SkillsAdd

endorlabs/ai-plugins

endor-agent-kit-setup

Use when setting up Endor Labs Agent Kit for Claude Code, checking readiness, verifying Endor auth, choosing namespaces, or diagnosing missing endorctl, gh, Endor MCP, or workflow prerequisites.

First seen Jun 10, 2026

Installation

$ npx skills add endorlabs/ai-plugins --skill endor-agent-kit-setup
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Shared topics
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
vercel-react-best-practices Shared topics
vercel-labs/agent-skills 697.8K installs
web-design-guidelines Shared topics
vercel-labs/agent-skills

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…

617.3K installs
microsoft-foundry Shared topics
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
azure-hosted-copilot-sdk Shared topics
microsoft/azure-skills 440.4K installs
azure-enterprise-infra-planner Shared topics
microsoft/azure-skills

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud a…

402.8K installs

Also in this package

Other skills from endorlabs/ai-plugins · top by installs.

npx skills add endorlabs/ai-plugins
endor-setup 58 ai-sast-triage 19 sca-remediation 19 endor-troubleshooter 18 malware-response 18 probe-droid 18 package-risk-summary 16 findings-browser 16 repository-dependency-reviewer 15 dependency-decision-helper 15

Browse all from endorlabs/ai-plugins

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 9
License LICENSE
Default branch main
Open issues 0
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Declared agents claude-code

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 9,879 B
  • docs SUMMARY.md 223 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 18 installs

SKILL.md

Endor Agent Kit Setup For Claude Code

Generated for the Endor Labs Agent Kit Claude Code plugin.

Claude Install And Upgrade Notice

  • endor-labs-agent-kit@endorlabs is the preferred Claude Code plugin id for new installs.
  • Existing ai-plugins@endorlabs users can keep using the legacy compatibility package.
  • Do not enable both Claude plugin ids in the same profile because they expose the same agents and setup skill.
  • The plugin does not auto-disable, uninstall, or edit Claude settings for either id.

Bundled Claude Code Agents

  • AI SAST Remediation -> Claude Code agent ai-sast-remediation
  • CI/CD And Supply Chain Posture -> Claude Code agent cicd-posture
  • Configuration Automation -> Claude Code agent configuration-automation
  • Dependency Reviewer -> Claude Code agent dependency-reviewer
  • Findings Browser -> Claude Code agent findings-browser
  • Malware Responder -> Claude Code agent malware-responder
  • OSS Upgrade Investigator -> Claude Code agent oss-upgrade-investigator
  • Remediation Planning -> Claude Code agent remediation-planning
  • SCA Remediation -> Claude Code agent sca-remediation
  • Troubleshooting -> Claude Code agent troubleshooting
  • Vulnerability Explainer -> Claude Code agent vulnerability-explainer

Claude Code Plugin Install Commands

From the public ai-plugins distribution repository:

/plugin marketplace add endorlabs/ai-plugins
/plugin install endor-labs-agent-kit@endorlabs

From a local checkout of the Agent Kit repository root:

/plugin marketplace add ./
/plugin install endor-labs-agent-kit@endorlabs

For package-only local validation, add the generated Claude marketplace:

/plugin marketplace add ./plugins/claude
/plugin install endor-labs-agent-kit@endorlabs

Endor Agent Kit Setup

Use this setup workflow when the user asks to install, check, update, or remove Endor Labs Agent Kit plugin support files, or when an Endor Agent Kit workflow is blocked by missing endorctl, GitHub CLI, authentication, namespace, or local toolchain readiness.

Setup Contract

Be proactive about checking the environment, but do not make persistent changes without explicit user approval. Report evidence for each check. Never print secret values.

Setup may:

  • Inspect command availability and versions for endorctl, gh, git, and

workflow-relevant language tooling.

  • Read ENDOR_NAMESPACE from the current process environment and report it as

namespace provenance when present.

  • Safely parse ~/.endorctl/config.yaml for non-secret fields such as

ENDORAPI and ENDORNAMESPACE.

  • Report the presence of credential fields by key name only.
  • Report the presence of ENDORAPICREDENTIALS_* authentication variables by

key name only.

  • Run lightweight read-only Endor auth verification when config or credentials

are present.

  • Offer re-authentication when verification fails.
  • Check gh authentication and point to official installation guidance.
  • Inspect Endor MCP support when a selected workflow needs MCP or the user asks

for MCP setup.

  • Offer host-specific Endor MCP configuration only after explaining the exact

file, command, and validation step.

  • Install, update, or uninstall host-specific Agent Kit support files only after

explicit approval.

Setup must not:

  • Run endorctl scan.
  • Run endorctl host-check.
  • Print ~/.endorctl/config.yaml or secret values.
  • Read, cat, source, recurse through, or point ENDORCTL_CONFIG or

--config-path at tenant-specific, customer-specific, production, backup, or other non-default Endor config directories.

  • Ask the user to paste API keys, API secrets, tokens, or passwords into chat.
  • Write ENDORAPICREDENTIALSKEY or ENDORAPICREDENTIALSSECRET.
  • Edit shell profile files such as .zshrc, .bashrc, or PowerShell profile.
  • Install gh, package managers, language runtimes, Docker, JDKs, or build

tooling.

  • Configure MCP globally without explicit user approval. MCP remains opt-in per

recipe/workflow.

Readiness Report

Start with a concise readiness report. Separate configured state from verified state.

Include these sections when relevant:

  • Ready
  • Needs action
  • Optional checks
  • Available fixes

For Endor auth, report sanitized fields only:

Endor config: found
API endpoint: https://api.endorlabs.com
Namespace candidates:
- ENDOR_NAMESPACE: not set
- ~/.endorctl/config.yaml ENDOR_NAMESPACE: example-namespace
Selected namespace: example-namespace from ~/.endorctl/config.yaml
Auth: API credential fields present
Endor auth: verified for namespace example-namespace
Secret values: hidden

If a namespace is missing, say that a namespace is required before live Endor lookups. If a namespace is detected, let the user use it or override it for the current workflow.

If ENDOR_NAMESPACE from the current process environment and ~/.endorctl/config.yaml disagree, surface both values and stop before live Endor lookups. Ask the user which namespace to use for this workflow. Do not silently trust either value, and do not unset environment variables or edit config files unless the user explicitly asks for that separate operational cleanup.

When the user selects or supplies a namespace, later workflow agents must pass it explicitly with -n <namespace> or --namespace <namespace> for scoped Endor lookups rather than relying on bare endorctl namespace resolution.

Endor Tooling

If endorctl is missing, offer documented install options in this order:

  1. Package manager route when available, such as Homebrew or npm.
  2. Direct binary download with checksum verification.

Only install endorctl after explicit approval. If installing to ~/bin, tell the user how to update PATH for the current shell. Do not edit shell profiles.

If API credential fields are present, do not run browser auth unless the user explicitly asks to switch or re-authenticate. If API credential setup is needed, tell the user to set ENDORAPICREDENTIALSKEY and ENDORAPICREDENTIALSSECRET through their preferred secure environment mechanism.

When browser or SSO authentication is requested, confirm the namespace first. Use non-interactive flags where supported. If multi-tenant selection appears, summarize the available tenant choices and ask the user before retrying.

Endor MCP

Require endorctl agent api --help to succeed for workflows that use Endor CLI API calls. Each selected workflow must pass its canonical recipe id through --agent-id; never fall back to the unattributed legacy API command. Configure Endor MCP only when a selected MCP-capable workflow needs it or the user explicitly asks for it.

The distribution may include ready-to-use Endor MCP config snippets such as root .mcp.json or Gemini mcpServers metadata. Treat those files as setup inputs, not permission to start or register MCP without approval.

When MCP setup is requested:

  1. Check whether npx is available.
  2. Check whether endorctl is available.
  3. Verify the proposed server command is:

npx -y endorctl ai-tools mcp-server.

  1. Inspect the host-specific MCP config location or installed plugin metadata.
  2. If endor-cli-tools is already registered, report it and ask before

changing anything.

  1. If it is missing, show the exact config that would be added and ask for

approval before writing host config files.

  1. After approval and configuration, validate in a fresh host session when the

host supports tool visibility checks.

Do not claim Endor MCP tools are available to a workflow until the host exposes them in the current session. If MCP tools are unavailable, continue with CLI-first workflows when they support endorctl agent api --agent-id <canonical-recipe-id>; otherwise record the missing MCP capability in data_gaps.

GitHub CLI

Check gh auth status when workflows need GitHub evidence, repository inventory, pull requests, or comments. If gh is missing, provide current official installation guidance instead of installing it automatically.

Do not manage GitHub token scopes or create personal access tokens. Verify only the specific read or write capability needed for the selected workflow.

Language Tooling

Detect and report workflow-relevant package managers, language runtimes, and build tools. Do not install them.

When tooling is missing, report the affected validation step and ask the user to install it through their team-standard toolchain.

Workflow Safety

Setup never performs remediation, creates branches, opens PRs/MRs, posts comments, writes Endor policies, or runs scans. Mutating workflows such as SCA Remediation and AI SAST Remediation keep those actions behind their generated agent approval gates.

Claude-Specific Rules

  • Prefer the default Claude Code user-scope plugin install unless the user explicitly requests project, local, or managed scope.
  • Do not copy plugin-packaged agents into .claude/agents/ when marketplace installation is available.
  • Do not add plugin-wide MCP automatically. Only guide per-workflow MCP setup when the selected workflow needs it and the user approves.
  • The primary endor-labs-agent-kit plugin also ships advisory hooks for prompt routing, dependency installs, and dependency manifest edits. Hooks are fail-open, read-only, and never run Endor commands.
  • Claude Code plugin-shipped agents cannot declare mcpServers, permissionMode, or hooks in agent frontmatter; report unavailable MCP-only signals in data_gaps.
  • Tell the user to restart or reload Claude Code after installing or updating the plugin.