{ "markdown": "
\n\n\"great_cto\"\n\n**Ship products with the coding agent you already have.**\n\n[![npm](https://img.shields.io/npm/v/great-cto?label=npx%20great-cto&color=cb3837)](https://www.npmjs.com/package/great-cto)\n[![npm downloads](https://img.shields.io/npm/dm/great-cto?color=cb3837&label=downloads)](https://www.npmjs.com/package/great-cto)\n[![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)\n[![Claude Code](https://img.shields.io/badge/Claude_Code-full_pipeline-blueviolet)](https://claude.com/claude-code) [![Codex](https://img.shields.io/badge/Codex-skills_·_MCP_·_second_opinion-blueviolet)](https://github.com/openai/codex)\n\n```bash\nnpx great-cto init\n```\n\n[Website](https://greatcto.systems) · [One real run →](https://greatcto.systems/proof) · [Live demo](https://greatcto.systems/r/CsqYVXs1Vibac5yp) · [Blog](https://greatcto.systems/blog/) · [Changelog](CHANGELOG.md)\n\n[Русский](docs/ru/README.md) · [简体中文](docs/zh-CN/README.md) · [繁體中文](docs/zh-TW/README.md) · [日本語](docs/ja/README.md) · [한국어](docs/ko/README.md) · [Español](docs/es/README.md) · [Português](docs/pt-BR/README.md) · [Deutsch](docs/de/README.md) · [Français](docs/fr/README.md)\n\n
\n\n---\n\ngreat_cto is the layer **around the coding agent you already run**. It drives\nyour Claude Code through a whole build and hands you a **repository you own** and\na **URL that already works**: architecture, data model, backend, frontend,\ngenerated tests and the deploy, finished. Not a plan. Not a prototype.\n\nThe one job it does that a prompt bundle does not: **it tells you what the agent\ndid not do.** A stage that was skipped, a review that never ran, a cost nothing\nmeasured — each renders as itself and is never counted as a pass. The proof is\nsubtraction: v3.27.0 and v3.27.1 deleted this project's own favourable\nnumbers — \"cost savings vs FTE\", a spend comparison against a human team, a\nprojected month — because none of them could be shown to be true.\n\nOn Codex the pipeline does not run: what runs there is the skills bundle and an\nMCP server. Codex's other job is to be the **second opinion** — from inside\nClaude Code it reads the same diff, and each review line carries the `sha` of the\ntree it read, so \"reviewed\" can be proven about *this* diff rather than asserted.\nThe log holds **4 lines so far, 1 carrying a sha**; no catch-rate is claimed\nfrom that, and none should be.\n\nIt is not a hosted app builder and does not replace your agent; without one there\nis nothing for it to orchestrate.\n\nSeven products built end to end in the open benchmark cost a **median of $171**\nin tokens, measured 2026-07. You pay your own LLM provider; great_cto bills you nothing and is MIT.\n\nYou are stopped **three times** — on *what* gets built, on *how*, and on *whether\nit ships*. Everything between those runs unattended, and it is the pipeline's job\nto be worth leaving alone: specialists with narrow jobs (architect,\ndesign-advisor, senior-dev, code-reviewer, QA, security, devops) and an\nindependent model checking each stage's work before the next one builds on it.\nThe full roster is in [docs/reference/agents.md](docs/reference/agents.md).\n\n```\n describe a product\n │\n 🤖 problem framed · options weighed · brief written\n ▼\n 👤 checkpoint 1 — approve WHAT gets built\n │\n 🤖 architecture · data model · screens · plan\n ▼\n 👤 checkpoint 2 — approve HOW it gets built\n │\n 🤖 scaffold → backend → frontend → tests → review → security\n ▼\n 👤 checkpoint 3 — approve the deploy\n │\n 🤖 deployed · repo · live URL\n```\n\nThree checkpoints is the **default**, not the floor. One line in `PROJECT.md`\ntakes it to one — you approve the deploy, and checkpoints 1 and 2 become a screen\nyou read rather than a form you fill:\n\n```\napproval-level: ship-only\n```\n\nSee [When it asks you](#when-it-asks-you).\n\n

\n \"The\n

\n\n

\n \"Terminal:\n

\n\nThe board at `localhost:3141` fills itself in — pipeline state, pending gates,\nper-agent cost, 30-day spend. You do not feed it; you check it. Four screens,\none question each: **Decisions** (what needs you — every gate with both\nreviewers' verdicts, sorted by cost of undo), **Ledger** (what it cost and what\nis running), **Fleet** (which agent to stop trusting — its tool grant, its\nruns, its spend), **Harness** (who is host, who gives the second opinion, and\nwhat it actually did). Settings sits behind the gear; `⌘K` finds any agent,\ndoc, session, memory or decision by name. Nothing on it renders an absence\nas a pass — a scan that never ran is `n/a`, never a green zero.\n\n## Numbers, measured\n\n| | |\n|---|---|\n| One feature, end to end, fully traced | **1h 26m · $3.40** in tokens — [the receipts](https://greatcto.systems/proof) |\n| A whole product — 7 built in the open benchmark | median **$171** in tokens · **70/100** quality (58–86) — [reproduce it](docs/benchmarks/BENCH-2026-07-batch1.md) |\n| Typical month, 20 pipeline runs | **~$34** — you pay your own LLM provider, nothing else |\n| Products it knows how to build | **60**, across 15 US industries, through [6 reusable pipelines](https://greatcto.systems/pipelines) |\n\nThe quality score is produced by running each product's own tests, not by\ncounting files — which is why it says 70 and not a rounder, prettier number.\n\n## Quick start\n\n```bash\nnpx great-cto init\n```\n\nRestart Claude Code, then:\n\n```bash\n/start \"build a dispatch & scheduling app for an HVAC business\"\n```\n\nThe pipeline takes it from there. Day to day you touch three things:\n\n| | |\n|---|---|\n| `/start \"…\"` | describe a product or feature — the pipeline runs it |\n| `/inbox` | what needs you: pending gates, P0s, blocked tasks |\n| `/digest` | weekly DORA metrics + cost-per-feature roll-up |\n\nRequires Node ≥ 18.17. Companion plugins (Superpowers, Beads) install\nautomatically. After init, verify the host actually loaded the plugin —\n`claude plugin list --json` should show no `errors` for `great-cto`.\n\n**On OpenAI Codex** (`npx great-cto init --host codex`) you get the **skills and\nthe MCP server** — not the pipeline above. Codex has no plugin surface for\nhooks, slash commands or role agents, so `/start`, `/inbox`, the gate chain and\n`secret-scan` do not run there. That is a limit of the host, not a setting:\n`hooks` in a plugin manifest is never read\n([openai/codex#16430](https://github.com/openai/codex/issues/16430),\n[#39895](https://github.com/openai/codex/issues/39895)). The installer prints\nthe same split before it does anything.\n\n**Two harnesses, one review.** Since 3.26.0 Codex *does* take part in the\npipeline — from inside Claude Code, as the second reviewer. Declare it once:\n\n```yaml\n# .great_cto/PROJECT.md\ncapabilities:\n second_opinion: codex # or: openrouter · none\n```\n\nand on every high-stakes change the Claude `code-reviewer` and **`codex exec`**\n(read-only sandbox, your Codex login, no API key) review the **same diff at the\nsame time**. Findings merge; a P0 from either side blocks; where they disagree,\nboth sets reach the human at the gate — the stricter one sets the verdict, and\nnobody averages. The board's **Harness** screen detects Codex, holds the choice,\nand shows beside it what the second opinion *did*: every run, including skipped\nones, from `.great_cto/cross-review.log`. Four states, and the fourth is the\npoint — *declared but unavailable* is never shown as *off*.\n\nHow much it helps is measured there, not asserted here. What the log holds so\nfar: the first real Codex review — of the commit that wired Codex in — found a\nP1 that the author and the test suite had both missed; the review of the fix\nfound nothing. Two runs is evidence of the mechanism, not a rate. The rate is\nthe card's job.\n\n## When it asks you\n\nOne setting in `.great_cto/PROJECT.md` decides where the pipeline stops:\n\n| `approval-level` | Stops you at | Stops |\n|---|---|---|\n| **`ship-only`** | **the deploy — and briefs you on what gets built** | **1** |\n| `product-only` | what we build · whether it ships | 2 |\n| `gates-only` *(default)* | what we build · the design · the deploy | 3 |\n| `strict` | the design · code review · the deploy | 3 |\n| `auto` | nothing in the pipeline | 0 |\n\nCounts are pipeline stops. Every level also carries one guard that is not a\nprocess choice: importing data over existing records stops you at **every**\nlevel, `auto` included, because that one destroys what was there.\n\n**`ship-only` is the minimum that is still honest.** One stop — the deploy, the\nonly decision whose consequence leaves your machine. The *what gets built*\ndecision does not vanish, because a pipeline that spends a day on the wrong thing\nis the expensive failure: it arrives as one screen in your console, printed once,\nbefore the build starts.\n\n```\nABOUT TO BUILD — say nothing and this proceeds, say something and it stops.\n\n What gets built: the offline-first checkout; ship the queue before the UI\n Why: reliability wins this segment, not features\n Stop if: under 20% of orders are created offline after four weeks\n Left open: which conflict rule for a re-submitted order\n\n Full brief: docs/product/BRIEF-checkout.md\n```\n\nSilence is consent, and the screen says so. If the brief cannot be read, the gate\ncomes back — \"I could not show you\" is never delivered as \"you were shown and\nsaid nothing\".\n\n`gates-only` gained the product gate in v3.0.0. It used to stop on *how* to build\nand *whether* to release, and never on *what* to build — the decision that is\nwrong for six stages before anyone finds out. It costs one pause per **product**,\nnot per feature: `product-owner` is an entry point and runs only from `/start`.\n\nA regulated archetype — fintech, healthcare, gov — keeps its security,\ncompliance and ship gates **at every level, including `auto`**. A lighter level\ndelegates judgement; it never skips compliance. Full table: [docs/GATES.md](docs/GATES.md).\n\n## The three doubts worth having\n\n**“I can't trust code I didn't watch being written.”**\nNeither do we, so nothing is taken on an agent's word about itself. Each stage is\nchecked against what it actually produced — do the named files exist, do the\nfrozen acceptance criteria pass when run, and only then is a separate model asked\nwhether each requirement is addressed. Where that check cannot tell, it returns\n`unverifiable`, which is **not** a pass.\n\n**“It will spend money while I sleep.”**\nPer-agent budgets decline to dispatch past their cap and name the number. A run\nwhose cost could not be measured reads `unmeasured` and holds nothing — a limit\nfiring on a number nobody measured is worse than no limit, and a confident\n`$0.00` for unmeasured work is how a spend goes unnoticed.\n\n**“And then I'm locked in.”**\nOne command to install, MIT, running on your machine against your own LLM\naccount. Delete great_cto and the repository it built is still yours — ordinary\nNext.js, Postgres and Stripe that any engineer can pick up.\n\n## What makes it different\n\n- **Specialists, not a generalist** — 70 agents with narrow jobs and their own\n review gates, instead of one assistant that types faster than it thinks.\n [The roster →](docs/reference/agents.md)\n- **Critics before code** — architecture, spec, and schema critics run before\n planning, where a mistake still costs hours instead of days.\n- **Scope enforced at write time** — an agent physically cannot touch files\n outside its brief. Not flagged at review; refused at write.\n- **QA that distrusts itself** — critical paths written as Gherkin before test\n code, then mutation testing asks whether the suite would catch anything at all.\n- **Memory across sessions** — decisions, lessons, and promoted patterns persist\n per project and globally; an interrupted run resumes knowing which stages ran.\n- **Cost you can see** — per-agent spend, estimate-vs-actual drift, and\n cost-per-accepted-change on the board, not in a spreadsheet.\n- **Spending caps that refuse** — `agent-budgets:` in PROJECT.md caps what a\n stage may spend, and the pipeline declines to dispatch past it, naming the\n number. An **estimate never refuses**: while no verdict carries a real cost the\n cap reads `unmeasured` and holds nothing, because a limit firing on a number\n nobody measured is worse than no limit. Set and cleared from the board.\n- **A stage is checked before the next builds on it** — the pipeline used to\n hand one agent's output to the next on the strength of a line the agent wrote\n about itself. Now a second model (Kimi K3 via OpenRouter) checks it, cheapest\n question first: do the files the verdict names exist, do the frozen\n `## ACCEPTANCE` criteria pass when run, and only then is a model asked whether\n each requirement is addressed. Three answers, never two — `verified`,\n `rework`, or **`unverifiable`**, which is not a pass: an agent that claims\n nothing and freezes no criteria is reported, or the cheapest way to pass\n becomes claiming nothing.\n- **Work goes back, and the return has a ceiling** — a stage that fails\n verification returns `REWORK` with the findings quoted, and the agent that just\n ran fixes it. Distinct from `BLOCKED`, which means a human must decide. After\n three passes it stops being the agent's problem and becomes one, because two\n machines handing work back and forth do not get bored.\n- **Quality kept apart from what happened** — the verdict says what a run did;\n a *score* says how well, in its own append-only store, produced by a different\n actor at a different time. A re-score appends rather than rewrites, several\n scorers can disagree about one run, and every score names who made it. An\n unassessed run counts as `null`, never zero — a pass rate divides by what was\n actually assessed and reports the rest beside it.\n- **Silence is recorded** — the dispatcher writes what it decided to\n `.great_cto/pipeline-runs.jsonl`, *including when it decided nothing* and why.\n Every pipeline defect found this year hid in the gap between \"nothing should\n happen\" and \"nothing could happen\".\n\nEverything runs locally, MIT-licensed, on your own keys. Your code stays on your\nmachine; prompts go to your LLM provider and nowhere else. Telemetry is\n**off by default** ([docs/PRIVACY.md](docs/PRIVACY.md)).\n\n## Limitations\n\n- **For one builder** — a solo founder or CTO. Two or more engineers sharing the\n pipeline have outgrown it.\n- **Not a CI/CD system** — gates run locally; you still merge through GitHub Actions.\n- **Not certification-audited** — PCI/HIPAA/SOC2 scaffolds are starting points,\n not certifications.\n- **Not deterministic** — LLM output. Gate verdicts deserve a sanity check.\n- **Spend is measured, attribution is not yet per-agent** — cost is read from\n the host's own session transcript rather than from an agent's self-report, so\n the tokens are real. But the transcript the hook is handed covers the session,\n not one subagent, so a run's cost can be attributed to whichever stage finished\n last — inflated by orders of magnitude. Treat per-agent figures as a ceiling\n until this is fixed. A stage with no measurement at all still shows\n `unmeasured` rather than a confident `$0.00`, and budgets do not fire for it.\n\n## Documentation\n\n**[Docs hub →](docs/README.md)** ·\n[Getting started](docs/tutorials/getting-started.md) ·\n[Gates & approval levels](docs/GATES.md) ·\n[Agents](docs/reference/agents.md) · [Commands](docs/reference/commands.md) ·\n[Archetypes](docs/ARCHETYPES.md) · [Architecture](docs/ARCHITECTURE.md) ·\n[MCP](docs/MCP.md) · [FAQ](docs/FAQ.md) ·\n[Everything else](docs/DETAILS.md) — critics, jurisdictions, cost breakdown, CI, alerts\n\n## Community\n\n[Issues](https://github.com/avelikiy/great_cto/issues) ·\n[Discussions](https://github.com/avelikiy/great_cto/discussions) ·\n[Blog](https://greatcto.systems/blog/) ·\n[Security policy](SECURITY.md) · [Contributing](CONTRIBUTING.md)\n\nMIT — [LICENSE](LICENSE). Built by [@avelikiy](https://github.com/avelikiy):\nCTO building AI-native trading and fintech platforms; great_cto is my own loops,\nautomated one agent at a time.\n\nIf it saved you time, a star helps other solo builders find it.\n\n
\n\n*Stop being the only person who can ship.*\n\n
\n", "bytes": 16683, "sha": "d09d33e05aa47dca160cf3717dc0ed6b5f737e98ba77eea778d1daf76f5ef6dc", "repo_slug": "avelikiy/great_cto", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/plg_avelikiy_great_cto_great_cto_abf65d56/readme" }