Plugin

devrunway

Modular SDLC plugin for any tech stack. Run /setup to declare your tools (frontend, backend, DB, auth, CI, etc.), and devrunway installs only the matching standards, pre-wires MCP servers, and activates a runtime of 35 hooks that block secrets, enforce conventional commits, and catch SQL injection, XSS, PII-in-logs, and more on every save.

• Published source
• Repository

Analysed

11 October 2026

Last observed

12 October 2026

What the code does

• Runs shell commands Code that starts system commands on the machine it runs on.
• Runs hooks automatically Hooks that execute without being called explicitly.

Having a capability is not wrongdoing; many tools need these to do their job. It tells you what to check before you install.

This is public metadata, not a safety certification or complete assessment. Static analysis cannot establish what a tool does at runtime.