GreatCTO — Summary

Slug: greatcto
GitHub: https://github.com/avelikiy/great_cto
Stars: 32
License: MIT
Language: JavaScript/TypeScript (Node.js 18.17+)
Version: 2.22.1
Status: Active (last commit 2026-05-26)

What It Is

GreatCTO is a Claude Code plugin that provides a full SDLC pipeline with 57 specialist agents, two human approval gates, compliance-aware jurisdiction detection, and a local Kanban dashboard. It targets solo founders and small engineering teams (up to 50 engineers).

Core pitch: "You make two decisions per feature. Everything else runs automatically."

Two-Gate Pipeline

/start "describe the feature"
     ↓
Critics (architecture + spec + schema critics run first)
     ↓
gate:plan  ← Human approval (architecture + tasks + cost)
     ↓
senior-dev → 12-angle review → qa-engineer → security-officer → devops
     ↓
gate:ship  ← Human approval (PR ready, security signed off)
     ↓
Deployed

By the Numbers

• 57 specialist agents (architect, PM, senior-dev, QA, security, devops, 30 archetype-specific reviewers, 16 domain/compliance packs)
• 39 commands
• 13 skill areas
• 25 archetypes auto-detected from PROJECT.md
• 12 jurisdictions (GDPR, HIPAA, PCI-DSS, SOX, DPDPA, etc.)
• 33+ compliance frameworks
• 7 hook event types (full Claude Code hooks coverage)

Dependencies

• superpowers (superpowers-marketplace)
• beads (local) — task tracking (bd CLI)

Cost Claim

• One real feature traced: $2.39 LLM cost vs ~$5,460 human-equivalent
• Monthly estimate: ~$34 for 20 pipeline runs
• 2 defects caught that QA had missed

GreatCTO — Overview

Origin and Positioning

Created by avelikiy. Website: https://greatcto.systems

Target: "The engineering process for solo founders and teams up to 50 engineers — without the overhead."

The positioning is explicitly NOT a general coding agent loop, but the orchestration layer above the coding agent: "Think 'specialist team that reviews and gates the work' rather than 'another assistant that types code.'"

README explicitly disclaims team use: "Built for the one-person engineering org." FAQ has a dedicated entry: "Not for teams."

Comparative Claim

Philosophy

Three core beliefs:

1. Critics before code — architecture, spec, and schema critics run before implementation, when reverting is cheap
2. Specialist vs generalist — routing to domain-specific agents (pci-reviewer, gdpr-reviewer, fda-reviewer) catches domain-specific bugs that a generalist misses
3. Two human gates — operators decide at plan (architecture + tasks) and ship (PR ready, security), not at every intermediate step

Pipeline Logic

The core pipeline (architect → pm → gate:plan → senior-dev → review → qa → security → devops → gate:ship) adapts per project:

• Fintech EU: adds pci-reviewer, gdpr-reviewer, regulated-reviewer; extra gates for GDPR DPIA and PCI audit
• Healthcare US: adds fda-reviewer, healthcare-reviewer, security-officer; adds clinical-validation gate
• CLI tool: adds cli-reviewer; gate:plan is the only human gate

Multi-language Docs

README translated to: Russian, Simplified Chinese, Traditional Chinese, Japanese, Korean, Spanish, Portuguese, German, French.

GreatCTO — Architecture

Distribution

• Install: npx great-cto init
• npm package: great-cto
• Type: Claude Code plugin (plugin.json)
• Plugin ID: great_cto

Repo Structure

great_cto/
├── .claude-plugin/
│   ├── plugin.json        # Plugin registration (hooks, MCP servers, metadata)
│   └── settings.example.json
├── agents/
│   ├── _shared/           # Shared agent contracts (artifact-summary, verdict-format, etc.)
│   ├── architect.md       # claude-opus-4-7, 30 maxTurns, 1200s timeout
│   ├── pm.md
│   ├── senior-dev.md
│   ├── qa-engineer.md
│   ├── security-officer.md
│   ├── devops.md
│   ├── l3-support.md
│   ├── project-auditor.md
│   ├── performance-engineer.md
│   ├── continuous-learner.md
│   ├── knowledge-extractor.md
│   ├── decision-scorer.md
│   └── [30+ domain/compliance reviewer agents]
├── commands/              # 39 Claude Code slash commands
├── skills/
│   ├── great_cto/         # Main skill (SKILL.md routing table, ARCHETYPES.md, TYPE_MAP.md)
│   ├── anti-patterns/
│   ├── archetype-review-base/
│   ├── cost-model/
│   ├── crystallize/
│   ├── decision-eval/
│   ├── discovery/
│   ├── done-blocked/
│   ├── pm-planning/
│   ├── pre-mortem/
│   ├── prose-style/
│   ├── skeptical-triage/
│   └── well-architected/
├── mcp-servers/
│   └── llm-router/
│       └── server.py      # Python MCP: great_cto_llm_router (OpenRouter)
├── packages/
│   └── board/
│       └── server.mjs     # Zero-dependency Node.js board server (localhost:3141)
├── scripts/
│   └── hooks/             # Hook implementations (secret-scan.mjs, format-check.mjs, etc.)
├── .beads                 # Beads task tracking integration
└── CLAUDE.md              # Agent instructions for contributors

State Files

MCP Server

"great_cto_llm_router": {
  "command": "python3",
  "args": ["${CLAUDE_PLUGIN_ROOT}/mcp-servers/llm-router/server.py"],
  "env": {
    "OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}",
    "GREAT_CTO_ROUTER_MODEL": "...",
    "GREAT_CTO_ROUTER_MAX_TOKENS": "...",
    "GREAT_CTO_ROUTER_TIMEOUT": "..."
  }
}

Provides mcp__great_cto_llm_router__ask_kimi tool used by the architect agent for external model consultation.

Plugin Dependencies

• superpowers@superpowers-marketplace — writing-plans, requesting-code-review skills
• beads@local — bd CLI for Beads task tracking (board UI, gate management)

GreatCTO — Components

Commands (39 slash commands)

Agents (57 specialists)

Core Pipeline Agents

Domain Compliance Reviewers

pci-reviewer, gdpr-reviewer, us-privacy-reviewer, dpdpa-reviewer, fda-reviewer, healthcare-reviewer, ai-clinical-reviewer, clinical-trials-reviewer, digital-health-reviewer, bio-data-reviewer, drug-discovery-ml-reviewer, glp-glab-reviewer, lab-automation-reviewer, biosecurity-reviewer, robotics-safety-reviewer, hr-ai-reviewer, edtech-reviewer, gov-reviewer, game-reviewer, enterprise-saas-reviewer, insurance-reviewer, lending-credit-reviewer, emerging-markets-fintech-reviewer, climate-mrv-reviewer, voice-ai-reviewer

Technical Reviewers

db-migration-reviewer, infra-reviewer, cli-reviewer, web-store-reviewer, mobile-store-reviewer, library-reviewer, api-platform-reviewer, mlops-reviewer, data-platform-reviewer, streaming-reviewer, marketplace-reviewer, cms-reviewer, firmware-reviewer, oracle-reviewer, regulated-reviewer, devtools-reviewer

Skills (13)

Hooks (7 event types)

Beads Integration (bd CLI)

Beads is the task tracking backend. Commands used:

• bd prime — cache task state
• bd list --label gate --status open — list open gates
• bd list --status open — list open tasks
• bd ready — show ready tasks

Gates are tracked as Beads items with --label gate.

GreatCTO — Uniqueness and Positioning

Differs from Seeds

GreatCTO is the most compliance-aware framework in this batch or the seeds. No other framework has 33+ compliance frameworks, 12 jurisdiction detectors, or domain-specific agents for FDA SaMD review, AEDT bias audit, GLP audit, or biosafety.

Versus superpowers (GreatCTO's primary dependency): Superpowers provides writing-plans and code-review skills. GreatCTO builds a complete opinionated SDLC pipeline on top.

Versus bernstein (also has compliance focus): Bernstein's compliance angle is audit trail (HMAC-SHA256, JWS, EU AI Act, SOC2 readiness) — it's about proving what happened. GreatCTO's compliance angle is agent routing — dispatching the right regulatory reviewer (fda-reviewer, pci-reviewer, gdpr-reviewer) before code is merged. Different layers of compliance.

Versus taskmaster-ai (task decomposition): Taskmaster decomposes tasks but doesn't execute them or gate them with specialist review. GreatCTO executes the full pipeline.

Versus claude-flow (parallel swarm): claude-flow uses a homogeneous worker pool with LLM coordination. GreatCTO uses named specialists with deterministic routing tables.

Distinctive Features

1. 57 specialist agents — the largest named agent catalog in this batch. No other framework reviewed has more than 15 named subagents.

2. Jurisdiction auto-detection — npx great-cto init reads README + infra files to detect applicable regulations (GDPR, HIPAA, PCI-DSS, DPDPA, etc.) and generates a project-specific pipeline. No other framework does regulatory-aware pipeline generation.

3. 12-angle code review — the specialist auto-attach pattern routes each PR diff to the appropriate domain reviewer(s) based on file patterns. A payment endpoint gets pci-reviewer. A migration gets db-migration-reviewer. A prompt file gets ai-security-reviewer. All automatically.

4. Critics before plan — three critic agents (architecture, spec, schema) run before the plan gate, catching the most expensive bugs before code is written. This "adversarial pre-plan" pattern is unique.

5. 11-layer memory with /crystallize — the global pattern library (GP-*.md files built from session incidents) gives agents actionable patterns before they re-solve known problems. The memory architecture is the most elaborate of any framework in this batch.

6. Zero-dependency board server — packages/board/server.mjs is explicitly a zero-dependency Node.js server with SSE. This ensures the dashboard works without npm install in CI/CD environments.

7. Explicit "not for teams" positioning — actively discourages the product from being used by large teams, avoiding feature bloat. Most frameworks position for scale; GreatCTO positions for solo/small.

Observable Failure Modes

1. Plugin dependency chain: requires superpowers + beads to be functional. If either dependency has an issue, the pipeline breaks.
2. SessionStart hook complexity: the hook is 100+ lines of shell commands. A failure in early parts (e.g., plugin dir not found) silently degrades context injection.
3. Specialist routing false negatives: SKILL.md routing covers ~40 patterns, but an unusual file path or unfamiliar framework won't trigger specialist routing — falls back to general-purpose.
4. Cost visibility lag: cost tracking requires reading Claude Code's token usage; if the API changes, cost-guard.mjs may report inaccurately.
5. 32 stars: very small community. Active maintainer but limited external vetting.