# Stratus GRCITSM Marketplace

Claude Code plugin marketplace for **GRCITSM** — Stratus Cyber's GRC/ITSM platform built on Halo. The plugins here let Claude Code operate your GRCITSM tenant directly: ticket and asset workflows, System Security Plan (SSP) authoring and generation, compliance control lookups, FedRAMP and CMMC requirement interpretation, and safe bulk-write operations.

## Plugins

| Plugin | Description |
|---|---|
| `grcitsm-analyst` | Query and operate your GRCITSM tenant: SSP spine authoring and generation, ticket and asset workflows, compliance lookups, FedRAMP / CMMC advisory, bulk-write pipeline |

## Installation

In Claude Code:

```
/plugin marketplace add Stratus-Cyber/grcitsm-marketplace
/plugin install grcitsm-analyst@stratus-grcitsm-marketplace
```

> **All reference docs are vendored and always present.** The CMMC corpus, FedRAMP Rev5 baselines, FedRAMP Consolidated Rules (`reference-docs/fedramp-rules`), 2026 narrative corpus (`reference-docs/fedramp-2026-markdown`), and Machine Readable submission schemas (`reference-docs/fedramp-schemas`) are all plain tracked files — no submodule initialization needed. Each FedRAMP corpus directory carries a `VENDORED.md` recording the upstream commit it was vendored from; refresh with `./scripts/update-fedramp-refs.sh`.

Then connect your tenant as described in [SETUP.md](SETUP.md) — the plugin talks to your GRCITSM tenant through your organization's claude.ai OAuth connector, whose name must start with `GRCITSM`. Once the connector is in place, run **`/grcitsm-analyst:setup`** in your project to verify the connection, scaffold the working directories, and install the bulk-write workflow. Re-run it after any plugin update to refresh the workflow.

## Quick start

Once installed and connected:

- `/grcitsm-analyst:setup` — verify the tenant connection, scaffold `inputs/`/`outputs/`, and install/update the bulk-write workflow (run once per project, and again after plugin updates)
- `/grcitsm-analyst:ssp-generate` — render a markdown SSP from your current tenant state
- `/grcitsm-analyst:ssp-ingest` — ingest policies, procedures, and transcripts into your SSP
- `/grcitsm-analyst:ssp-interview` — author SSP content from scratch through conversation
- `/grcitsm-analyst:ssp-compile` — compile SSP structure authored as flat CSV manifests into an applyable action file
- `/grcitsm-analyst:halo-apply` — apply a planned bulk-write action file against your tenant, with ledger-based resume
- `/grcitsm-analyst:demo-build` — build or rebuild the stored demo system into a tenant via the `system-package` pipeline
- Ask anything about your tickets, assets, controls, or compliance posture — the `grcitsm` skill teaches Claude the tenant workflows automatically
- Ask FedRAMP or CMMC requirement questions — "what does AC-2 require?", "which controls map to KSI-IAM-AAM?", "what does CMMC AC.L2-3.1.1 require?" — the `fedramp-expert` and `cmmc-expert` advisors answer with cited requirement text and inform SSP authoring

## What's in the analyst plugin

- **14 agents** — an SSP authoring team (curator, interviewer, reviewer, writer, author), a bulk-write pipeline team (pipeline-coordinator, planner, executor), operational and project agents (ops, project-manager), the routing coordinator, a technical-accuracy gate (`grcitsm-tech-reviewer`), and FedRAMP / CMMC requirement advisors (`fedramp-expert`, `cmmc-expert`)
- **19 skills** — tenant workflow primers, the SSP asset model, ingestion/interview/generation pipelines, the unified `system-package` format and its driver, spreadsheet-driven asset import, narrative voice and review standards, bulk-update methodology, and FedRAMP / CMMC interpretation skills
- **Reference docs** — Halo write-shape conventions, the required MCP tool manifest, the FedRAMP Consolidated Rules + 2026 narrative corpus + Machine Readable submission schemas (vendored), FedRAMP Rev5 baselines, and the CMMC reference corpus

## Requirements

- Claude Code 2.x or later
- A Stratus-provisioned GRCITSM tenant exposing the GRCITSM MCP tool catalog (see [SETUP.md](SETUP.md))

## Support

Contact your Stratus Cyber engagement team, or email support@stratuscyber.com.

## License

The code, prompts, and documentation in this marketplace are licensed under the [Apache License 2.0](LICENSE), with attribution in [NOTICE](NOTICE). The vendored government reference corpora under `plugins/grcitsm-analyst/reference-docs/` (`fedramp-rules/`, `fedramp-2026-markdown/`, `fedramp-rev5/`, `fedramp-schemas/`, and `cmmc/`) are works of the US Government redistributed unmodified; they retain their own status and are not covered by the Apache-2.0 grant. See NOTICE for provenance.
