ECC
ECC Deployment Guide: Install an AI Coding Harness Without Duplicating Hooks
A source-backed ECC deployment checklist for selecting one install path, auditing generated files, running AgentShield, and operating hooks safely.
What you will learn
- Select and document one ECC installation boundary
- Audit generated hooks, MCP entries, and memory
- Operate upgrades and rollback with least privilege
Before you start
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Key takeaways
- Pick one install path per harness and keep an inventory of generated files.
- Test hooks and memory in a disposable repository before granting broad permissions.
- Pin upgrades, run AgentShield, and maintain a rollback and ownership plan.
Choose the deployment boundary
ECC is deployed into an agent host and a project context, not as a single server daemon. Start by choosing the harness you actually use—Claude Code, Codex, Cursor, OpenCode, or another adapter—and read the support matrix for that release. The README's primary Claude path is `npx ecc-universal setup`; its guided installer covers supported harness combinations.
Do not combine a native plugin install with a full manual copy unless the project explicitly documents that migration. Duplicate hooks can run twice, duplicate rules can conflict, and a stale generated file can make a later security review misleading. Keep one install method and record the package version and target paths.
Deploy into a disposable repository first
Run the installer in a throwaway repository with no production credentials. Inspect every generated skill, agent, command, rule, hook, MCP entry, and settings file before enabling it for a real project. Verify which files are project-local and which live in the user profile, then check permissions and ownership so a team member can remove or update them deliberately.
Exercise the full loop with a harmless task: plan a documentation change, run a test command, request a fresh-context review, and observe which hooks write memory or telemetry. Capture command output and paths, but redact tokens, private prompts, and source code before sharing a deployment receipt.
Harden operations and upgrades
Treat hooks, MCP servers, and persisted memory as executable configuration. Restrict destructive shell actions behind human approval, keep credentials in the host's secret store, and review outbound domains. Run `npx -y ecc-agentshield scan --path .` from the official package channel, then address findings before making ECC a team default.
Pin the npm package or repository revision and stage upgrades in a canary project. Compare generated files, hook events, context size, and test outcomes between revisions. If a hook fails, disable only that hook, preserve the log, and fall back to a manual checklist while you investigate rather than bypassing all policy controls.
Define a rollback and ownership plan
A production-ready deployment has an uninstall path, an owner for each rule or skill, and a retention policy for memory and instincts. Keep a manifest of installed components and their source revisions. When a project leaves ECC, remove generated files through the documented uninstall flow and verify that no duplicate plugin or hook remains in the host configuration.
ECC's cross-client adapters do not promise identical behavior. Validate the exact editor, model, shell, and repository permissions your team uses, and keep a human approval gate for dependency upgrades, data deletion, security work, and any command that changes remote state.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Select a supported harness and pin the ECC package/revision.
- 2
Run guided setup in a disposable repository and inspect generated files.
- 3
Exercise a harmless task, audit hooks/MCP/memory, and run AgentShield.
- 4
Canary upgrades, document uninstall, and retain human approval for risky actions.
Copy-ready example
# Choose one documented setup path
npx ecc-universal setup
# Or guided installation for supported harnesses
npx ecc-universal install --guided
# Scan the disposable project before wider rollout
npx -y ecc-agentshield scan --path .Frequently asked questions
Can I install the Claude plugin and run the full installer too?
Avoid stacking methods unless the release's migration guide says otherwise; the README warns that duplicate hooks and copied configuration can fire twice.
What should be backed up before an upgrade?
Keep the component manifest, package/repository revision, generated files, hook settings, memory policy, and a recent harmless-run receipt with secrets removed.
Sources
- ECC README (captured 2026-08-31)Source checked 2026-08-31
- ECC repositorySource checked 2026-08-31