# 🧠 Systemores: AI Agent & MCP Security Auditor

**Stop shipping unverified prompts and over-privileged MCP tools. Audit schemas, delegation graphs, 21-dimension behavioral stability, and `<250ms` inline circuit breakers directly inside your IDE.**

[![Version](https://img.shields.io/badge/version-1.1.3-0ea5e9.svg)](https://audit.systemores.com)
[![npm](https://img.shields.io/npm/v/@systemores/systemores-plugin?color=cb3837&label=npm)](https://www.npmjs.com/package/@systemores/systemores-plugin)
[![MCP Registry](https://img.shields.io/badge/MCP_Registry-io.github.bobcar0%2Fsystemores--plugin-0ea5e9)](https://registry.modelcontextprotocol.io)
[![MCP 2026](https://img.shields.io/badge/MCP-2026%20Streamable%20HTTP-10b981.svg)](https://audit.systemores.com/api/mcp)
[![Compatibility](https://img.shields.io/badge/IDE-Antigravity%20%7C%20Claude%20Code%20%7C%20Gemini%20CLI-6366f1.svg)](https://audit.systemores.com)
[![M8ven Score](https://m8ven.ai/badge/mcp/bobcar0-systemores-plugin-1u21uy?v=fcb3fcb50848eda8e8bcb1f027a78fbe&variant=verified)](https://m8ven.ai/mcp/bobcar0-systemores-plugin-1u21uy?s=readme)

> Most AI agents pass unit tests and fail under real user pressure—leaking tool privileges, capitulating to sycophancy, or burning token budgets in cyclic delegation loops.
>
> The **Systemores Plugin** wires an autonomous security and psychometric auditor directly into **Google Antigravity**, **Claude Code**, and **Gemini CLI**—giving you **3 unlimited static security auditors for free on install**, plus on-demand cloud access to **Systemores System One (`<250ms`) circuit breaking**, **IPIP-NEO-120 adversarial cohorts**, and **EU AI Act / NIST AI RMF / SOC 2 compliance dossiers**.

---

## 🛡️ Systemores Self-Audit Certification (Dogfooded & Verified)

[![Systemores Health Index](https://img.shields.io/badge/Systemores_Health_Index-98.4%2F100-10b981?style=for-the-badge)](https://audit.systemores.com)
[![MCP 2026 Tool Integrity](https://img.shields.io/badge/MCP_2026_Tool_Integrity-100%2F100_PASS-10b981?style=for-the-badge)](https://audit.systemores.com)
[![Multi-Turn Drift](https://img.shields.io/badge/50--Turn_Drift-5%C2%B0_CONTROLLED-3b82f6?style=for-the-badge)](https://audit.systemores.com)
[![4-Framework Certified](https://img.shields.io/badge/EU_AI_Act_%7C_NIST_%7C_EEOC_%7C_SOC2-92%2F100_CERTIFIED-8b5cf6?style=for-the-badge)](https://audit.systemores.com)

| Audit Vector | Tool Used | Result / Metric | Status |
| :--- | :--- | :--- | :---: |
| **MCP 2026 Tool Schema Integrity** | `systemores_audit_tool_integrity` (`strictMode: true`) | **100 / 100** (11/11 tools, 0 annotation or injection flags) | 🟢 `PASS` |
| **Multi-Agent Graph Topology** | `systemores_audit_agent_graph` | **0 Cycles / 0 Privilege Escalations** (6 nodes, 5 edges) | 🟢 `PASSED` |
| **System One Adversarial Refusal** | `systemores_audit_turn_live` (`systemores-s1-1.13.0`) | **98.4 / 100 Health Index** (`1.99/2.0` compliance, `4.0%` sycophancy, `135ms`) | 🟢 `DISPATCH` |
| **System One Sycophancy Trap** | `systemores_audit_turn_live` (`systemores-s1-1.13.0`) | **Blocked Fake 100/100 Coercion** (`98%` sycophancy detected in `129ms`) | 🛡️ `INTERCEPT` |
| **20- & 50-Turn Behavioral Drift** | `systemores_evaluate_drift` (`turns: 20 & 50`, `temp: 0.7`) | **0.050 Drift Index / 5° Deviation Angle** (`ISFJ-A` / `98%` Conscientiousness) | 🟢 `CONTROLLED` |
| **High-Press Needs-Press Stability** | `systemores_stress_test_agent` (`pressIntensity: high`) | **1.00 Behavioral Integrity** (`0.934` PSI, `93` Compliance, `6` Confrontation) | 🟢 `PASSED` |
| **4-Domain Algorithmic Bias Audit** | `systemores_assess_bias` (`eeoc`, `ecoa`, `housing`, `coppa`) | **0 Non-Compliance Flags** across all 4 statutory domains (`LOW` risk) | 🟢 `PASSED` |
| **30-Facet Synthetic Cohort** | `systemores_generate_cohort` (`IPIP-NEO-120`) | **10 DevOps Personas** (`cooperative`, `noisy`, `adversarial`, `edge_case`) | 🟢 `VERIFIED` |
| **Chaos Fault & OTel Trace Audit** | `systemores_inject_environment_fault` & `analyze_trace_telemetry` | **Policy `fault-pol-4cyigov`** + **`$0.0068` / 4 Spans** (`0` loops or burn traps) | 🟢 `OPTIMIZED` |
| **Cognitive Throughput & Drag** | `systemores_measure_drag` | **95.70% Efficiency** (`1.91 chars/ms`, `OPTIMIZED` token cost) | 🟢 `EFFICIENT` |
| **4-Framework Regulatory Dossier** | `systemores_export_dossier` (`dos-yj3mybv7`) | **92 / 100** across **EU AI Act**, **NIST AI RMF 1.0**, **EEOC/ECOA**, **SOC 2 AI** | 🟢 `CERTIFIED` |

---

## ✨ What's Included in the Bundle

| Component | Path | Description |
| :--- | :--- | :--- |
| **Antigravity Manifest** | `plugin.json` | Native Antigravity plugin configuration, starter prompts, and branding. |
| **Claude Code Manifest** | `.claude-plugin/plugin.json` | Cross-platform manifest for Claude Code plugin installation. |
| **Gemini CLI Manifest** | `gemini-extension.json` | Cross-platform manifest for Gemini CLI extension installation. |
| **Cloud MCP Config** | `mcp_config.json` | Connects to `https://audit.systemores.com/api/mcp` via stateless Streamable HTTP. |
| **Specialist Subagent** | `agents/systemores-auditor.md` | Autonomous behavioral & security auditor powered by the 21-dimension & IPIP-NEO-120 framework. |
| **Audit Workflow Skill** | `skills/systemores-audit/SKILL.md` | On-demand procedural runbook for 11 MCP tools, scorecards, and compliance certification. |
| **Governance Rules** | `rules/AGENTS.md` | Enforces MCP 2026 `annotations` (`readOnlyHint`, `destructiveHint`) and anti-sycophancy guardrails. |

---

## 🚀 Quick Install

### 1. Google Antigravity IDE / CLI
Install via the Antigravity CLI (or clone into your global Antigravity plugins directory):
```bash
agy plugin install https://github.com/bobcar0/systemores-plugin
# or clone directly:
git clone https://github.com/bobcar0/systemores-plugin.git ~/.gemini/config/plugins/systemores
```
Then toggle **Systemores** under **Customizations -> Installed** in Antigravity.

### 2. Claude Code
```bash
claude plugin add https://github.com/bobcar0/systemores-plugin.git
```

### 3. Gemini CLI
```bash
gemini extensions install https://github.com/bobcar0/systemores-plugin.git
```

### 4. npm / npx (Zero-Clone Stdio MCP Server)
Run directly in any MCP-compatible host via `npx` or install from npm:
```bash
npx -y @systemores/systemores-plugin
# or
npm i @systemores/systemores-plugin
```

---

## ⚡ What Runs Free vs. Pro & Team Compliance

The Systemores Cloud MCP Server (`https://audit.systemores.com/api/mcp`) provides a **zero-friction Free Community Tier ($0 / forever)** so developers get immediate static security value on install, plus self-serve **Systemores Pro ($49/mo)** and **Team & Compliance ($199/mo)** subscriptions (as well as 7-day Trial tokens) at **[audit.systemores.com/pricing](https://audit.systemores.com/pricing)**.

| Tool / Capability | Free Community ($0 — No Key) | Systemores Pro ($49/mo — 1 Seat / 1k Audits) | Team & Compliance ($199/mo — Multi-Seat / 5k Audits) |
| :--- | :---: | :---: | :---: |
| `systemores_audit_tool_integrity` *(MCP 2026 Schema & Annotation Audit)* | ✅ Unlimited* | ✅ | ✅ |
| `systemores_audit_agent_graph` *(Multi-Agent Loop & Privilege Escalation Audit)* | ✅ Unlimited* | ✅ | ✅ |
| `systemores_measure_drag` *(Cognitive Drag & Token Velocity Math)* | ✅ Unlimited* | ✅ | ✅ |
| `systemores_audit_turn_live` *(Systemores System One <250ms Inline Circuit Breaker)* | 🔒 Pro / Trial Key | ✅ Live System One Engine | ✅ Priority Burst SLA |
| `systemores_stress_test_agent` *(21-Dimension Murray Needs-Press + Big Five/MBTI/DISC)* | 🔒 Pro / Trial Key | ✅ Live 21-Trait Engine | ✅ Unredacted Raw Vectors |
| `systemores_evaluate_drift` *(Multi-Turn Persona Erosion & Entropy Curve)* | 🔒 Pro / Trial Key | ✅ Up to 100 Turns | ✅ Up to 100 Turns |
| `systemores_assess_bias` *(EEOC, ECOA, Fair Housing & COPPA Bias Audit)* | 🔒 Pro / Trial Key | ✅ All 4 Domains | ✅ All 4 Domains |
| `systemores_generate_cohort` *(30-Facet IPIP-NEO-120 Synthetic Adversarial Cohorts)* | 🔒 Pro / Trial Key | ✅ Up to 50 Personas | ✅ Custom Domain Cohorts |
| `systemores_inject_environment_fault` *(Chaos Engineering Fault Generator)* | 🔒 Pro / Trial Key | ✅ All Fault Profiles | ✅ All Fault Profiles |
| `systemores_analyze_trace_telemetry` *(OpenTelemetry Span & Cost Burn Trap Audit)* | 🔒 Pro / Team Key | ✅ W3C Trace Context | ✅ Full OTel Ingestion |
| `systemores_export_dossier` *(EU AI Act, NIST AI RMF 1.0 & SOC 2 Certification Dossier)* | 🔒 Team Key | 🔒 Team Key | ✅ Audit-Ready Dossier Suite |

*\*Protected by standard per-IP burst rate limiting.*

---

## 🔓 Unlock All 11 Auditors in 30 Seconds (Trial & Pro Keys)

1. **Claim a key in one click:** Subscribe for an instant Pro/Team API key (`sys_pro_...`) or request a 7-day Trial Token at **[audit.systemores.com/pricing](https://audit.systemores.com/pricing)**.
2. **Add your key to `mcp_config.json`:**
   ```json
   {
     "mcpServers": {
       "cloud": {
         "serverUrl": "https://audit.systemores.com/api/mcp",
         "headers": {
           "Authorization": "Bearer YOUR_SYSTEMORES_API_KEY"
         }
       }
     }
   }
   ```

---

## 🧪 Local Verification & Test Suite

Run the built-in manifest verifier and 12-tool unit test suite:
```bash
npm test
node scripts/verify-plugin.mjs
```

---

## 🔒 Privacy Policy & Data Handling

Systemores adheres strictly to **Privacy by Design**: prompts, MCP tool schemas, and OpenTelemetry traces are processed ephemerally and are never used to train models, and Pro/Team API keys (`sys_pro_...`) are stored only as SHA-256 digests. Read the full policy in **[PRIVACY.md](./PRIVACY.md)** or at **[https://audit.systemores.com/privacy](https://audit.systemores.com/privacy)**.