Mastermind

The AI engineering team you run as CEO. It lives in your repo, its memory compounds across runs, and you keep the final say on every verdict.

Mastermind attaches a persistent team of twelve named specialists to an existing codebase. They review, debate, build, and ship inside your repo: every framing, veto, and tie-break is written to disk and replayable, and nothing merges, pushes, or spends budget without you. It joins Claude Code as a plugin (and runs standalone against any OpenAI-compatible endpoint); it does not replace your coding environment.

Why trust it

Three properties carry the product, and all three are inspectable:

• You are at the helm. Iterate is opt-in, engagements pause and resume under your control (inject, redirect, interview, override), delivery is approval-gated with typed confirmation tokens, and two roles hold hard vetoes that fast-track to escalation instead of shipping around you.
• Everything is on disk. Charters, role memory, decision logs, episode history, and run replays are plain files in .mastermind/ that you own, version, and edit. 97.6% of recorded decisions are attributable to a named role from the on-disk trail alone (measured by the offline scoreboard over real runs).
• The metrics are honest. Numbers below come from scripts/vision-eval.mjs (offline, zero API) and live campaigns, and the claim-vs-measured drift check ships as mastermind doctor honesty. When a lever measured flat, we shipped it off and said so.

What is measured, and what it means

Two different claims, kept apart on purpose:

• Seeded benchmark: 79% convergence. On a hard cross-file corpus of seeded multi-file bugs (symptom and cause in different files), the team converged 19 of 24 live runs. n=24, 95% CI roughly 59-91%; the honest floor is one retry-backoff fixture at 3 of 6.
• Real repository: early, improving, never lies. Against a real open-source bug (validator.js), the team found a test-passing fix in every run, and ships a complete fix 5 of 8 on a hard regex bug and 3 of 3 on a logic bug (up from 1 of 8 before the completeness and apply-repair machinery, both now default-on). It has never shipped a partial fix: when the draft covers only one of two affected code paths, the panel holds it back. The remaining ceiling is a genuine false block (about 1 in 8) where the panel kills a complete fix; closing it is active engine work.

Review coverage is the daily wedge: 54 distinct review concerns are logged across real runs, each attributed to the specialist who raised it (benchmarks/coverage-catches.md). Measuring that edge against an equal-budget single pass is designed and not yet run (benchmarks/proposals/launch-benchmarks.md). Memory compounds: exact prior-run recall rises from 25% cold to 30% as a cycle warms (per spawn), and about 85% of warm role-memory writes carry a kept / reverted / merged / abandoned outcome label.

Today the honest claim is review, human-at-helm control, and on-disk auditability. Autonomous real-repo fixing is early but measurably improving, and it fails closed.

60-second start

From Claude Code (no API key; spawns run as Agent subagents under your existing session):

/plugin add Haydn-opti/mastermind

/mastermind:review --diff
/mastermind:iterate --path src/rate-limiter.ts --goal "fix off-by-one"
/mastermind:engage "Add per-IP rate limiting to src/auth" --run
/mastermind:mission-control

Standalone (npm package is mastermind-ai; the installed binary is mastermind):

npm install -g mastermind-ai

mastermind demo        # replay a real iterate run, zero API calls
mastermind init        # first-run wizard: config + team scaffold
export ANTHROPIC_API_KEY=...   # or OpenAI / any compatible endpoint

mastermind review --diff
mastermind iterate --path src/rate-limiter.ts --goal "fix the window edge case"
mastermind engage "Refactor the auth middleware" --run

Daily work is iterate (one fix, one branch, tests as the gate) or review (multi-pass panel on a diff). Reach for engage when the brief needs interpretation or spans sessions: a seven-phase lifecycle (Discovery, Design, Plan, Build, Review, Ship, Handoff), resumable after a crash, a /compact, or a multi-day pause. There are eleven direct workflows in all (review, iterate, rfc, triage, postmortem, sprint-plan, simulate, think, ask, diagram, onboard); engage is the wrapper that composes them. mastermind doctor checks your setup and prints repair commands.

Mission Control

A local, token-gated web console over the same on-disk state: live deliberation stream, engagement board, decision paper trail, benchmark scoreboard, persona profiles, and a persistent intervention bar (Pause / Inject / Redirect / Override / Approve). Loopback-bound, every mutation confirmation-gated, WCAG 2.2 AA in both themes.

mastermind mission-control

The team

Twelve hand-authored personas, deliberately in tension (velocity vs structure, threat probability vs scope, rollback vs shipping). They share one model and tool surface by default; what differs is framing, priorities, and accumulated memory. Genuine differentiation (per-role model tiers, provider routing, skill packs) is opt-in and fully recorded in each run's replay.

| Handle | Role | | Handle | Role | |---|---|---|---|---| | Ada | CTO, synthesis + tie-breaks | | Dario | Security (hard veto) | | Andrej | Architect | | Linus | SRE (hard veto) | | Sam | Pragmatist | | Jensen | Performance | | Lex | Implementer (IC) | | Grace | Testing | | Kent | Best practices | | Fei-Fei | Developer experience | | Reid | Engagement lead | | Toby | Vision drift watcher |

Charters live in .mastermind/team/<role>/charter.md; edit them, add custom roles with mastermind roles, or disable optional ones.

Safety rails

• Iterate requires autonomy.allowIterate: true; every run works on its own branch with a ledger and rollback.
• Hard cost caps per run; the cost shape is printed before the first spawn.
• Push and PR delivery are approval-gated behind typed confirmation.
• Every untrusted span (file content, test output, debate text) is wrapped and sanitized before it reaches a prompt; forged trust markers are neutralized.
• Live benchmark or campaign spend refuses to start without an explicit approval variable. Self-evolution of the roster is off by default and triple-gated.
• No API keys in config files: the loader rejects inline keys unless explicitly overridden.

Development

CI on GitHub Actions is currently billing-blocked; the enforced gate is local and honest: npm run typecheck and npm test (2318 tests, zero failures at last release cut), plus npm run demo:smoke and the mission-control-ui suite (vitest + Playwright accessibility checks in both themes). mastermind verify re-checks the claim witness manifest, and mastermind doctor honesty fails on claim-vs-measured drift.

Further reading

• SKILL.md: the full Claude Code integration contract
• docs/: commands, config, architecture, cost model, engagement lifecycle, iterate state machine
• docs/positioning.md: tools vs team, the one-pager
• ROADMAP.md: shipped state, live tracker
• CHANGELOG.md
• benchmarks/claims-manifest.json: the witness manifest behind mastermind verify
• demos/: a real human-at-helm control walkthrough and replayable run HTML

Apache 2.0. The package is mastermind-ai on npm; the binary, plugin, and marketplace namespace are mastermind.