The RISK track
Finds what's wrong: code smells, antipatterns, vulnerabilities, and supply-chain risks — graded by severity and correlated into hotspots in the unified report.
A plugin for Claude Code · audit → fix → verify
claude-oop-excellence hunts God Classes, Anemic Domain
Models, Feature Envy and the rest, then refactors toward sound design with
GoF patterns. One read-only /audit front door runs two
tracks in parallel — RISK and PATTERN —
into one unified report, then hands off to gated, test-verified fixes. No
framework, stack, or paradigm lock-in.
How it works
/audit is the single read-only entry point. It resolves a
selector against the glossary and fans workers out per in-scope entity in
parallel — the RISK track for issues and the
PATTERN track for patterns — merging everything into one
unified report that ends with a gated handoff to two user-invoked action
commands.
/audit stays read-only end to end — the
action layer is separate, gated, and user-invoked. A
typical analyze → act loop, with oop as the spine that is
fixed before other families:
/audit flags a god-class hotspot and, on the
PATTERN track, suggests Extract Class plus a facade to
tame the call sites.
/fix-risks god-class component src/ —
scoped to what it found.
entity-fixer refactors entity by entity and
verifies every change against your project's
own detected test, typecheck, and lint commands
before moving on.
Finds what's wrong: code smells, antipatterns, vulnerabilities, and supply-chain risks — graded by severity and correlated into hotspots in the unified report.
Two aspects: scan reports the design patterns already present, and fit suggests the most-suitable patterns to adopt — Strategy, Facade, Decorator and the rest of the GoF catalog.
What it finds
Detection is driven by a canonical glossary —
45 issues and 57 design patterns. A full
/audit fans out one worker per in-scope entity, so a complete
baseline is a single wall-clock pass.
God Class, Anemic Domain Model, Feature Envy, Inappropriate Intimacy,
Refused Bequest — the structural smells that erode encapsulation and
cohesion. oop is the spine, fixed first.
Spaghetti code, circular dependencies, the Yo-Yo problem, and other design-level antipatterns caught by universal principles — SOLID, Law of Demeter, DRY — not a per-language matrix.
The security family: injection, unsafe deserialization, secrets in source, and the OWASP-style risks that surface from language-neutral signs in any codebase.
Dependency and build-surface risks — unpinned or risky dependencies and the supply-chain weaknesses that don't show up in the application logic itself.
The PATTERN track's scan aspect reports the design
patterns already present — Strategy, Observer, Factory,
Adapter — so you can see the design you actually have.
The fit aspect suggests the most-suitable
patterns to adopt where they'd help — from creational and structural
to behavioral, architectural, and DDD.
What makes it excellence
glossary.json is the single source of truth — 102
entities with detection signs, principles, severity, and
cross-references. Add coverage by appending, not by writing agents.
Detection lives as universal design principles plus language-neutral signs — so it works in any language the model can read, with no per-language matrix to maintain.
The orchestrator selects in-scope entities and fans one generic worker out per entity in parallel, batched by family — a full baseline in one pass.
RISK and PATTERN findings merge into a single report with scoring, hotspots, and correlations — and a Recommended Actions handoff with real selectors and paths.
/fix-risks and /implement-patterns run your
project's own detected test/typecheck/lint command and
verify each change before moving on.
/audit never modifies code. The action commands are
disable-model-invocation — Claude never refactors on its
own; you invoke a fix by name.
Commands
/audit resolves a selector against the
glossary and zooms across three layers — track → aspect →
family / category / entity. Each selector takes an optional scope
suffix: full (default), changed (vs the base
branch), or component <path> (a single subtree).
| Selector | Resolves to |
|---|---|
/audit [scope] |
L1 (full) — both tracks in parallel, one unified report. |
/audit risks |
RISK track only (alias: /audit risk-scan). |
/audit patterns |
PATTERN track — both aspects (scan + fit). |
/audit pattern-scan |
Design patterns already present. |
/audit pattern-fit |
Most-suitable pattern suggestions. |
/audit <category> |
One category — e.g. vulnerability, design-pattern. |
/audit <family> |
One family — e.g. oop, security, behavioral. |
/audit <entity-id> |
A single entity or pattern — e.g. god-class, strategy. |
Take action — gated, user-invoked only
| Command | What it does |
|---|---|
/fix-risks <selector> [scope] |
Fixes risk findings entity by entity via
entity-fixer (OOP first), verified with the project's
own detected commands.
|
/implement-patterns <selector> [scope] |
Adopts suggested patterns via pattern-implementer,
applied through a safe parallel-change sequence + tests.
|
glossary |
Resolve any entity by id, list a family or category, or follow cross-references. Read-only. |
onboarding |
In-session orientation — the mental model and analyze → act flow. Read-only. |
Common runs: /audit,
/audit changed,
/audit risks,
/audit pattern-fit,
/audit god-class component src/.
Use cases
/audit gives one read-only, unified picture — smells,
antipatterns, vulnerabilities, and the patterns already in play —
before you touch a line.
/audit changed scopes the whole run to just the files
changed vs the base branch — a design-quality gate for the diff under
review.
Once the report flags it, /fix-risks god-class refactors
it entity by entity and verifies each step against your own tests.
/audit pattern-fit names the most-suitable patterns; then
/implement-patterns adopts them through a safe
parallel-change sequence.
/audit security narrows the RISK track to vulnerabilities
and supply-chain risks — language-neutral signs, any stack.
/audit <selector> component src/ scopes any run to a
single directory — handy for a service, a module, or a package you
own.
/audit changed is read-only end to end — run it on every
PR to catch design regressions before they ship.
/onboarding gives a read-only, in-session tour of the
mental model and the analyze → act flow — no docs to read first.
Get started
# In a Claude Code session — add the marketplace, then install
/plugin marketplace add odere-pro/claude-oop-excellence
/plugin install claude-oop-excellence@odere-pro
# Run your first audit — read-only, never changes code
/audit # whole project: both tracks, one unified report
/audit changed # only files changed vs the base branch
/audit god-class # a single entity
/audit never modifies
code — it ends with a Recommended Actions section that
prints the exact /fix-risks and
/implement-patterns commands to run next. Those actions are
disable-model-invocation (user-invoked only) and verify every
change against your project's own tests before moving on.
# Or load a local checkout for one session (development)
claude --plugin-dir /path/to/claude-oop-excellence
# then, in-session:
/reload-plugins
# Verify the install
/plugin # confirms claude-oop-excellence is enabled
/skills # /audit, glossary, onboarding registered
/agents # the oop-orchestrator + workers registered
/context # confirms ~zero idle context cost
New here?
# A read-only, in-session guided tour before you dive in
/onboarding
Questions
/audit change my code?/audit is read-only end to end — it never modifies code.
It produces one unified report ending with a Recommended Actions section
that prints the exact /fix-risks and
/implement-patterns commands to run next. Nothing changes
until you invoke one of those yourself.
/fix-risks,
/implement-patterns) are
disable-model-invocation, so they cost no standing context.
The worker subagents only cost tokens when an audit or action run spawns
them, and they fan out one per in-scope entity in parallel.
/fix-risks and /implement-patterns run your
project's own detected test, typecheck, and lint
commands — e.g. npm test, pytest,
make test, go test ./... — and verify each
change before moving on. There is no single-language tooling assumption.
skills/glossary/glossary.json is the single source of truth —
102 entities: 45 issues (code smells, antipatterns, vulnerabilities,
supply-chain risks) and 57 design patterns. Every detection sign,
principle, severity, and cross-reference lives there, so adding coverage
means appending to the glossary, not writing a new agent.
/plugin disable claude-oop-excellence turns it off;
/plugin uninstall claude-oop-excellence removes it entirely.
The plugin keeps no project-side state of its own — your code and tests
are the only artifacts it touches, and only through gated, user-invoked
actions.