enpitech-ai-tools
10 years of engineering judgment. One Claude plugin. Zero noise.
Open source Open in the app JSON README (API)
About
10 years of engineering judgment. One Claude plugin. Zero noise.
Details
- Kind
- Plugins
- Topic
- Government & public data
- Publisher
- enpitech
- Origin
- marketplace
- Category
- ferramentas
- Stars
- 1
- Forks
- 1
- Open pull requests
- 1
- Last push
- 2026-05-19T21:11:42Z
- Repository state
- ativo
- License
- MIT
- Added
- 2026-08-30 01:48:58
- Updated
- 2026-08-30 01:48:58
- Origin id
enpitech/ai-tools/enpitech-ai-tools
README
<div align="center">
<!-- Replace with your actual logo: add .github/assets/logo.png to the repo -->
<img src=".github/assets/banner2.png" alt="Enpitech" width="" />
<br />
<br />
# AI Tools
**We've distilled 10+ years of frontend and fullstack engineering into a structured AI toolkit —<br />a skills repository purpose-built for AI agents and LLMs.**
[](LICENSE)
[](https://code.claude.com/docs/en/plugins)
[](https://github.com/enpitech/ai-tools/actions)
[What's Inside](#whats-inside) · [Code Review](#code-review) · [Implementation Skills](#implementation-skills) · [All Skills](#available-skills) · [Installation](#installation) · [CI Setup](#ci-setup)
</div>
<br />
> **Built by [Enpitech](https://enpitech.dev)** | a comprehensive AI engineering toolkit for [Claude Code](https://docs.anthropic.com/en/docs/claude-code), VS Code Copilot, Cursor, and more. Multi-pass code review, Figma-to-code implementation, and growing. Works in CI and locally. Supports React, Node.js, Python, and any language.
<br />
## Install
In Claude Code, run these one by one:
```
/plugin marketplace add enpitech/ai-tools
```
```
/plugin install enpitech@enpitech
```
Then `/reload-plugins` to activate. Skills will be available under `/enpitech:<skill-name>`.
<br />
## What's Inside
This toolkit packages Enpitech's 10+ years of frontend and fullstack expertise into structured AI skills. Each skill gives your agent a **deterministic, repeatable process** — not a vague prompt, but a step-by-step system.
<table>
<tr>
<td width="50%">
### 🔬 Code Review
Multi-pass review system: 5–7 sequential passes per language. Bugs → Security → Architecture → Performance → Quality. CI-ready.
### 🎨 Figma → Code
Pixel-perfect implementation from Figma designs via MCP. Auto breakpoints, design tokens, asset export, visual verification.
### 🔄 Two review scopes
`cr-*` reviews PR diffs (CI + local).<br />`cra-*` audits the full codebase (local, includes deps).
</td>
<td width="50%">
### 🧠 Auto-detection
Fullstack and general skills detect your language and framework automatically.
### ⚡ CI-ready
Ships with a GitHub Actions workflow. Comment `/cr-react` on a PR → threaded review comments with `/fix` autofix support.
### 🛠 Customizable
All criteria live in plain markdown files. Add passes, change thresholds, adapt to your stack. More skills coming.
</td>
</tr>
</table>
<br />
## Example Use Cases
<table>
<tr>
<td>
#### 💬 PR review in CI
A developer opens a PR with React changes. A teammate comments `/cr-react`. Claude runs 7 review passes on the diff and posts a threaded comment with findings. Each finding ends with "reply `/fix`" and the summary ends with "reply `/fix-all`".
</td>
<td>
#### 🔍 Pre-merge local check
Before pushing a Node.js branch, run `/enpitech:cr-node` locally. Get a findings report, then choose: save to file, fix step by step (approve each change), or fix all at once.
</td>
</tr>
<tr>
<td>
#### 🏗 Full codebase audit
A tech lead assesses a Python project before a refactor. `/enpitech:cra-python` scans every file + system-level checks (dead code, circular imports, config drift) + full dependency audit.
</td>
<td>
#### 🎨 Figma to production code
A designer hands off a Figma section. `/enpitech:figma-to-code` pulls the design via MCP, classifies nodes as assets or UI elements, uses your design tokens, and screenshots every breakpoint until it matches.
</td>
</tr>
<tr>
<td>
#### 🌐 Fullstack cross-layer review
A PR touches React frontend and Express backend. `/enpitech:cr-fullstack` auto-detects the stack, applies the right passes per layer, and checks cross-layer issues like API mismatches and auth flow gaps.
</td>
<td>
#### 📦 Dependency health check
Before a release, `/enpitech:cr-deps` checks for CVEs, outdated packages, deprecated deps, license issues, unused packages, and lockfile integrity.
</td>
</tr>
</table>
<br />
---
## Available Skills
### Code Review
Two scope prefixes, applied uniformly across all languages:
| Prefix | Scope | Where | Includes deps? |
|--------|-------|-------|:---:|
| `cr-` | PR diff + affected files | CI + Local | ✗ |
| `cra-` | Full codebase audit | Local only | ✓ |
<br />
| Skill | Scope | What it does | CI Trigger |
|:------|:-----:|:-------------|:----------:|
| `cr-react` | Diff | 7-pass React/Next.js review | `/cr-react` |
| `cra-react` | Full | React audit + system checks + dep audit | — |
| `cr-node` | Diff | 7-pass Node.js review | `/cr-node` |
| `cra-node` | Full | Node.js audit + system checks + dep audit | — |
| `cr-python` | Diff | 7-pass Python review | `/cr-python` |
| `cra-python` | Full | Python audit + system checks + dep audit | — |
| `cr-general` | Diff | 5-pass language-agnostic review | `/cr-general` |
| `cra-general` | Full | General audit + system checks + dep audit | — |
| `cr-deps` | Deps | 6-pass dependency health audit | `/cr-deps` |
| `cr-fullstack` | Diff | Auto-detect stack + cross-layer checks | `/cr-fullstack` |
| `cra-fullstack` | Full | Full audit per layer + cross-layer + dep audit | — |
> All review skills report only **CRITICAL** and **WARNING** findings at **8/10+ confidence**.
<br />
### Implementation Skills
| Skill | What it does | Requirements |
|:------|:-------------|:-------------|
| `figma-to-code` | Pixel-perfect Figma → responsive production code. Auto breakpoints, DS tokens, asset export, visual verification loop. | Figma MCP + Playwright MCP |
<br />
---
## Detailed Review Passes
<details>
<summary><strong>React/Next.js</strong> — 7 passes</summary>
<br />
| Pass | Focus | Examples |
|:-----|:------|:--------|
| 1. BUGS | Logic errors | null access, race conditions, wrong conditionals |
| 2. SECURITY | Vulnerabilities | XSS, exposed secrets, unauthenticated Server Actions |
| 3. COMPONENT ARCHITECTURE | Structure | God components, prop drilling, cross-feature imports |
| 4. HOOKS & STATE | React patterns | Derived state in useEffect, stale closures, joinable hooks |
| 5. PERFORMANCE | Speed | Sequential awaits, missing dynamic imports, barrel file imports |
| 6. CODE QUALITY | React-specific | Array mutation, missing error boundaries, duplicated logic |
| 7. INTENT CHECK | PR scope | Unrelated changes that snuck into the diff |
**Context-aware**: React Compiler, Next.js SSR/RSC, design systems (`@radix-ui`, `shadcn`).
```
/enpitech:cr-react # PR diff review
/enpitech:cra-react # Full codebase audit + system checks + dep audit
```
</details>
<details>
<summary><strong>Node.js</strong> — 7 passes (OWASP + eslint-plugin-security)</summary>
<br />
| Pass | Focus | Examples |
|:-----|:------|:--------|
| 1. BUGS | Logic errors | Unhandled promise rejections, race conditions, event loop blocking |
| 2. SECURITY | Vulnerabilities | eval/exec injection, prototype pollution, ReDoS, SSRF, missing helmet/CSRF |
| 3. ASYNC PATTERNS | Event loop | Blocking calls in async, missing Promise.all, stream backpressure |
| 4. ERROR HANDLING | Resilience | Bare catch, missing error events, uncaughtException without exit |
| 5. API DESIGN | Express/Fastify | Missing request size limits, rate limiting, input validation, permissive CORS |
| 6. PERFORMANCE | Runtime | Sync fs/crypto ops, missing connection pooling, N+1 queries, memory leaks |
| 7. CODE QUALITY | Node-specific | `require(variable)`, `new Buffer()`, deprecated APIs, missing graceful shutdown |
**Context-aware**: Express, Fastify, Koa; TypeScript; Prisma, Sequelize, TypeORM, Mongoose.
```
/enpitech:cr-node # PR diff review
/enpitech:cra-node # Full codebase audit + system checks + dep audit
```
</details>
<details>
<summary><strong>Python</strong> — 7 passes (Bandit + Ruff + Pylint)</summary>
<br />
| Pass | Focus | Examples |
|:-----|:------|:--------|
| 1. BUGS | Logic errors | Mutable default arguments, loop variable closures, unreachable code |
| 2. SECURITY | Vulnerabilities | eval/exec, pickle, subprocess shell=True, SQL injection, unsafe YAML, XML attacks |
| 3. TYPE SAFETY | Type correctness | Missing annotations, inconsistent returns, overly broad `Any` |
| 4. ASYNC PATTERNS | asyncio/threading | Blocking in async, missing await, sync sleep, thread safety |
| 5. API DESIGN | Django/Flask/FastAPI | Missing auth decorators, debug mode, insecure uploads, rate limiting |
| 6. PERFORMANCE | Efficiency | Generator vs list comprehension, quadratic string concat, inefficient loops |
| 7. CODE QUALITY | Pythonic | Bare except, mutable defaults, unused imports, missing context managers |
**Context-aware**: Django, Flask, FastAPI, SQLAlchemy, Pydantic, pytest, mypy/pyright.
```
/enpitech:cr-python # PR diff review
/enpitech:cra-python # Full codebase audit + system checks + dep audit
```
</details>
<details>
<summary><strong>General — Any Language</strong> — 5 passes</summary>
<br />
Works with Vue.js, Angular, Svelte, Go, Rust, Ruby, PHP, Java, Kotlin, Swift, C#, and more.
| Pass | Focus | Examples |
|:-----|:------|:--------|
| 1. BUGS | Logic errors | Null access, resource leaks, concurrency issues, off-by-one |
| 2. SECURITY | Vulnerabilities | Injection, hardcoded secrets, insecure crypto, SSRF, XSS, CSRF |
| 3. ERROR HANDLING | Resilience | Silent failures, bare exception catching, missing cleanup |
| 4. PERFORMANCE | Efficiency | Blocking I/O, N+1 queries, quadratic algorithms, memory issues |
| 5. CODE QUALITY | Maintainability | Dead code, duplication, overly complex functions, deprecated APIs |
**Auto-detects** language and framework, then applies framework-specific checks (Vue `v-html` XSS, Go unchecked errors, Rails mass assignment, Laravel raw queries, Spring injection, etc.).
```
/enpitech:cr-general # PR diff review
/enpitech:cra-general # Full codebase audit + system checks + dep audit
```
</details>
<details>
<summary><strong>Dependencies</strong> — 6 audit passes</summary>
<br />
| Pass | Focus | What It Checks |
|:-----|:------|:---------------|
| 1. VULNERABILITIES | Security | `npm audit` / `pip-audit` — CVEs by severity |
| 2. OUTDATED | Freshness | Major version lag, security-related updates |
| 3. DEPRECATIONS | Lifecycle | Deprecated packages, suggested replacements |
| 4. LICENSE | Compliance | Copyleft in permissive projects, missing licenses |
| 5. UNUSED | Bloat | Declared but never imported dependencies |
| 6. LOCKFILE | Integrity | Missing lockfile, unpinned versions, sync issues |
Auto-detects npm, yarn, pnpm, pip, poetry, uv, pipenv.
```
/enpitech:cr-deps
```
> Runs standalone, or automatically as part of any `cra-*` full audit. Not included in `cr-*` diff reviews.
</details>
<details>
<summary><strong>Fullstack — Cross-Layer</strong> (Auto-Detect)</summary>
<br />
**Dynamically detects** which languages are in the project and applies the right criteria per layer:
| Detected | Criteria applied |
|:---------|:-----------------|
| React/Next.js | `rules/react.md` |
| Express/Fastify/Koa | `rules/node.md` |
| Django/Flask/FastAPI | `rules/python.md` |
| Vue, Angular, Svelte, Go, Rust, Ruby, PHP, Java, etc. | `rules/general.md` |
| Monorepo | Reads each workspace's config to classify |
**Stack examples:**
- React + Express → React passes on frontend, Node passes on backend
- Vue + Go → General passes on both (auto-adapted)
- React + FastAPI → React passes on frontend, Python passes on backend
**Cross-layer checks** (always applied):
1. API contract validation
2. Shared type drift
3. Environment variable hygiene
4. Authentication flow consistency
5. Error contract matching
6. Data flow security
7. API versioning & deprecation
```
/enpitech:cr-fullstack # PR diff + cross-layer checks
/enpitech:cra-fullstack # Full audit per layer + cross-layer + system checks + dep audit
```
</details>
<details>
<summary><strong>Figma → Code</strong> — Implementation Skill</summary>
<br />
Converts Figma designs into pixel-perfect, responsive, production-ready code using MCP tools.
| Step | What it does |
|:-----|:-------------|
| 1. Variables | Collects section name, Figma URL, node IDs, route, selector from user |
| 2. Baselines | Pulls mobile/tablet/desktop images via Figma MCP |
| 3. Token mapping | Auto-discovers breakpoints, maps design values to existing DS tokens |
| 4. Asset classification | Classifies each node as ASSET (export as-is) or UI ELEMENT (build with code) |
| 5. Scaffold | Generates responsive code using DS primitives and tokens |
| 6. Visual verification | Screenshots via Playwright MCP, compares to Figma baseline, iterates |
**Requires**: Figma MCP server + Playwright MCP server running.
**Policies**: No invented content/styles. No new breakpoints. No custom sizes outside token scale. Assets used as-is (never recreated with CSS).
```
/enpitech:figma-to-code # Interactive — asks for Figma URL and section details
```
</details>
<br />
---
## Installation
The skills and rules are structured markdown files. They work natively as a **Claude Code plugin**, but can also be used with **any AI coding assistant** that reads instructions from your repo — including VS Code with GitHub Copilot, Cursor, Windsurf, and others.
### Option A: Claude Code Plugin
**From a marketplace** search for "Enpitech" and install the "AI Tools" plugin. or in claude code, run:
```
/plugins install enpitech
```
**From a local directory:**
```bash
git clone https://github.com/enpitech/ai-tools.git
claude --plugin-dir ./ai-tools
```
Or add it permanently to your project's `.claude/plugins.json`.
Skills become `/enpitech:cr-react`, `/enpitech:cra-react`, `/enpitech:cr-node`, etc.
> **Note:** Plugins don't install workflow files. Copy the CI workflow manually:
> ```bash
> cp -r ai-tools/.github your-project/
> ```
### Option B: Copy into your project (works with any AI tool)
```bash
# Clone this repo
git clone https://github.com/enpitech/ai-tools.git
# Copy into your project
cp -r ai-tools/rules your-project/rules
cp -r ai-tools/skills your-project/skills
cp -r ai-tools/.github your-project/ # CI workflow (optional)
```
Once the files are in your repo, any AI coding assistant can use them:
| Tool | How it picks up the skills |
|:-----|:---------------------------|
| **Claude Code** | Reads `skills/` and `rules/` automatically. Invoke with `/cr-react`, `/cra-node`, etc. |
| **GitHub Copilot (VS Code)** | Reference the rules files as context in chat, or add them to `.github/copilot-instructions.md` |
| **Cursor** | Add rules files to `.cursor/rules/` or reference them in chat context |
| **Windsurf** | Reference the criteria markdown files as project context |
| **Other AI assistants** | Point the agent to the relevant `rules/*.md` file — they're self-contained review criteria |
> The `rules/*.md` files are the core value — they contain all the review criteria and work with any LLM. The `skills/*/SKILL.md` files add agent-specific automation (diff collection, file scanning, output formatting, MCP orchestration).
<details>
<summary><strong>Cherry-pick what you need</strong></summary>
<br />
**Rules** (review criteria — pick by language):
| File | Purpose |
|:-----|:--------|
| `rules/react.md` | React/Next.js 7-pass review criteria |
| `rules/node.md` | Node.js 7-pass review criteria |
| `rules/python.md` | Python 7-pass review criteria |
| `rules/general.md` | Language-agnostic 5-pass review criteria |
| `rules/deps.md` | Dependency audit criteria |
| `rules/fullstack.md` | Cross-layer check criteria |
| `rules/autofix.md` | Autofix workflow (local options + CI comment format) |
**Skills** (pick by language + scope):
| File | Skill |
|:-----|:------|
| `skills/cr-react/SKILL.md` | PR diff React review |
| `skills/cra-react/SKILL.md` | Full codebase React audit |
| `skills/cr-node/SKILL.md` | PR diff Node.js review |
| `skills/cra-node/SKILL.md` | Full codebase Node.js audit |
| `skills/cr-python/SKILL.md` | PR diff Python review |
| `skills/cra-python/SKILL.md` | Full codebase Python audit |
| `skills/cr-general/SKILL.md` | PR diff general review |
| `skills/cra-general/SKILL.md` | Full codebase general audit |
| `skills/cr-deps/SKILL.md` | Dependency health audit |
| `skills/cr-fullstack/SKILL.md` | PR diff fullstack review |
| `skills/cra-fullstack/SKILL.md` | Full codebase fullstack audit |
| `skills/figma-to-code/SKILL.md` | Figma → pixel-perfect production code |
</details>
<br />
---
## CI Setup
1. Copy `.github/workflows/claude-code-review.yml` into your repo
2. Add `ANTHROPIC_API_KEY` to your repo secrets (Settings → Secrets → Actions)
3. Comment one of these on any PR:
### Review Commands
| Trigger | Review Type |
|:--------|:------------|
| `/cr-react` | React/Next.js code review |
| `/cr-node` | Node.js code review |
| `/cr-python` | Python code review |
| `/cr-general` | Language-agnostic code review |
| `/cr-deps` | Dependency health audit |
| `/cr-fullstack` | Fullstack auto-detect + cross-layer |
> `cra-*` skills (full audits) are local-only and not triggered in CI.
### Autofix Commands
After a review posts findings, reply to apply fixes:
| Command | What it does | Reply to |
|:--------|:-------------|:---------|
| `/fix` | Apply the fix for a single finding | An individual finding comment |
| `/fix-all` | Apply all suggested fixes at once | The main review summary comment |
The autofix job checks out the PR branch, applies the fix(es), commits, and pushes automatically.
### How it works
The workflow:
- Detects the trigger keyword and selects the appropriate review criteria
- Only runs for repo collaborators (OWNER/MEMBER/COLLABORATOR)
- Posts a summary comment with all findings, each linking to `/fix`
- Posts individual finding replies with full details and suggested code changes
- `/fix` and `/fix-all` replies trigger a separate job that applies fixes and pushes
<details>
<summary><strong>Optional: Auto-trigger on PR</strong></summary>
<br />
Uncomment the `pull_request` trigger in the workflow:
```yaml
on:
pull_request:
types: [opened, synchronize]
issue_comment:
types: [created]
```
</details>
<br />
---
## Security
- Trigger restricted to repo OWNER/MEMBER/COLLABORATOR only
- Autofix only applies changes suggested in review findings — no arbitrary modifications
- Fix job requires explicit `/fix` or `/fix-all` reply from an authorized collaborator
- All commits are attributed to `github-actions[bot]`
## Customization
Edit the criteria files in `rules/` to add/remove review passes, adjust confidence thresholds, change severity levels, or add framework-specific checks.
| File | Controls |
|:-----|:---------|
| `rules/react.md` | React/Next.js review rules |
| `rules/node.md` | Node.js review rules |
| `rules/python.md` | Python review rules |
| `rules/general.md` | Language-agnostic review rules |
| `rules/deps.md` | Dependency audit rules |
| `rules/fullstack.md` | Cross-layer check rules |
| `rules/autofix.md` | Autofix workflow (local + CI) |
All review skills reference these files — single source of truth per concern.
Implementation skills like `figma-to-code` are self-contained in their `SKILL.md` — no separate rules file needed.
<br />
---
<div align="center">
**Built with ❤️ by [Enpitech](https://enpitech.com)**
MIT License
</div>
## Contributors
<a href="https://github.com/lirankor">
<img src="https://github.com/lirankor.png" width="60" height="60" style="border-radius:50%" alt="lirankor" />
</a>
<a href="https://github.com/nir2002">
<img src="https://github.com/nir2002.png" width="60" height="60" style="border-radius:50%" alt="nir2002" />
</a>
## License
MIT