writ
infinri/WritPlugin
Hybrid RAG rule retrieval and workflow enforcement for Claude Code. A five-stage pipeline (BM25 + vector + graph traversal + two-pass ranking) retrieves the right coding rules for each task in under 1ms from a Neo4j knowledge graph,. 726x context reduction vs loading a full rulebook at 10K rules. A mode and gate state machine enforces workflow discipline at the tool-call boundary: - writes are blocked until plans and tests are approved. - Ships with 276 rules across 12 domains (Security, Clean Code, DRY, SOLID, Architecture, Testing, Error Handling, Performance, Scaling, API Design, Process, Documentation). - AI agents can propose new rules through a structural gate; frequency-driven graduation and human review control what stays.
Why this score
Popularity score: 72/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 22, 2026 at commit d3c33d3e35ad, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs..claude/hooks/auto-approve-gate.sh:29, .claude/hooks/enforce-violations.sh:41, .claude/hooks/pre-validate-file.sh:30 and 86 more
- Runs code it builds while running (eval or exec) Harder to read ahead of time, since the code is assembled while it runs.scripts/seed_phase_1a_injection.py:143 and 2 more
- Makes network requestsSKILL.md, bible/architecture/rules.md:95, bin/lib/writ-session.py:460 and 15 more
- Uses dependencies without a pinned version A later version of a dependency could change what runs.pyproject.toml:12 and 15 more
- Includes scripts in hidden folders Folders starting with a dot are easy to miss when you read a repo..claude/hooks/auto-approve-gate.sh:23, .claude/hooks/enforce-violations.sh:15, .claude/hooks/friction-logger.sh:22 and 26 more
Web addresses in its code:
- api.stripe.combible/architecture/rules.md:96
- docs.docker.comscripts/bootstrap.sh:59
These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Nothing from another maker does quite the same job yet.