VibeControls plugin catalogue
Meta interfaces, concrete providers, standalone tools — the agent ships small. Install what you need. Build your own with the Plugin SDK.
Every plugin and the Plugin SDK are open source under the MIT License. The@vibecontrols/agentruntime that loads them is closed-source.
Meta plugins
Each meta plugin owns one interface contract. Providers below implement that contract for a specific backend. Standalone tools sit alongside the hierarchy.
AI
AI tool orchestrator — one interface, many providers (Claude, Codex, Gemini, Copilot, Aider, OpenCode, Plandex, OpenAI-compatible).
@vibecontrols/vibe-plugin-aiSecurity
Security lifecycle orchestrator — dispatches every dev / pr / merge / build / release stage to the right per-stage security provider.
@vibecontrols/vibe-plugin-securityGitOps
GitOps orchestrator — one interface for GitHub, GitLab, Bitbucket Cloud, and Azure DevOps repo / PR / CI / security queries.
@vibecontrols/vibe-plugin-gitopsPlan
Plan orchestration meta-plugin — owns the PlanProvider contract and dispatches to plan-mode providers like Plannotator.
@vibecontrols/vibe-plugin-planStorage
Storage meta plugin — owns the AgentDatabase contract so embedded and shared backends are interchangeable behind one API.
@vibecontrols/vibe-plugin-storageSession Manager
Unified session manager — capability discovery, feature negotiation, and provider routing across tmux, WezTerm, and Zellij.
@vibecontrols/vibe-plugin-session-managerTunnel
Unified tunnel manager — routes requests across registered tunnel providers (Cloudflare, VibeTunnels).
@vibecontrols/vibe-plugin-tunnelAll plugins (56)
AI
AI tool orchestrator — one interface, many providers (Claude, Codex, Gemini, Copilot, Aider, OpenCode, Plandex, OpenAI-compatible).
@vibecontrols/vibe-plugin-aiSecurity
Security lifecycle orchestrator — dispatches every dev / pr / merge / build / release stage to the right per-stage security provider.
@vibecontrols/vibe-plugin-securityGitOps
GitOps orchestrator — one interface for GitHub, GitLab, Bitbucket Cloud, and Azure DevOps repo / PR / CI / security queries.
@vibecontrols/vibe-plugin-gitopsPlan
Plan orchestration meta-plugin — owns the PlanProvider contract and dispatches to plan-mode providers like Plannotator.
@vibecontrols/vibe-plugin-planStorage
Storage meta plugin — owns the AgentDatabase contract so embedded and shared backends are interchangeable behind one API.
@vibecontrols/vibe-plugin-storageSession Manager
Unified session manager — capability discovery, feature negotiation, and provider routing across tmux, WezTerm, and Zellij.
@vibecontrols/vibe-plugin-session-managerTunnel
Unified tunnel manager — routes requests across registered tunnel providers (Cloudflare, VibeTunnels).
@vibecontrols/vibe-plugin-tunnelAider
Aider CLI agent — pair programmer that edits your local git tree.
@vibecontrols/vibe-plugin-ai-aiderAmp
Sourcegraph Amp — agentic IDE actions backed by your codebase index.
@vibecontrols/vibe-plugin-ai-ampClaude
Anthropic Claude Code agent — the default reference provider.
@vibecontrols/vibe-plugin-ai-claudeCodex
OpenAI Codex CLI — agentic coding from OpenAI.
@vibecontrols/vibe-plugin-ai-codexGitHub Copilot
GitHub Copilot CLI for the agent runtime.
@vibecontrols/vibe-plugin-ai-copilotCharm Crush
Charm Crush AI agent provider — TUI-native chat.
@vibecontrols/vibe-plugin-ai-crushCursor
Cursor CLI + SDK — bring your Cursor experience into the agent.
@vibecontrols/vibe-plugin-ai-cursorGemini
Google Gemini CLI provider — Gemini Pro 1.5 / 2.0 ready.
@vibecontrols/vibe-plugin-ai-geminiGoose
Block Goose agent provider for VibeControls.
@vibecontrols/vibe-plugin-ai-gooseMinimax
Minimax CLI + Anthropic-compatible SDK provider.
@vibecontrols/vibe-plugin-ai-minimaxOllama
Ollama (local + cloud) — self-hosted models, BYOK API key.
@vibecontrols/vibe-plugin-ai-ollamaOpenAI-compatible
Any OpenAI-compatible endpoint — point it at vLLM, LM Studio, Bedrock proxies, etc.
@vibecontrols/vibe-plugin-ai-openai-compatOpenCode
OpenCode CLI agent provider.
@vibecontrols/vibe-plugin-ai-opencodeOpenRouter
OpenRouter SDK provider — pay-as-you-go to 100+ models.
@vibecontrols/vibe-plugin-ai-openrouterPi
Pi.ai conversational agent provider.
@vibecontrols/vibe-plugin-ai-piPlandex
Plandex multi-step AI engineering agent.
@vibecontrols/vibe-plugin-ai-plandexArchive Offboard
Writes tombstone.json evidence at archive.offboard for SOC2/ISO retention proofs.
@vibecontrols/vibe-plugin-security-archiveDAST (preview)
OWASP ZAP baseline DAST scan against alpha preview URLs at deploy.preview.
@vibecontrols/vibe-plugin-security-dast-previewDeploy alpha smoke
TLS / HSTS / CSP smoke checks for alpha environment URLs at deploy.alpha.
@vibecontrols/vibe-plugin-security-deploy-alphaDeveloper local
Local pre-commit secrets scanner (gitleaks protect) — runs on the developer machine.
@vibecontrols/vibe-plugin-security-developer-localIncident response
Targeted incident-response scanner for incident.response lifecycle stage.
@vibecontrols/vibe-plugin-security-incidentRepo onboard
Repo profile detector — picks the right policy bundle on repo.onboard.
@vibecontrols/vibe-plugin-security-onboardPackage publish
Cosign signing + SLSA provenance at package.publish.
@vibecontrols/vibe-plugin-security-package-publishRelease gate
OPA-backed release-gate at promote.prod — block on policy, evidence-required deploys.
@vibecontrols/vibe-plugin-security-release-gateScheduled rescan
Nightly Grype offline rescan against last-built SBOMs.
@vibecontrols/vibe-plugin-security-rescanRuntime continuous
Trivy + kube-bench continuous runtime checks against live workloads.
@vibecontrols/vibe-plugin-security-runtimeSAST deep
Full SAST + SCA sweep (Semgrep + osv-scanner) on pull_request.deep.
@vibecontrols/vibe-plugin-security-sast-deepSBOM build
Syft CycloneDX SBOM + Grype scan at build lifecycle stage.
@vibecontrols/vibe-plugin-security-sbom-buildOpenSSF Scorecard
OpenSSF Scorecard checks at main.merge — track posture over time.
@vibecontrols/vibe-plugin-security-scorecardSecrets (PR)
Gitleaks-backed secret scanner for pull_request.fast — fail fast on PR.
@vibecontrols/vibe-plugin-security-secrets-prGitHub
GitHub provider for the GitOps meta plugin — REST v3 + GraphQL v4.
@vibecontrols/vibe-plugin-gitops-githubGitLab
GitLab provider for the GitOps meta plugin — REST v4.
@vibecontrols/vibe-plugin-gitops-gitlabBitbucket Cloud
Bitbucket Cloud provider for the GitOps meta plugin — REST v2.
@vibecontrols/vibe-plugin-gitops-bitbucketAzure DevOps
Integrate Azure DevOps with VibeControls for seamless GitOps workflows. Supports REST 7.1 for efficient plugin management.
@vibecontrols/vibe-plugin-gitops-azdevopstmux
Tmux + ttyd session provider — the default for persistent terminal sessions.
@vibecontrols/vibe-plugin-session-tmuxWezTerm
WezTerm + ttyd session provider — GPU-accelerated multiplexer in the browser.
@vibecontrols/vibe-plugin-session-weztermZellij
Zellij + ttyd session provider — terminal workspace with floating panes.
@vibecontrols/vibe-plugin-session-zellijSkalex
Document-oriented file-backed storage provider with AES-256-GCM at rest.
@vibecontrols/vibe-plugin-storage-skalexPostgres
Full-parity shared database storage provider with AES-256-GCM encryption — share state across multiple agents.
@vibecontrols/vibe-plugin-storage-postgresCloudflare Tunnel
Cloudflare Tunnel provider — expose localhost endpoints via cloudflared with named tunnels.
@vibecontrols/vibe-plugin-tunnel-cloudflareVibeTunnels
frp-based tunnel provider — self-hostable tunnel relay for air-gapped networks.
@vibecontrols/vibe-plugin-tunnel-vibetunnelsPlannotator
Plannotator plan provider — wraps the upstream CLI and configures per-AI-agent hooks.
@vibecontrols/vibe-plugin-plan-plannotatorAI config sync
Cross-harness AI configuration management via Bridle — sync prompts + settings.
@vibecontrols/vibe-plugin-agent-aiconfigBackup Solution | VibeControls plugin
Back up Skalex-backed agent state to S3 or any custom storage — restore on demand.
@vibecontrols/vibe-plugin-agent-backupcode-server
Browser-based VS Code via code-server — reverse-proxied through the VibeControls agent.
@vibecontrols/vibe-plugin-tool-code-serverGit client
Visual Git client (Ungit) — reverse-proxied through the VibeControls agent.
@vibecontrols/vibe-plugin-tool-gitGraphiQL
API Playground (GraphiQL) — embedded in the VibeControls agent for any endpoint.
@vibecontrols/vibe-plugin-tool-graphiqlSSH
SSH connections, remote terminals, port forwarding, and remote agent installation — all from the dashboard.
@vibecontrols/vibe-plugin-tool-sshUI Hello
Minimal example UI plugin — copy as a starting point for new iframe-mounted plugin UIs.
@vibecontrols/vibe-plugin-ui-hello