{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-31", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "superpowers", "name": "Superpowers", "vendor": "Prime Radiant", "vendorUrl": "https://primeradiant.com/superpowers/", "kind": "framework", "category": "code", "summary": "Superpowers is an MIT-licensed library of 15 agent skills and a session-start bootstrap that steer coding agents through brainstorming, a design, a plan, test-driven implementation by subagents and code review. Its README gives install steps for 16 coding agents.", "url": "https://www.anchorterminal.com/tools/superpowers", "markdownUrl": "https://www.anchorterminal.com/tools/superpowers.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/superpowers.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/superpowers.json", "repo": "https://github.com/obra/superpowers", "license": "MIT (Copyright (c) 2025 Jesse Vincent)", "transports": [], "packages": [], "auth": "none", "authNotes": "No account, key or login of its own. It installs through each coding agent's plugin manager (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces, or a git install from the repository) and runs with whatever model access and permissions that agent already has.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy. Model usage is billed by the coding agent's provider, and the skills dispatch a subagent per task plus reviewers, which adds model calls. Prime Radiant takes enquiries for enterprise support at sales@primeradiant.com, with no published price.", "priceSummary": "Free ยท OSS", "where": "library", "x402": { "level": "no", "evidence": "No machine payment protocol in the repository or on primeradiant.com, read on 2026-10-30. The project sells nothing per call.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 309222, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://github.com/obra/superpowers#readme", "capabilities": [ "code.git", "agent.multi-agent" ], "tags": [ "open-source", "mit", "local", "free", "agent-skills", "framework", "claude-code-plugin" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 64.5, "grade": "B", "agentReady": false, "rank": 408, "ranked": true, "rankOf": 1239, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 83, "payments": 60, "reliability": 68, "schema": 71, "security": 58, "transparency": 68 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 68, "points": 13.6, "reason": "Local-package reading, as for ai-job-search and the other skill workflows. Installs through official plugin channels (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces) or a git install in 16 coding agents, with harness versions stated for OpenCode 2.0.4 and Claude Code's hook quirks, but bash and Node needs are spread across the docs rather than stated once (17 of 20). No .github/workflows directory, so no public CI. About 60 test files in tests/ cover the hooks, plugin manifests and the visual companion server, run locally, with LLM evals in a separate repository (8 of 25). 194 issues open on 30 October 2026; 25 issues were closed between 10 and 22 October, each with a reply, while 13 of the 25 newest open issues had no comment (13 of 25). Dated release notes with Breaking Changes and Visible Changes sections and semver majors for them (15). Version 7.0.1 (15). 68 in all.", "checked": "2026-10-30" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 71, "points": 11.54, "reason": "Framework reading, docs a model can follow. Each skill has name and description frontmatter and every harness gets a JSON plugin manifest, but the skills are prose with no typed interface or API reference (12 of 25). All docs are Markdown in the repository, which an agent reads directly; no llms.txt (10). Every description starts with \"Use when\", using-superpowers sets skill priority and a subagent stop rule, and executing-plans says when to prefer subagent-driven development. When not to use a skill is stated in fewer places (17 of 20). Skills take no typed parameters; the helper scripts have fixed arguments and documented exit codes, such as review-package's exit 3 for an empty range (6 of 15). Worked examples in the debugging and TDD skills, troubleshooting in the OpenCode install guide and a diagnosing skill for failed sessions, with few documented error outputs (11 of 15). Semver releases and a dated RELEASE-NOTES.md (15). 71 in all.", "checked": "2026-10-30" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 71, "points": 11.54, "reason": "Framework reading, how much a tool-calling agent has to carry. The bootstrap (3,192 bytes) is injected at every startup, clear and compaction, and 15 skill descriptions add about 2,500 characters. Bodies load on demand and long guidance moved to references/ in v7.0.1, but single skills run to 19,506 bytes and the bootstrap asks for a skill before any reply (17 of 25). The work can be sized. Brainstorming does a quick task at once and writes a design only for a project, execution can be inline (cheapest) or one subagent per task, and every dispatch must name a model (15 of 20). Implementers report DONE, DONE_WITH_CONCERNS, BLOCKED or NEEDS_CONTEXT and the controller acts on each; review-package rejects bad ranges (14 of 20). A progress ledger and task-done records let a run resume, work happens in a worktree, merges are confirmed and a discard needs the typed word (15 of 20). Skills trigger without a command and install in one step per harness; no SDK applies (10 of 15). 71 in all.", "checked": "2026-10-30" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 58, "points": 10.15, "reason": "Harness reading of the framework checklist, the one harness2 and agent-zero used. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own and no network access in the hooks or plugins. The visual companion's logo request carries the version to primeradiant.com by default, disclosed with opt-outs, and some installs (OpenCode's git+https spec, git installs) follow main unless pinned, so new hook code runs at the next session start (22). Worktrees isolate work, reviewers are read-only, merges are confirmed, a discard needs the typed word, force pushes need the person, and issues are filed only after approval. No sandbox of its own, and plan execution runs for hours without check-ins (12). The companion has a per-session key and refuses symlinks and path escapes since 16 June 2026, the Windows hook ignores planted bash.cmd since 9 October 2026, and diagnosing-superpowers treats transcripts as evidence, not instructions. No guidance on untrusted content in repositories or fetched pages (7). Plans, briefs, reports, review diffs and a ledger are written to files, and the diagnosing skill cites path:line for each finding (11). No SECURITY.md, no security.txt and no advisories; GitHub shows a Report a vulnerability link, and both 2026 security fixes are credited in the release notes (6). 58 in all.", "checked": "2026-10-30" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). Free to use with no card (20). An agent can install it in its own harness with no account or sign-up (20). Model usage is billed by the coding agent's provider, and the enterprise support Prime Radiant mentions has no published price. 60 in all.", "checked": "2026-10-30" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "v7.0.1 on 21 October 2026, nine days before the check (30). Five releases in the last 90 days, v6.3.0 (12 August), v6.4.1 (18 September), v6.4.2 (25 September), v7.0.0 (10 October) and v7.0.1 (21 October) (20). 1,190 pull requests closed and 181 open; issues are triaged in batches with a reply on each closed one, but about half the newest open issues had no comment, and AGENTS.md says most PRs are rejected (15 of 25). Listed as Anthropic verified in Claude's plugin directory, read first-hand; the README also names the official Codex and Grok marketplaces, which weren't read (12 of 15). Zero dependencies by design, tests in the tree and a skill-size check, but no CI (6 of 10). 83 in all.", "checked": "2026-10-30" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 68, "points": 5.95, "note": "editorial 77, provenance 58", "reason": "MIT, an OSI licence (30). The README and the source agree on the one outbound request and what it carries, git-ignored scratch files stay in the working tree, and diagnosing-superpowers has a written redaction policy and approval gates. Prime Radiant publishes no privacy policy covering the logo request, which reaches its site with the visitor's address (15 of 30). Breaking changes are dated in the release notes, the legacy slash commands showed deprecation notices in v5.0.0 (9 March 2026) before removal in v5.1.0 (30 April 2026), but no written deprecation policy (12 of 20). Telemetry disclosed in the README with three opt-out variables, read in server.cjs (20). 77 in all.", "checked": "2026-10-30" } ], "assessment": { "date": "2026-10-30", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Framework reading, how much a tool-calling agent has to carry. The bootstrap (3,192 bytes) is injected at every startup, clear and compaction, and 15 skill descriptions add about 2,500 characters. Bodies load on demand and long guidance moved to references/ in v7.0.1, but single skills run to 19,506 bytes and the bootstrap asks for a skill before any reply (17 of 25). The work can be sized. Brainstorming does a quick task at once and writes a design only for a project, execution can be inline (cheapest) or one subagent per task, and every dispatch must name a model (15 of 20). Implementers report DONE, DONE_WITH_CONCERNS, BLOCKED or NEEDS_CONTEXT and the controller acts on each; review-package rejects bad ranges (14 of 20). A progress ledger and task-done records let a run resume, work happens in a worktree, merges are confirmed and a discard needs the typed word (15 of 20). Skills trigger without a command and install in one step per harness; no SDK applies (10 of 15). 71 in all.", "maintenance": "v7.0.1 on 21 October 2026, nine days before the check (30). Five releases in the last 90 days, v6.3.0 (12 August), v6.4.1 (18 September), v6.4.2 (25 September), v7.0.0 (10 October) and v7.0.1 (21 October) (20). 1,190 pull requests closed and 181 open; issues are triaged in batches with a reply on each closed one, but about half the newest open issues had no comment, and AGENTS.md says most PRs are rejected (15 of 25). Listed as Anthropic verified in Claude's plugin directory, read first-hand; the README also names the official Codex and Grok marketplaces, which weren't read (12 of 15). Zero dependencies by design, tests in the tree and a skill-size check, but no CI (6 of 10). 83 in all.", "payments": "Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). Free to use with no card (20). An agent can install it in its own harness with no account or sign-up (20). Model usage is billed by the coding agent's provider, and the enterprise support Prime Radiant mentions has no published price. 60 in all.", "reliability": "Local-package reading, as for ai-job-search and the other skill workflows. Installs through official plugin channels (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces) or a git install in 16 coding agents, with harness versions stated for OpenCode 2.0.4 and Claude Code's hook quirks, but bash and Node needs are spread across the docs rather than stated once (17 of 20). No .github/workflows directory, so no public CI. About 60 test files in tests/ cover the hooks, plugin manifests and the visual companion server, run locally, with LLM evals in a separate repository (8 of 25). 194 issues open on 30 October 2026; 25 issues were closed between 10 and 22 October, each with a reply, while 13 of the 25 newest open issues had no comment (13 of 25). Dated release notes with Breaking Changes and Visible Changes sections and semver majors for them (15). Version 7.0.1 (15). 68 in all.", "schema": "Framework reading, docs a model can follow. Each skill has name and description frontmatter and every harness gets a JSON plugin manifest, but the skills are prose with no typed interface or API reference (12 of 25). All docs are Markdown in the repository, which an agent reads directly; no llms.txt (10). Every description starts with \"Use when\", using-superpowers sets skill priority and a subagent stop rule, and executing-plans says when to prefer subagent-driven development. When not to use a skill is stated in fewer places (17 of 20). Skills take no typed parameters; the helper scripts have fixed arguments and documented exit codes, such as review-package's exit 3 for an empty range (6 of 15). Worked examples in the debugging and TDD skills, troubleshooting in the OpenCode install guide and a diagnosing skill for failed sessions, with few documented error outputs (11 of 15). Semver releases and a dated RELEASE-NOTES.md (15). 71 in all.", "security": "Harness reading of the framework checklist, the one harness2 and agent-zero used. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own and no network access in the hooks or plugins. The visual companion's logo request carries the version to primeradiant.com by default, disclosed with opt-outs, and some installs (OpenCode's git+https spec, git installs) follow main unless pinned, so new hook code runs at the next session start (22). Worktrees isolate work, reviewers are read-only, merges are confirmed, a discard needs the typed word, force pushes need the person, and issues are filed only after approval. No sandbox of its own, and plan execution runs for hours without check-ins (12). The companion has a per-session key and refuses symlinks and path escapes since 16 June 2026, the Windows hook ignores planted bash.cmd since 9 October 2026, and diagnosing-superpowers treats transcripts as evidence, not instructions. No guidance on untrusted content in repositories or fetched pages (7). Plans, briefs, reports, review diffs and a ledger are written to files, and the diagnosing skill cites path:line for each finding (11). No SECURITY.md, no security.txt and no advisories; GitHub shows a Report a vulnerability link, and both 2026 security fixes are credited in the release notes (6). 58 in all.", "transparency": "MIT, an OSI licence (30). The README and the source agree on the one outbound request and what it carries, git-ignored scratch files stay in the working tree, and diagnosing-superpowers has a written redaction policy and approval gates. Prime Radiant publishes no privacy policy covering the logo request, which reaches its site with the visitor's address (15 of 30). Breaking changes are dated in the release notes, the legacy slash commands showed deprecation notices in v5.0.0 (9 March 2026) before removal in v5.1.0 (30 April 2026), but no written deprecation policy (12 of 20). Telemetry disclosed in the README with three opt-out variables, read in server.cjs (20). 77 in all." }, "sources": [ { "what": "repository metadata (created 2025-10-09, MIT, default branch)", "url": "https://api.github.com/repos/obra/superpowers", "seen": "2026-10-30" }, { "what": "GitHub releases", "url": "https://api.github.com/repos/obra/superpowers/releases?per_page=100", "seen": "2026-10-30" }, { "what": "tags", "url": "https://api.github.com/repos/obra/superpowers/tags?per_page=100", "seen": "2026-10-30" }, { "what": "earliest tag commit, v3.1.0", "url": "https://api.github.com/repos/obra/superpowers/commits/0bc5a5989d8cf140e9f671af14c76f6a6e6fae79", "seen": "2026-10-30" }, { "what": "file tree", "url": "https://api.github.com/repos/obra/superpowers/git/trees/main?recursive=1", "seen": "2026-10-30" }, { "what": "contributors", "url": "https://api.github.com/repos/obra/superpowers/contributors?per_page=30", "seen": "2026-10-30" }, { "what": "README", "url": "https://raw.githubusercontent.com/obra/superpowers/main/README.md", "seen": "2026-10-30" }, { "what": "release notes", "url": "https://raw.githubusercontent.com/obra/superpowers/main/RELEASE-NOTES.md", "seen": "2026-10-30" }, { "what": "LICENSE", "url": "https://raw.githubusercontent.com/obra/superpowers/main/LICENSE", "seen": "2026-10-30" }, { "what": "contributor guidelines", "url": "https://raw.githubusercontent.com/obra/superpowers/main/AGENTS.md", "seen": "2026-10-30" }, { "what": "SessionStart hook", "url": "https://raw.githubusercontent.com/obra/superpowers/main/hooks/session-start", "seen": "2026-10-30" }, { "what": "Windows hook wrapper", "url": "https://raw.githubusercontent.com/obra/superpowers/main/hooks/run-hook.cmd", "seen": "2026-10-30" }, { "what": "bootstrap skill", "url": "https://raw.githubusercontent.com/obra/superpowers/main/skills/using-superpowers/SKILL.md", "seen": "2026-10-30" }, { "what": "visual companion server", "url": "https://raw.githubusercontent.com/obra/superpowers/main/skills/brainstorming/scripts/server.cjs", "seen": "2026-10-30" }, { "what": "subagent-driven-development skill", "url": "https://raw.githubusercontent.com/obra/superpowers/main/skills/subagent-driven-development/SKILL.md", "seen": "2026-10-30" }, { "what": "finishing-a-development-branch skill", "url": "https://raw.githubusercontent.com/obra/superpowers/main/skills/finishing-a-development-branch/SKILL.md", "seen": "2026-10-30" }, { "what": "diagnosing-superpowers skill and redaction policy", "url": "https://raw.githubusercontent.com/obra/superpowers/main/skills/diagnosing-superpowers/references/redaction-policy.md", "seen": "2026-10-30" }, { "what": "OpenCode install guide", "url": "https://raw.githubusercontent.com/obra/superpowers/main/.opencode/INSTALL.md", "seen": "2026-10-30" }, { "what": "testing guide", "url": "https://raw.githubusercontent.com/obra/superpowers/main/docs/testing.md", "seen": "2026-10-30" }, { "what": "open and closed issues (numbers, dates, comment counts)", "url": "https://github.com/obra/superpowers/issues", "seen": "2026-10-30" }, { "what": "pull request counts", "url": "https://github.com/obra/superpowers/pulls", "seen": "2026-10-30" }, { "what": "security policy and advisories", "url": "https://github.com/obra/superpowers/security", "seen": "2026-10-30" }, { "what": "announcement post, 9 October 2025", "url": "https://blog.fsck.com/2025/10/09/superpowers/", "seen": "2026-10-30" }, { "what": "Prime Radiant about page", "url": "https://primeradiant.com/about/", "seen": "2026-10-30" }, { "what": "Prime Radiant post, What a year", "url": "https://blog.primeradiant.com/what-a-year/", "seen": "2026-10-30" }, { "what": "Claude plugin directory entry", "url": "https://claude.com/plugins/superpowers", "seen": "2026-10-30" } ], "openQuestions": [ "Judgement call. Listed in code because the batch suggested it and no category covers development methods; the code category's capabilities (repository, git, docs, deploy) fit only in part, so code.git and agent.multi-agent were chosen. Graded as a framework the way ai-job-search was", "firstReleased is 2025-10-09, from the announcement post on blog.fsck.com with install steps and the repository's created_at of 2025-10-09T19:45:18Z. Prime Radiant's post of 9 October 2026 says Superpowers 1.0 shipped that day. The earliest tag is v3.1.0 (17 October 2025); earlier versions have notes but no tags", "unchecked: whether the tests in tests/ pass on main. There's no CI, and we don't run vendor code", "unchecked: issue and PR reply times and text. Counts and dates were read from GitHub's issue pages with a script; no issue text was read", "unchecked: the official Codex and Grok marketplace entries the README names; only Claude's plugin directory was read", "unchecked: whether GitHub private vulnerability reporting is enabled; the security page shows a Report a vulnerability link, with no SECURITY.md", "unchecked: Prime Radiant's legal form and registration. Its pages say \"Prime Radiant\" with no Inc. or address, while its GitHub organisation is prime-radiant-inc", "Disclosure. These grades are written by agents on Anthropic's Claude models. Superpowers started as a Claude Code plugin and Claude's plugin directory marks it Anthropic verified; the checklist was applied as for any listing, and the directory's installs figure was not used", "Our own products. Superpowers is a development method for coding agents. It does neither LocalGhost's job nor letme's (choosing a tool for a job), so it was graded the normal way", "We did not install or run Superpowers, its hooks or its visual companion. Every claim about behaviour comes from the source, docs and release notes" ] }, "negative": -3, "negativeNotes": [ "-2: until v6.0.0 of 16 June 2026 the brainstorming visual companion, a local web server, had no authentication. The release notes say anyone who could reach the port on a shared or remote machine could read the session or inject events the agent treats as the person's input (issue #1014). Fixed with a per-session key and documented, with no report of exploitation found, so the deduction is small (https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md)", "-1: until v7.0.0 of 9 October 2026, run-hook.cmd on Windows could run a `bash.cmd` or `where.bat` planted in the current directory at session start, per the release notes. Fixed and documented (https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md)" ], "verdict": "Fifteen MIT-licensed skills that make a coding agent design, plan, test first and review before it finishes, with five releases in 90 days and dated release notes. It has no CI workflow or security policy, its bootstrap insists a skill be invoked before any reply, and its optional visual companion loads a logo from Prime Radiant's site unless disabled.", "bestFor": "A test-first development method for coding agents", "strengths": [ "Installs in one command or a marketplace click in 16 coding agents, including Claude Code's official marketplace, where it is marked Anthropic verified", "Five releases between 12 August and 21 October 2026, each with dated notes that name breaking changes, fixes and the reporters credited", "Discarding work needs the typed word 'discard', merges are confirmed first, and force pushes never happen on the agent's own initiative", "Plans, task briefs, review diffs and a progress ledger are written to files, so a controller that loses context can resume without redoing work", "Zero third-party dependencies by design, MIT licence, and the one outbound request is disclosed in the README with three opt-out variables" ], "weaknesses": [ "No CI workflow in the repository; the test suites in tests/ run only on a contributor's machine", "No SECURITY.md or published advisories, though two security fixes in 2026 (the visual companion key, a Windows hook path) are documented in release notes", "The bootstrap is injected on every session start and compaction and tells the model to invoke skills before any reply, including simple questions", "Skills are long Markdown instructions (subagent-driven-development is 19,506 bytes), with no typed inputs beyond the frontmatter name and description", "194 issues and 181 pull requests were open on 30 October 2026; 13 of the 25 newest open issues had no comment" ], "agentNotes": [ "Install it once per coding agent; each harness has its own install command, and the README says a second harness needs a second install.", "Expect brainstorming to start before any code on a build request. Say so plainly if your human partner wants a quick change done without a design document.", "Name a model on every subagent dispatch, as the skill asks; an unnamed subagent inherits the session's most expensive model.", "Set SUPERPOWERS_DISABLE_TELEMETRY=1 before using the visual companion if no request may leave the machine.", "Keep `.superpowers/sdd/` out of `git clean -fdx`; it holds the progress ledger a resumed run reads." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.5 } ], "editorialScores": { "ergonomics": 71, "maintenance": 83, "payments": 60, "reliability": 68, "schema": 71, "security": 58, "transparency": 77 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-10-30", "maintenance": "2026-10-30", "payments": "2026-10-30", "reliability": "2026-10-30", "schema": "2026-10-30", "security": "2026-10-30", "transparency": "2026-10-30" }, "last": "2026-10-30", "oldest": "2026-10-30", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-10-30", "grade": "B", "kind": "listed", "method": "0.7", "score": 64.5 } ] }, "connect": { "claudeCode": "/plugin install superpowers@claude-plugins-official" }, "letme": { "capability": "https://letme.dev/code.git", "tool": "https://letme.dev/superpowers" }, "notable": [ "Released on 9 October 2025 with Jesse Vincent's post \"Superpowers: How I'm using coding agents in October 2025\", the day the GitHub repository was created; Prime Radiant's post of 9 October 2026 dates Superpowers 1.0 to that day (https://blog.fsck.com/2025/10/09/superpowers/)", "A SessionStart hook injects the using-superpowers skill (3,192 bytes) at startup, clear and compaction, and that skill tells the model to invoke any skill with \"even a 1% chance\" of applying before any reply (https://github.com/obra/superpowers/blob/main/hooks/session-start)", "The optional brainstorming visual companion is a local Node server on 127.0.0.1 guarded by a per-session key since v6.0.0 of 16 June 2026; before that it had no authentication, which the release notes say let anyone reaching the port read the session or inject input (https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md)", "The visual companion page loads Prime Radiant's logo from primeradiant.com with the Superpowers version in the query string, disclosed in the README as usage telemetry and turned off by SUPERPOWERS_DISABLE_TELEMETRY, DISABLE_TELEMETRY or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC (https://github.com/obra/superpowers/blob/main/skills/brainstorming/scripts/server.cjs)", "Claude's plugin directory lists Superpowers as \"Anthropic verified\", installed with `/plugin install superpowers@claude-plugins-official` (https://claude.com/plugins/superpowers)", "16 GitHub releases from v5.0.4 (17 March 2026) to v7.0.1 (21 October 2026) and 38 tags back to v3.1.0 (17 October 2025), with a dated RELEASE-NOTES.md that names breaking changes and credits reporters (https://github.com/obra/superpowers/releases)", "The repository has no .github/workflows directory and no SECURITY.md; tests for the hooks, plugins and visual companion server live in tests/ and run locally (https://github.com/obra/superpowers/blob/main/docs/testing.md)" ], "area": "developer", "details": [ { "label": "Surface listed", "value": "The obra/superpowers repository at v7.0.1 (main, tree 2ce8aa1), read from raw.githubusercontent.com, GitHub's release, tag, issue and security pages, primeradiant.com, blog.primeradiant.com, blog.fsck.com and claude.com/plugins/superpowers on 30 October 2026. Nothing was installed or run, and no session was opened with it" }, { "label": "How an agent reaches it", "value": "As a plugin inside the coding agent, not as an endpoint. The skills sit in the agent's skill list and load on demand, and a SessionStart hook (or a plugin or extension on OpenCode, Pi and Hermes) injects the using-superpowers bootstrap. An outside agent can't call it over a network" }, { "label": "Install routes", "value": "Claude Code (official marketplace or obra/superpowers-marketplace), Antigravity, Codex app and CLI (official Codex marketplace), Cursor, Devin CLI, Factory Droid, Gemini CLI, GitHub Copilot CLI, Grok Build CLI, Kimi Code, OpenCode (git+https spec, pin a tag with #v7.0.1), Pi, Qwen Code, Hermes Agent and Muse. No install script; each harness's own plugin manager fetches the repository" }, { "label": "Skills", "value": "15 skills. brainstorming, writing-plans, subagent-driven-development, executing-plans, test-driven-development, requesting-code-review, receiving-code-review, using-git-worktrees, finishing-a-development-branch, dispatching-parallel-agents, systematic-debugging, verification-before-completion, diagnosing-superpowers, writing-skills and using-superpowers. Each description starts with \"Use when\", about 2,500 characters in all; a test fails any SKILL.md of 20,000 bytes or more" }, { "label": "What runs on the machine", "value": "The SessionStart hook is a bash script that reads one SKILL.md and prints JSON, with no network access. On Windows, run-hook.cmd finds Git Bash and, since v7.0.0, ignores bash or where in the current directory. Helper scripts for plans and reviews are bash. The visual companion is a dependency-free Node server bound to 127.0.0.1 by default, with a 4-hour idle timeout" }, { "label": "Data leaving the machine", "value": "The visual companion page requests https://primeradiant.com/brand/superpowers-visual-brainstorming-logo.png?v=\u003cversion\u003e with no referrer, which the README calls telemetry and says carries no project, prompt or agent details. diagnosing-superpowers files a GitHub issue or builds a scrubbed bundle only after the person approves the exact text. Prompts and code go to the coding agent's model provider as usual" }, { "label": "Work products", "value": "Designs and plans under docs/superpowers/, worktrees in .worktrees/ unless told otherwise, and task briefs, implementer reports, review diffs and a progress ledger in a self-ignoring .superpowers/sdd/ directory in the working tree" }, { "label": "Contributions", "value": "AGENTS.md says new skills are generally not accepted, PRs must target dev, every PR and issue must disclose the model, harness and plugins used, and agent-written PRs fixing someone else's issue are closed. It states a 94 per cent PR rejection rate, which is the project's own figure" }, { "label": "Company", "value": "The repository is under Jesse Vincent's GitHub account. The README says Superpowers is built by him and the rest of Prime Radiant, which its about page calls an AI research lab he founded" }, { "label": "Category", "value": "Listed in code, the closest category, though its capabilities are repository and documentation tools. Superpowers is a method a coding agent follows. It works through git branches and worktrees and dispatches subagents, hence code.git and agent.multi-agent" } ], "provenance": { "legalEntity": "Prime Radiant (no legal form or registration found on its pages); the MIT LICENSE names Jesse Vincent", "domain": "primeradiant.com", "domainRegistered": "2002-05-14", "endpointOnVendorDomain": false, "terms": "https://github.com/obra/superpowers/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md", "securityTxt": "none", "checked": "2026-10-30", "notes": [ "The README says Superpowers is built by Jesse Vincent and the rest of the folks at Prime Radiant, and the plugin manifests name Jesse Vincent as author. The LICENSE reads Copyright (c) 2025 Jesse Vincent.", "RDAP for primeradiant.com gives a registration date of 2002-05-14 and a last change on 2026-06-16; the registration may predate the company.", "No terms or privacy policy on primeradiant.com (/privacy/ and /terms/ answer 404). The MIT licence stands in for terms.", "primeradiant.com/.well-known/security.txt and /security.txt answer 404. GitHub's security page for the repository says no security policy is set up and no advisories are published, and shows a Report a vulnerability link.", "The software runs inside the person's coding agent, so there is no vendor endpoint or status page.", "firstReleased is 9 October 2025, the date of the announcement post with install steps and the repository's creation date (created_at 2025-10-09T19:45:18Z). The earliest tag, v3.1.0, is dated 17 October 2025, and RELEASE-NOTES.md has v2.0.1 on 12 October 2025." ], "score": 58, "checks": [ { "check": "Legal entity named", "value": "Prime Radiant (no legal form or registration found on its pages); the MIT LICENSE names Jesse Vincent", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "primeradiant.com, registered 2002-05-14 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": " is not on primeradiant.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "2 named with their role, 2 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://github.com/obra/superpowers/blob/main/LICENSE", "state": "unreadable", "reason": "the page has 169 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-30", "points": 7, "max": 10 }, { "kind": "privacy", "url": "", "state": "none-found", "points": 0, "max": 10 } ] }, "humans": { "slug": "superpowers", "checked": "2026-10-30", "company": "Prime Radiant", "people": [ { "name": "Jesse Vincent", "role": "Founder, Prime Radiant; creator and maintainer of Superpowers", "founder": true, "linkedin": "https://www.linkedin.com/in/jessevincent/", "github": "https://github.com/obra", "bio": "Jesse Vincent founded Prime Radiant and created Superpowers, which he announced on 9 October 2025. Prime Radiant's about page says he co-founded Keyboardio, led VaccinateCA, created Request Tracker and K-9 Mail, and was project leader for Perl.", "bioSources": [ "https://primeradiant.com/about/", "https://blog.fsck.com/2025/10/09/superpowers/" ], "page": "/people/jesse-vincent/" }, { "name": "Drew Ritter", "role": "Member of Technical Staff, Prime Radiant; contributor to Superpowers", "github": "https://github.com/arittr", "page": "/people/drew-ritter/" } ], "peopleNote": "Prime Radiant's about page (read 30 October 2026) names Jesse Vincent as founder and lists Simon Willison (Researcher), Drew Ritter (Member of Technical Staff) and Eden Kettleson (Operations). Only the two people tied to Superpowers are listed here. The README says Superpowers is built by Jesse Vincent and the rest of Prime Radiant, and the plugin manifests name him as author. The GitHub account arittr shows the name Drew Ritter and Prime Radiant as its organisation and is the second-largest contributor to the repository (79 commits). The roster may be incomplete. Investors were looked for on primeradiant.com (home, about, jobs, products, contact), the blog.primeradiant.com feed and its posts What a year and We're hiring for Superpowers, and in three web searches; no funding, round or backer was found.", "companySocial": { "linkedin": "https://www.linkedin.com/company/prime-radiant-inc/", "x": "https://x.com/primeradianthq", "github": "https://github.com/prime-radiant-inc" }, "support": { "urls": [ "https://github.com/obra/superpowers/issues" ], "community": [ { "label": "Discord", "url": "https://discord.gg/35wsABTejz", "kind": "discord" } ], "contactEmails": [ "contact@primeradiant.com", "sales@primeradiant.com" ], "contactUrls": [ "https://primeradiant.com/contact/" ] }, "sources": [ "https://primeradiant.com/about/", "https://primeradiant.com/community/", "https://primeradiant.com/contact/", "https://primeradiant.com/superpowers/", "https://raw.githubusercontent.com/obra/superpowers/main/README.md", "https://raw.githubusercontent.com/obra/superpowers/main/.claude-plugin/plugin.json", "https://github.com/obra", "https://github.com/arittr", "https://blog.fsck.com/2025/10/09/superpowers/", "https://blog.primeradiant.com/rss/" ], "ownership": { "status": "private", "checked": "2026-10-30", "sources": [ "https://primeradiant.com/about/", "https://raw.githubusercontent.com/obra/superpowers/main/README.md" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/superpowers.json" } }