great-cto

One decision per feature

🤖 architect + design-advisor  →  spec · data model · screens
   ↓
🟡 gate:plan   ←  you decide here — approve the spec (the one CTO gate)
   ↓
🤖 senior-dev → review → qa-engineer → devops  →  built · tested · deployed

The pipeline is risk-tiered (change_tier): a maintenance fix opens no gate (CI is the gate), a reversible feature opens only gate:plan, and an irreversible change forces the full set + the frontier model. Everything between the gate and deploy runs automatically. Memory persists between sessions: every gate verdict appends to ~/.great_cto/decisions.md, every retrospective to per-project lessons.md, and /crystallize promotes high-impact patterns to a global library agents query before re-solving.

Critics before the plan

The most expensive bugs aren’t in the code — they’re in decisions made before coding starts. Three critic agents run before the Plan stage, at the three positions where a mistake costs the most:

Previously critics only activated starting from Plan. Now the pipeline catches architectural and spec-level mistakes before implementation begins — when reverting costs hours, not days.

How great_cto compares

great_cto is not another coding-agent loop — it’s the orchestration layer above the coding agent you already use. Think “specialist team that reviews and gates the work” rather than “another assistant that types code.”

Jurisdiction detection

npx great-cto init scans three signal sources — README keywords, infra region strings (Terraform, .env AWS_REGION=, docker-compose TZ=), and package.json homepage TLD — and auto-detects which of 12 jurisdictions apply:

Word-boundary matching prevents false positives ("india" doesn’t match "indiana"). Detected jurisdiction is written to PROJECT.md as jurisdiction: [eu, us-ca] and gates the appropriate reviewer on every feature. Override manually:

jurisdiction: [eu, us-ca]

Three commands you use every day

/start "build a dispatch & scheduling app for an HVAC business"
# → architect + design-advisor → spec, data model, screens
# → pm → Beads tasks → gate:plan (you approve the spec — the one gate)
# → senior-dev → review → qa → devops → built · tested · deployed

/inbox
# Pending gate · P0 incidents · blocked tasks · stale in-progress

/digest
# Weekly DORA + delta vs last week + cost-per-feature roll-up

Plus: /audit (existing-codebase scan), /cost (LLM router savings), /sec (security umbrella), /oncall, /release, /rfc. Full list: ~/.claude/commands/ after install.

Cost

~$34/month for a typical solo-CTO project — 20 pipeline runs/month, indicative.

Pay your own Anthropic API tokens. No per-seat fee. No SaaS lock-in. Routine triage auto-routes to Kimi K2 (Sonnet-equivalent at ~5× lower cost) → 60–80% reduction on log clustering.

Build archetypes

Every product maps to a build archetype that shapes its pipeline — the stack template, the data shape, the signature integration. The 6 Product Builder archetypes (the ~40 products collapse into these):

Plus the underlying software-kind archetypes (web-service, mobile-app, cli-tool, library, …) the engine auto-detects to tune the build. See the 6 pipelines.

Full table (26 archetypes) + how detection works: docs/ARCHETYPES.md.

Deep US coverage — beyond GDPR/PCI/HIPAA, great_cto now reviews against SEC cyber-disclosure (8-K Item 1.05), CMMC 2.0 / NIST 800-171 for defense contractors, US AI governance (NIST AI RMF · Colorado SB 205 · Utah/Texas AI), web-tracking litigation (VPPA · CIPA · Washington MHMDA), and HMDA / SR 11-7 model risk for lending.

Domain overlays (optional)

Beyond the build archetype, the engine can auto-attach an optional domain overlay when it detects domain-specific signals (deps, README terms) — adding a specialist reviewer and a few extra checks for things like voice/telephony, privacy (GDPR/CCPA), or AI governance. They’re opt-in and orthogonal to the build pipeline; most products need none.

One real run, fully traced

The canonical receipt: one real feature shipped through the full pipeline in 1h 26m wall-clock for $3.40 in LLM cost — architect → plan → implementation → review → human gate → merged PR. The traditional path for the same feature: ~170 hours and ~$42K. Every stage timestamped, every artifact links to a public GitHub PR.

An earlier run on a Python CLI feature ($2.39 vs ~$5,460 human-equivalent) showed the review model working: security caught two real defects QA had passed (list(stream_csv()) defeated streaming → 14.5 MB peak RSS on 13 MB input).

Full trace + artefacts: greatcto.systems/proof · raw: docs/qa/runs/2026-05-09/E2E-CLI-PIPELINE.md.

CI integration

Drop into any GitHub Actions workflow:

- run: npx great-cto@latest ci ./ --sarif results.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with: { sarif_file: results.sarif }

great-cto ci auto-detects $GITHUB_ACTIONS and emits ::error file=...,line=N:: annotations inline on PR diffs. Exit codes: 0 clean / 1 findings / 2 setup error.

Test pyramid

Layered test suite — structural + state-machine tier runs in <2 min for $0 (node --test tests/*.test.mjs); real-LLM tier (26 archetypes × 4-8 stages + 14 packs + 13 reviewers) runs on-demand via OpenRouter for ~$5–10. Full breakdown: docs/testing/.

MCP

Native MCP server — 7 tools callable from Claude Desktop, Codex, or any MCP host. Local (no board needed): detect_archetype · estimate_cost · query_decisions. Board-backed: project_status · cost_summary · pipeline_stages · recent_verdicts.

{ "mcpServers": { "great-cto": { "command": "npx", "args": ["-y", "great-cto@latest", "mcp"] } } }

Full setup + internal MCPs (Grafana, LLM router, Beads): docs/MCP.md.

Email alerts (zero-setup)

Five things that need you to act in <2h get emailed automatically — even when you’re away from the board:

Setup: board → Notifications tab → enter email → enter the 6-digit code we send → pick triggers. No Resend signup, no API keys — delivery routed through greatcto.systems/notify (free, 100 emails/24h per verified email).

Limitations & non-goals

• Not for multi-dev engineering teams — one builder is the product; 2+ engineers sharing the pipeline have outgrown it.
• Not a replacement for senior engineers — codifies process; doesn’t make architectural judgement calls without one.
• Not a CI/CD system — gates run locally / in-session. You still need GitHub Actions for actual merge.
• Not certification-audited — PCI/HIPAA/SOC2 archetype scaffolds are starting points, not certifications.
• Not deterministic — LLM-generated outputs. Every gate verdict should be sanity-checked.

FAQ (top 5)

Is my source code used to train models? No. Claude API zero-retention by default for paying customers. great_cto adds nothing.

How do you keep token costs down? Haiku-by-default + Kimi K2 router for triage (60–80% savings) + cost-guard hook.

Can I disable hooks? Every hook honors GREAT_CTO_DISABLE_<NAME>=1. Per-file secret-scan opt-out: // great_cto:allow-secrets.

What if I’m not solo? GreatCTO’s build pipeline is built for one engineer — if you have 2+ engineers who need shared builder boards and concurrent pipelines, you’ve outgrown it.

Full FAQ: docs/FAQ.md.

Documentation

📚 Full documentation hub → — organized by Diátaxis: Getting Started · How-to guides · Agents & Commands reference · Architecture · FAQ.

Architecture

The plugin runs inside Claude Code (or any MCP-capable host); 46 agents are markdown specs; tasks live in Beads (dolt, git-native); memory is plain markdown (no vector store). Diagram + stack table: docs/ARCHITECTURE.md.

What’s new

v2.74+ (June 2026) — The Product Builder pivot: GreatCTO becomes an AI Product Builder — describe a software product, approve the spec at one CTO gate, and the pipeline ships it (spec → build → test → deploy). 10 US industries, ~40 products, 6 reusable pipelines. Build gates are risk-tiered (change_tier); the regulated runtime surface moved out to avelikiy/operate. Story: the strategy · the 6 pipelines

v2.40–v2.62 (June 2026) — The autopilot pivot: GreatCTO becomes AI autopilots for business — 25 service-autopilot verticals, each a flow with a measured quality scorecard, an accountable owner, and the runtime invariant that an irreversible action never executes without a human signature. 22 live connectors run every vertical on real data. Story: We pivoted →

v2.46–v2.63 (June 2026) — The operator console: durable runs pause at the human gate and wait in an inbox for a named licensed human; signing executes the write. Role-based access, scoped invites, AI-drafted determinations with evidence, QA sampling, SLA clocks, Ops tab (metering · connector health · dead-letter requeue), WCAG 2.2 AA, light/dark. Story: The operator console →

v2.37–v2.65 (June 2026) — Under the hood: the dev board becomes a pult — approving a gate can spawn a live-streamed agent run; prompt self-improvement gated on held-out evals (SIA-inspired); $0 context compression (CI log 31,475 → 155 chars with the FATAL preserved); Fable 5 support. Story: June under the hood →

Full changelog →

Roadmap

• Product archetype detection — pick the build archetype from the product brief, not just the stack
• Per-industry build templates — ship a reference product end-to-end through each of the 6 pipelines
• Tier-aware judge — a cheap fine-tuned judge on T0/T1 evals, frontier + human on T2 (ADR-004)
• Headless task-runner — queue product builds and run them on a VPS, unattended

Vote on the next feature →