claude-grc-engineering plugin
An open set of Claude Code plugins for compliance: findings from cloud and SaaS, gap reports and OSCAL output
- 430 ★ on the repository
- Last commit
Broad access
Why this level
- Connectors reach AWS, GCP, Azure, Okta, Slack, Datadog and other systems with your credentials and collect evidence from them
- Generation commands produce remediation code, policies and evidence packages that land in your project
Install
- Works in
Manual install
/plugin marketplace add GRCEngClub/claude-grc-engineering
/plugin install grc-engineer@grc-engineering-suiteOther plugins install the same way: /plugin install name@grc-engineering-suite.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Connectors reach AWS, GCP, Azure, Okta, Slack, Datadog and other systems with your credentials and collect evidence from them
- Generation commands produce remediation code, policies and evidence packages that land in your project
This is third-party code. Review the repository files before installing.
What it does
The project is a Claude Code plugin marketplace from the GRC Engineering Club. It turns technical data from clouds, SaaS, code and security tools into findings against framework requirements, gap reports, remediation guidance, evidence packages and OSCAL files. Connectors collect evidence, every finding follows finding.schema.json, and the grc-engineer plugin maps findings through the Secure Controls Framework: 1468 controls across 249 frameworks. The core of the set is the grc-engineer plugin: gap assessment, IaC scanning, evidence collection, remediation and policy generation, pull request review and continuous monitoring. Around it sit plugins for roles (auditor, internal GRC team, vendor assessment, reporting, learning), reference plugins for SOC 2, NIST 800-53, ISO 27001, FedRAMP, PCI DSS, CMMC, HITRUST, GDPR, DORA and other standards, connectors to AWS, GCP, Azure, GitHub, Okta, Slack, Datadog, Splunk and more, draw.io diagrams and OSCAL tooling for FedRAMP. You install only the plugins you need. GitHub works as an evidence source for a first run without cloud keys, and the rest is added as needed.
Who it is for. For security engineers, internal GRC teams and auditors who want compliance to behave like engineering work: repeatable, tested and versioned.
Good fit when
- You prepare for a SOC 2 or ISO 27001 audit and want a gap report built from GitHub and cloud data
- You need Terraform, CloudFormation or Kubernetes checked against requirements: the `/grc-engineer:scan-iac` command
- One control satisfies several standards and you need to see the mapping: `/grc-engineer:map-controls-unified`
- You must assemble SSP, SAP, SAR or POA&M in OSCAL for FedRAMP: the `/oscal:*` and `/fedramp-ssp:*` commands
- You want to learn a standard or a GRC role: `/teach-me:framework`, `/teach-me:control` and `/teach-me:quiz`
Not a fit when
- You need a managed service with support and a contract: this is an open set of plugins before version 1.0, and the finding schema may change
- You need the full text of standards: the project cites control IDs and guidance and does not reproduce the standards themselves
- Company policy forbids giving an AI agent access to cloud and SaaS systems: the connectors work with your credentials
- You do not use Claude: the set is built for Claude Code, Claude Desktop and Claude Cowork
Example request
Build a SOC 2 gap assessment from my GitHub repositories and show which controls are missingLimitations
- The project is pre-1.0: the finding schema is versioned and breaking changes are recorded in CHANGELOG.md.
- Plugins install through Claude Code. Claude Desktop and Claude Cowork use the same Markdown files when the repository is attached as project context.
- Licenses differ: MIT for the project's own code, CC BY-SA 4.0 for the CIS Controls plugin, CC BY-ND 4.0 for SCF data.
- The project is not affiliated with Anthropic. Each connector needs credentials for its own service.
How to disable. Installed plugins are removed through the `/plugin` menu in Claude Code. The data you keep in the grc-data/ directory belongs to you and stays in the project.
FAQ
How do I install claude-grc-engineering in Claude Code?
Run `/plugin marketplace add GRCEngClub/claude-grc-engineering`, then `/plugin install grc-engineer@grc-engineering-suite`. Other plugins install with the same command, using their own name and the @grc-engineering-suite suffix. The full first-run order is in docs/QUICKSTART.md.
Can I try it without cloud access?
Yes, GitHub can be the evidence source. Install github-inspector and soc2, run `/github-inspector:setup` and `/github-inspector:collect --scope=@me`, then `/grc-engineer:gap-assessment SOC2 --sources=github-inspector`.
How does the project map requirements across standards?
Through the Secure Controls Framework, which links 1468 controls to 249 frameworks. Connectors emit findings in one shared schema, and grc-engineer fans them out across standards and builds reports and remediation.
Does the set work in Claude Desktop?
Partly. Claude Desktop and Claude Cowork read the same Markdown skills and runbooks when the repository is added as project context or a shared workspace. The steps are in docs/CLAUDE-COWORK.md.
Which standards do the reference plugins cover?
SOC 2, NIST 800-53, ISO 27001, FedRAMP, PCI DSS, CMMC, HITRUST, CIS Controls, GDPR, DORA, HIPAA Security and regional privacy and security requirements. The `/grc-engineer:frameworks` command shows coverage by framework.
Discussion
No questions or reviews yet.
Related
PluginsClaude Skills for GRC
Claude Skills for Governance, Risk & Compliance (GRC)
A set of governance, risk and compliance skills: ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIST, the EU AI Act and other frameworks
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Prowler plugin for Claude Code
Prowler for Claude Code
A plugin that takes a cloud account toward CIS, PCI-DSS and other frameworks: reads Prowler Cloud reports, fixes failures and proposes a rescan
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
A Claude Code marketplace from Trail of Bits: 29 plugins with hooks and scripts reviewed line by line, from fuzzing and Ghidra to documents
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| claude-grc-engineering (this entry) | no | 430 | |
| Prowler plugin for Claude Code | yes | 15,121 | a plugin built around a Prowler Cloud report that moves a cloud account toward CIS and PCI-DSS and fixes violations |
| Security audit skill with GOST and FSTEC | no | 1 | a code security audit skill with a compliance matrix and no cloud connectors |
README in short
The repository page opens with the purpose and a one-minute install, followed by a table of common tasks with commands and a plugin map by category. It ends with documentation links, contribution rules and the pre-1.0 status.