v1.9.0 Released — Selective Install, ECC Tools Pro, 12 Language Ecosystems, AgentShield v1.4.0

[affaan-m]

v1.9.0 is live

This is the biggest release since 1.0. 219 commits, 30+ contributors, and a lot of ground covered.

Highlights

ECC Tools Pro is live. The GitHub App now has Stripe billing. Pro tier is $19/seat/month for private repo analysis, 50 analyses/month, and AgentShield-backed scanning. Free tier stays at 10 analyses/month for public repos. Install at github.com/apps/ecc-tools. Upgrade at ecc.tools/pricing.

Selective install. Install only what you need with --with and --without flags. Agent and skill component families are now in the manifest.

12 language ecosystems. C#, Rust, Java, Kotlin, C++, Go, Python, TypeScript, Perl, PyTorch, Nuxt 4, and Flutter now have dedicated rules, agents, or skills.

28 agents, 116 skills, 57 commands. Up from 17/94/40 in v1.8.0.

Windows CI fully green. All 38 matrix jobs passing across Ubuntu, macOS, Windows with Node 18/20/22 and npm/pnpm/yarn/bun.

AgentShield v1.4.0 ships alongside

• False positive scanning fixed (deny rules and block hooks no longer flagged as threats)
• CVE database with 25+ known MCP vulnerabilities
• MCP tool description poisoning detection (5 new rules)
• Continuous scanning with config drift detection (watch mode)
• Runtime monitoring daemon for tool calls
• Supply chain verification for MCP npm packages
• PR security gate with baseline comparison
• Organization-wide security policy enforcement
• 1,609 tests passing

Scan your config: npx ecc-agentshield scan

Infrastructure

• Agent description compression with lazy loading
• Skill inspection logic for recurring failure pattern detection
• Governance event capture hooks
• MCP health-check hook with auto-reconnect
• SQLite state store for session/skill/decision tracking
• Session adapters for canonical snapshots

New Guides

• The Shorthand Guide to Everything Agentic Security — attack vectors, sandboxing, sanitization, CVEs, and AgentShield
• SECURITY.md added to the repo

Links

• Release notes
• AgentShield v1.4.0
• ECC Tools pricing
• Install GitHub App

Install / Upgrade

npx claudepluginhub affaan-m/everything-claude-code --plugin everything-claude-code

88K stars. thank you all.

[borzov]

Congrats on the release — this looks like a massive amount of work, and the progress here is genuinely impressive. Thanks for continuing to push the project forward.

For my use case, though, I’m not ready to use paid ECC / ECC Tools yet. I’d prefer to keep using everything-claude-code through the normal plugin or manual setup path.

At the moment, I’m also not able to update to v1.9.0 using the standard Claude Code plugin update mechanisms, so it’s a bit unclear what the intended upgrade path is for users who don’t want to adopt ECC Tools.

If possible, it would be very helpful to document a clear non-ECC upgrade path for v1.9.0.

[affaan-m]

Hey, thanks for the kind words and the honest feedback.

A few things to clarify:

ECC Tools (the GitHub App) is a separate product from ECC itself. Everything in this repo is still open source, free, and works exactly the same as before. Nothing changed about the install path, the plugin system, or how you use ECC day to day. ECC Tools is a paid GitHub App for private repo analysis and security scanning. Completely optional. You install it separately at github.com/apps/ecc-tools.

To update to v1.9.0 without ECC Tools: the standard paths still work:

• Plugin hub: npx claudepluginhub affaan-m/everything-claude-code --plugin everything-claude-code
• Manual: clone the repo and run ./install.sh
• Selective install is new in 1.9.0: use --with and --without flags to pick only what you need

If the plugin hub path is not picking up 1.9.0 for you, can you share what error or behavior you are seeing? The npm package and repo should both be on 1.9.0. Might be a caching issue on Claude side.

Separately, we are looking into a report that the GitHub Marketplace listing might not have updated to the latest version. If that is what you are hitting, it is a propagation delay and we are pushing a fix.