claude-crap
ahernandez-developer/claude-crapPlugin
Deterministic Quality Assurance plugin for Claude Code. CRAP stands for Change Risk Anti-Patterns — a metric originally developed by Alberto Savoia and Bob Evans at Google in 2007 to identify code that is both complex and under-tested. Inspired by their work. Claude-crap wraps every Write, Edit, and Bash tool call with a PreToolUse gatekeeper, a PostToolUse verifier, and a Stop quality gate backed by the CRAP index, Technical Debt Ratio, tree-sitter AST metrics, and SARIF 2.1.0 reports. Auto-detects and runs ESLint, Semgrep, Bandit, and Stryker at boot so users get real A..E quality grades out of the box. Forbids the agent from writing functional code before a test safety net exists (the Golden Rule).
Why this score
Popularity score: 44/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Nov 4, 2026 at commit 9a38ee8c298e, with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs.bundle/launcher.mjs:28, bundle/mcp-server.mjs:7361, launcher.mjs:28 and 4 more
- Runs code it builds while running (eval or exec) Harder to read ahead of time, since the code is assembled while it runs.bundle/mcp-server.mjs:2939 and 1 more
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Nothing from another maker does quite the same job yet.