agents can they read?
Claude Code, Codex CLI and Gemini CLI, since all three write their sessions to
disk in a readable format. Claude Code is the one the plugin packaging targets;
the scanners also run standalone with
node scripts/blackbox.mjs against the other two.
08 Contact
Open to interesting problems.
Software engineer in Istanbul. ASP.NET Core and EF Core by day; agent tooling, data-loss-prevention research and Node CLIs the rest of the time. Currently building evidence-first instrumentation for coding agents.
If you are working on agent observability, developer tooling, or anything where a system has to prove what it did rather than claim it — I want to hear about it.