Point Claude at a repository and let Lazarus help make it: Alive again, documented, and audited — behind a guard that blocks destructive commands before they ever run.

Lazarus is a Claude Code plugin for working on a codebase with an AI agent you can actually trust. It does two jobs on any repo — yours, one you inherited, an open-source project, healthy or broken:

• 🔧 Make it run — point it at code that won't start, or that you simply don't know yet. It investigates, proposes a plan with a concrete "done" checklist you approve, then works through the blockers until the app boots — and writes down what actually worked so the next person (or the next you) doesn't start from zero.
• 🧭 Assess it — get a principal-engineer read: what's risky, what to fix first, and whether to maintain, refactor, or rewrite. A report you act on or hand to a client. Nothing in the repo changes.

Both run behind a guard that blocks destructive commands before they ever run — and on the "make it run" side, nothing changes until you approve the plan. It'll resurrect a dead repo that won't even start (the namesake), but it's just as useful on healthy code you want made runnable, understood, or assessed.

Three skills in two workflows, with the guard across both. Match your situation:

New here? The three commands below get you running in under a minute — no config, no keys. Want the internals? The collapsible Deep dive sections further down open up the guard's design, the anti-hallucination model, and the research behind it. For the whole picture in one read, see the complete project overview.

In any claude session, run these three commands — one at a time (press Enter after each; don't paste them together):

1 — add the marketplace

/plugin marketplace add https://github.com/CognitiveCodeAI/lazarus

2 — install the plugin

/plugin install lazarus@cognitivecode

3 — activate it in your session

/reload-plugins

That's it. It installs globally — active in every repo you open. No file copying, no config, no API keys, no signup.

Then open any repo, run claude, and either type /lazarus:discover or /lazarus:audit — or just say "make this run locally." See it in action below. 👇

A scary repo to a running app — discover, you approve, repair, and the guard swatting a destructive command mid-run:

Two independent workflows. One makes the code run; the other tells you what to do about it.

flowchart LR
    A["any codebase<br/>(broken or healthy)"] --> B{what do<br/>you need?}

    B -->|make it run| C["🔍 lazarus:discover<br/>read-only"]
    C --> D["📋 DISCOVERY.md<br/>plan + 'done' checklist"]
    D --> E(["🧑 you approve<br/>the checklist"])
    E --> F["🔧 lazarus:repair<br/>works the blockers"]
    F --> G["✅ running app +<br/>verified CLAUDE.md"]

    B -->|assess it| H["🧭 lazarus:audit<br/>read-only"]
    H --> I["📊 CODEBASE_AUDIT.md<br/>risks · what to fix first<br/>· refactor vs rewrite"]

    style A fill:#fee2e2,stroke:#ef4444,color:#111
    style G fill:#dcfce7,stroke:#22c55e,color:#111
    style I fill:#e0f2fe,stroke:#0ea5e9,color:#111
    style E fill:#fef9c3,stroke:#eab308,color:#111

Type the command, or just describe what you want — both work. The fast path is the command itself: /lazarus:discover, /lazarus:repair, /lazarus:audit (start typing /discover, /repair, or /audit and it autocompletes). Plain English triggers the same skill.

Here's the headline. Letting an agent loose in an unfamiliar repo is terrifying because one confident-but-wrong command can wreck your machine. So Lazarus ships a deterministic guard — a PreToolUse hook that inspects every shell command before it runs and refuses the dangerous ones.

This is not a politely-worded instruction Claude can talk itself out of. It's a hook that runs outside the model and returns "no." It blocks rm -rf /, git push --force, git reset --hard origin, DROP TABLE, terraform destroy, kubectl delete, npm publish, and ~25 more patterns — and it composes with any hooks you already have, so nothing of yours is overwritten.

lazarus/  ← the marketplace
│
├── plugins/lazarus/                 🧟 core   — /plugin install lazarus@cognitivecode
│   ├── skills/discover · repair · audit    the two workflows
│   ├── agents/repo-explorer                read-only Haiku subagent for huge repos
│   └── hooks/ + scripts/check-destructive.sh   the deterministic guard
│
└── plugins/lazarus-github/         📋 optional companion — /plugin install lazarus-github@cognitivecode
    └── skills/issues                       turns an audit's Top 10 into GitHub Issues

After running /lazarus:audit, you can turn the audit's Top 10 Action Items into filed GitHub Issues with one command. lazarus-github is the first sibling plugin in the Lazarus ecosystem — opt-in, installed separately from core.

Install (one at a time, like the core install):

/plugin install lazarus-github@cognitivecode

/reload-plugins

Use:

/lazarus-github:issues

The skill reads CODEBASE_AUDIT.md §11, shows you the proposed issues, lets you adjust titles and labels and pick which to file, then runs gh issue create for each one. Ratify-before-create — nothing is filed silently.

Idempotent on re-runs. Each created issue carries a hidden provenance marker (<!-- lazarus:audit-item:<slug> -->, keyed to a stable per-item slug — not the rank) plus a lazarus-audit label. Re-audit your repo, re-run /lazarus-github:issues, and items that already have an issue are skipped — only new findings get filed. Re-ranking on a re-audit can't cause duplicates, because the marker keys on the slug, not the position.

GitHub-only for v1. Uses the gh CLI, which most developers already have — pre-authenticated in many environments (Codespaces, devcontainers, anyone who's run gh auth login). No API tokens to manage.

What it requires: gh installed, authenticated (gh auth status succeeds), and resolving to the current repo (gh repo view succeeds). The skill fails fast with a clear message if any of these isn't true — it never partially files.

lazarus-github establishes the structural pattern for outward-facing integrations: each ships as a separate opt-in plugin in the same marketplace, never bundled into core. Core Lazarus stays small, fast, and zero-config; integrations grow the ecosystem by addition.

Why not one plugin with every integration? Each tracker has its own auth story — Linear and Jira need API tokens and workspace config; GitLab brings its own CLI. Bundling them into core would force every user to pay the setup cost for integrations they'll never use. Sibling plugins let you install only what you need — and a gh/API failure can only ever reach someone who opted in.

Other tracker integrations (Linear, Jira, GitLab) are part of the architectural vision — not committed roadmap items. If one would help you, open a discussion; interest signals what to build next.

It's a 1-second click, and it does two things: it helps the next person staring at a dead repo actually find this, and it tells me whether to keep building in the open.

I have more Claude Code tools ready to ship — I'm releasing them based on real signal. Stars and activity here are how I gauge whether people want them. So a star isn't just a thank-you; it's a vote for the next one.

🔜 Next up: /lazarus:remediate — close the loop from audit to fixed: take the findings and work them, behind the same guard. ⭐ star and open a discussion to shape it before it ships.

💬 Got an idea, a bug, or a repo Lazarus choked on? Open an issue or start a discussion — I read every one.

Maintaining or contributing? See MAINTAINING.md and CONTRIBUTING.md.