Claude Grc Engineering plugin for Grok Build
Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.
How to install Claude Grc Engineering in Grok Build
1. Add this repo as a plugin marketplace in Grok Build (once per computer):
grok plugin marketplace add GRCEngClub/claude-grc-engineering2. Install the plugin:
grok plugin install grc-engineer@GRCEngClub/claude-grc-engineering --trustReview before you trust it. --trust lets this plugin's hooks, MCP servers and scripts run code on your computer. It's a community repo that neither xAI nor GrokStacks has reviewed, so read its code first.
This repo's marketplace has 66 plugins; we checked grc-auditor, grc-engineer, grc-internal. Install another the same way: grok plugin install <name>@GRCEngClub/claude-grc-engineering --trust (names under 'What it contains'). Then start a new Grok session, or press r in /plugins, to load it.
Inside Grok Build: type /plugins, open the Marketplace tab, press a and add GRCEngClub/claude-grc-engineering, then select grc-engineer and press i.
Command format: Grok Build's plugin guide
What we checked: on Oct 18, 2026 it installed with grok 1.0.62 and Grok found 37 skills, 24 slash commands. That's an install check only: we haven't run it in a live Grok session.
What it contains
Skills (37)
access-review-triage— Helps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export. For each row, recommends certify, revoke, manager confirm, or investigate using rules that catch the usual audit-fail patteaudit-ready-pr-reviewer— Reviews pull requests for compliance regressions. Scans code diffs for security and compliance violations, flags issues, and suggests fixes aligned with frameworks like SOC 2, ISO 27001, NIST 800-53.code-to-control-mapper— Maps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied.evidence-artifact-collector— Generates CLI commands and API scripts to collect point-in-time evidence for audit controls. Automates evidence gathering from cloud providers (AWS, Azure, GCP) and outputs formatted reports.interview-question-generator— Generates focused assessor interview questions from a technology stack and maps them to compliance frameworks with practical CLI/API evidence hints.policy-as-code-generator— Converts natural language compliance requirements into executable policies (OPA Rego, AWS Config Rules, Sentinel, Terraform). Standardizes governance by making it part of the build process.risk-to-jira-transformer— Converts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted for Jira API with clear Definition of Done criteria.collect-evidence— Generate scripts to collect audit evidencefind-conflicts— Identify conflicting requirements across frameworksframeworks— List every SCF-mapped framework (249) and show which have a dedicated plugingap-assessment— Aggregate connector findings, map to requested frameworks via SCF crosswalk, and produce a prioritized gap report with remediation links.generate-implementation— Generate implementation code for a security controlgenerate-interview-questions— Generate assessment interview questions mapped to framework controlsgenerate-policy— Generate policy-as-code from natural language requirementsmap-control— Map infrastructure code to compliance framework controlsmap-controls-unified— Map a control across all compliance frameworksmonitor-continuous— Run recurring compliance checks and emit machine-readable alertsoptimize-multi-framework— Optimize implementation across multiple compliance frameworkspipeline-status— Summarize every configured connector — auth validity, cache freshness, last-run counts — so operators can see the data-pipeline state at a glance.record-automation-metrics— Write automation coverage metric snapshots into grc-data/metricsreview-pr— Review pull requests for compliance regressionsscaffold-framework— Scaffold a new framework plugin from the SCF crosswalk (Stub or Reference depth)scan-iac— Scan Infrastructure as Code for compliance violationstest-control— Test security control effectiveness with automated validationtransform-risk— Transform risk assessments into Jira ticketscontrol-tester— Designs and documents control testing procedures. Creates test plans, executes walkthroughs, and documents results for audit workpapers.evidence-validator— Validates audit evidence artifacts for completeness, timeliness, relevance, and authenticity. Reviews screenshots, logs, configurations, and policies against control requirements.finding-generator— Generates professional audit findings using the Condition-Criteria-Cause-Effect format. Creates management letter comments and remediation recommendations.generate-workpaper— Generate audit workpaper documentationreview-evidence— Review and validate evidence artifacts against control requirementsvalidate-control— Validate control implementation against framework requirementscompliance-tracker— Tracks compliance status across multiple frameworks. Monitors control implementation, identifies gaps, and generates compliance dashboards and reports.policy-lifecycle— Manages policy documents through their full lifecycle. Reviews policies for gaps, suggests updates based on framework changes, and tracks approval workflows.risk-register-manager— Manages organizational risk registers. Performs risk assessments, calculates risk scores, tracks mitigations, and generates risk reports for leadership.manage-risk— Manage the risk register and risk assessmentstrack-compliance— Track compliance status across frameworks and controlsupdate-policy— Manage policy lifecycle and updates
Plugins in this marketplace (60)
grc-engineer— Maps IaC to compliance controls, generates policies, collects evidence, reviews PRsgrc-auditor— Evidence review, control validation, and audit workpaper generation for external auditorsgrc-internal— Policy management, risk registers, and compliance tracking for internal GRC teamsgrc-tprm— Vendor assessments, questionnaire analysis, and risk scoring for third-party risk managementgrc-reporter— Translate findings, risks, and metrics into narratives leadership reads. Reference implementation of the Reporting category from RFC #38.grc-loop— Iterative GRC automation loops for gap-remediation burndown and quarterly evidence sweeps.gcp-docs— Knowledge source for Google Developer Knowledge API: current Google developer documentation citations for GRC workflows.teach-me— Socratic primer + drill plugin for new-to-GRC practitioners. Get up to speed on a framework, control, or role without already knowing it.academic-research-companion— Guide a research project through the academic lifecycle — idea, literature, methodology, writing, feedback, publishing, and authorship — with verified sources and a durable tracker.grc-diagrams— Editable draw.io diagram patterns for GRC system boundaries, evidence flows, control maps, risk treatment, audits, crosswalks, TPRM, POA&M, data flows, RACI, and operating models.soc2— SOC 2 Trust Service Criteria expertise and Type I/II assessment supportnist-800-53— NIST 800-53 control families and baseline selection (Low/Moderate/High)iso27001— ISO 27001 Annex A controls and ISMS implementation guidancefedramp-rev5— FedRAMP Rev 5 traditional authorization with SSP/SAP/SAR/POA&M and NIST 800-53 controlsfedramp-20x— FedRAMP 20X automated authorization with KSIs, continuous monitoring, and auto-sync from official docspci-dss— PCI DSS v4.0.1 compliance with ROC guidance, SAQ selection, and March 2025 requirementscmmc— CMMC v2.0 (DoD contractors) with 5 levels and C3PAO assessment prephitrust— HITRUST CSF healthcare security with i1/r2 assessmentscis-controls— CIS Controls v8 baseline security with IG1/IG2/IG3 levelsgdpr— GDPR EU privacy regulation with DPIA and data subject rightscsa-ccm— CSA Cloud Controls Matrix with 197 controls and CAIQ supportnydfs— NYDFS 23 NYCRR 500 cybersecurity requirements for financial servicesdora— DORA EU Digital Operational Resilience Act for financial entitiesstateramp— StateRAMP state/local government cloud authorizationessential8— Essential 8 Australian cyber security strategies with maturity levelsglba— GLBA Gramm-Leach-Bliley Act for financial institution privacyus-export— US Export Controls: ITAR (defense) + EAR (dual-use commercial) complianceus-hipaa-security— HIPAA Security Rule (45 CFR Part 164, Subpart C) for ePHI protection with Administrative, Physical, and Technical Safeguardspbmm— Canadian PBMM (Protected B Medium Medium) with ITSG-33 controlsismap— Japanese ISMAP government cloud security (ISO 27001/27017/27018)irap— Australian IRAP (ISM + Essential Eight) for government cloudaws-inspector— GRC connector for AWS: IAM, S3, CloudTrail, EBS compliance checks → v1 finding contractaws-secrets-inspector— GRC connector for AWS Secrets Manager: rotation, customer-managed KMS, resource policy, and access-pattern checks → v1 finding contract. Hybrid shape supports opt-in secret retrieval to stdout or 0600-permission files.github-inspector— GRC connector for GitHub: branch protection, secret scanning, Dependabot, code scanning → v1 finding contractgcp-inspector— GRC connector for Google Cloud: IAM, Cloud Storage, audit logs, KMS rotation, Compute OS Login → v1 finding contractazure-inspector— GRC connector for Azure: Entra ID, Storage, Key Vault, Monitor, and Defender for Cloud to v1 finding contractslack-inspector— GRC connector for Slack: workspace 2FA, SSO/session, retention, app approvals, and DLP visibility to v1 finding contractdatadog-inspector— GRC connector for Datadog: log retention, audit logs, monitor coverage, SSO, and RBAC to v1 finding contractcrowdstrike-inspector— GRC connector for CrowdStrike Falcon: sensor coverage, policies, and host-group scoping to v1 finding contractdrata-inspector— GRC connector for Drata: wraps drata-cli workflows and normalizes compliance posture to v1 finding contractsplunk-inspector— GRC connector for Splunk: index retention, RBAC, audit coverage, search ACLs, and auth posture to v1 finding contracttenable-inspector— GRC connector for Tenable.io/Tenable.sc: scan coverage, credentialed scans, vulnerability age, and scan access to v1 finding contractsnowflake-inspector— GRC connector for Snowflake: MFA, network policies, masking/row access policies, session timeout, and retention to v1 finding contractwiz-inspector— GRC connector for Wiz CNAPP: configuration findings, issues, vulnerabilities, and cloud inventory to v1 finding contracttestssl-inspector— GRC connector wrapping testssl.sh: TLS/SSL protocol, cipher, certificate, and known-CVE checks on HTTPS endpoints → v1 finding contractokta-inspector— GRC connector for Okta: password/MFA/session policies, inactive users, admin factor enrollment → v1 finding contractoscal— OSCAL toolkit: validate and convert catalogs, profiles, SSPs, SAPs, SARs, POA&Ms, assessment results, component definitions. Wraps ethanolivertroy/oscal-cli.fedramp-ssp— Convert FedRAMP Rev 5 SSP DOCX templates to validated OSCAL 1.2.0 SSP JSON. Wraps ethanolivertroy/frdocx-to-froscal-ssp.singapore-pdpa— Singapore - Personal Data Protection Ac (PDPA) (2012) — reference-depth plugin backed by the SCF crosswalk (30 SCF → 14 framework controls).us-finra— FINRA Broker-Dealer Cybersecurity Guidance — stub-depth plugin backed by the SCF crosswalk (17 SCF → 39 framework controls).cyber-essentials-plus— UK NCSC Cyber Essentials Plus (CE+) v3.3 Danzell — gap assessments, evidence checklists, remediation plans, and cross-framework mapping to ISO 27001 and NIST CSF.ch-fadp— Swiss Federal Act on Data Protection (nFADP) — stub-depth plugin backed by the SCF crosswalk (35 SCF → 90 framework controls).ind-dpdpa— India Digital Personal Data Protection Act, 2023 — reference-depth plugin with scope determination, evidence checklist, and breach-process workflow backed by the SCF crosswalk.poam-automation— GRC connector wrapping networkbm/POAM-Automation-Tool: converts vulnerability scans into FedRAMP POA&M Excel and emits NIST-800-53-r5 (SI-2) findings → v1 finding contract.eu-nis2— EU NIS2 Directive (2022) — reference-depth plugin backed by the SCF crosswalk (68 SCF → 30 framework controls).nist-csf-20— NIST Cybersecurity Framework (v2.0) — reference-depth plugin backed by the SCF crosswalk (250 SCF → 134 framework controls).us-sox— US Sarbanes-Oxley Act of 2002 (SOX) — Reference-depth plugin for ICFR scoping, IT General Control (ITGC) testing, and §302/§404/§906 evidence preparation. Backed by the SCF crosswalk (4 SCF → 17 framework controls).us-ccpa— California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — Reference plugin with scope determination, evidence checklist, and SCF-backed gap assessment for the California Privacy Protection Agency (CPPA) regulations.compliance-posture-dashboard— Localhost compliance posture dashboard for monitor-continuous JSON output. Reference implementation of the Dashboards category from RFC #38.jp-appi— Japan APPI reference plugin with scope, evidence checklist, and SCF-backed gap assessment.
About this listing
Claude Grc Engineering is a community plugin on GitHub by GRCEngClub, written as a Claude Code plugin that Grok Build installs. We install-checked it in Grok; we haven't run it in a live session or reviewed its code. When we installed it, Grok found 37 skills, 60 plugins in this marketplaces. No license stated in the repo, so check with the author before reusing its code. We checked commit 784fd9ab375c. It's one of 79 listings in the Security category on GrokStacks.
Stacks Weekly: every new Grok Build and Codex plugin, every Tuesday.
One short email for GrokStacks and CodexStacks readers, with each new plugin's install line and what it ships. Subscribe and get the free starter list: 20 Grok Build plugins worth installing first.
You'll get a confirmation email first. Unsubscribe anytime.
Claude Grc Engineering FAQ
How do I install Claude Grc Engineering in Grok Build?
Add the repo as a marketplace with grok plugin marketplace add GRCEngClub/claude-grc-engineering, then run grok plugin install grc-engineer@GRCEngClub/claude-grc-engineering --trust. This repo's marketplace has 66 plugins; we checked grc-auditor, grc-engineer, grc-internal. Install another the same way: grok plugin install <name>@GRCEngClub/claude-grc-engineering --trust (names under 'What it contains'). Then start a new Grok session, or press r in /plugins, to load it.
Is Claude Grc Engineering an official Grok Build plugin?
No. Claude Grc Engineering is a community plugin on GitHub by GRCEngClub, not in xAI's official Grok Build marketplace. We checked that it installs and what Grok loads from it, but haven't run it in a live Grok session or reviewed its code.
What does Claude Grc Engineering include?
According to what Grok loaded in our install check, Claude Grc Engineering includes 37 skills, 60 plugins in this marketplaces: access-review-triage, audit-ready-pr-reviewer, code-to-control-mapper, evidence-artifact-collector, interview-question-generator, policy-as-code-generator….
Details
- Type
- Plugin
- Category
- Security
- Source
- Community Claude Code plugin, installs in Grok
- License
- No license stated
- Author
- GRCEngClub
- Version
- 1.0.0
- Keywords
- agentic-ai, auditing, claude-code, claude-code-plugin, cmmc, compliance, fedramp, gap-analysis, grc, hitrust, infrastructure-as-code, iso27001
- Source repo
- https://github.com/GRCEngClub/claude-grc-engineering
- Checked commit
784fd9ab375c- Homepage
- https://grcengclub.com
- Checked by GrokStacks
- Install-checked in Grok Build on Oct 18, 2026; not run in a live session
Something wrong or missing? Submit or improve this listing. Marketplace listings also refresh automatically every night.
For maintainers: badge and embeds
Maintain Claude Grc Engineering? Add the badge; it links to this page.
Markdown
[](https://grokstacks.com/p/claude-grc-engineering/)HTML
<a href="https://grokstacks.com/p/claude-grc-engineering/"><img src="https://grokstacks.com/badge.svg" alt="Listed on GrokStacks" width="164" height="28"></a>Embed card (static HTML and inline CSS, no JavaScript). Preview:
<a href="https://grokstacks.com/p/claude-grc-engineering/" style="display:block;max-width:380px;box-sizing:border-box;padding:14px 16px;border:1px solid #2a2e3c;border-radius:12px;background:#0a0b0f;color:#e8eaf0;font:14px/1.45 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;text-decoration:none"><span style="display:block;font-size:16px;font-weight:700;color:#e8eaf0">Claude Grc Engineering</span><span style="display:block;margin:2px 0 8px;font-size:12px;color:#9aa0b1">Community plugin for Grok Build · 37 skills, 60 plugins in this marketplaces</span><span style="display:block;margin:0 0 10px;color:#c9cdd8">Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks…</span><span style="font-size:12px;font-weight:600;color:#7c9cff">View on GrokStacks →</span></a>Markdown summary
**[Claude Grc Engineering on GrokStacks](https://grokstacks.com/p/claude-grc-engineering/)**: Community plugin for Grok Build with 37 skills, 60 plugins in this marketplaces. Install: `grok plugin install grc-engineer@GRCEngClub/claude-grc-engineering --trust` (after `grok plugin marketplace add GRCEngClub/claude-grc-engineering`)More on badges, embeds and keeping your listing up to date: GrokStacks for plugin authors.
Also in Security
Aaron Marketing Skills
120 marketing skills as an AI marketing staff — plugin, portable skills, or an 8-bot team across 7 disciplines (narrative, SEO/GEO, social, email, paid, influencer, launch) on one contract, with 8 auditor gates: TALE · CORE-EEAT · CITE · ECHO · SEND · ROAS · STAR · RAMP.
Adrian
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
Agent Beacon
The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu
Agent Governance Toolkit
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Agentguard
Security guard for AI agents — blocks malicious skills, prevents data leaks, protects secrets. 24 detection rules, runtime action evaluation, trust registry.
Android Reverse Engineering Skill
Claude Code skill to support Android app's reverse engineering