Add Antigravity, Claude Code, and Codex plugin support with local installer

.claude-plugin/marketplace.json

@@ -0,0 +1,16 @@
+{
+  "name": "google-secops",
+  "owner": {
+    "name": "Google"
+  },
+  "metadata": {
+    "description": "Marketplace for the Google SecOps extension: curated agent skills for Security Operations."
+  },
+  "plugins": [
+    {
+      "name": "google-secops",
+      "source": "./",
+      "description": "Essential Security Operations skills for Triage, Investigation, and Hunting."
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "google-secops",
+  "description": "Essential Security Operations skills for Triage, Investigation, and Hunting.",
+  "version": "1.1.0",
+  "author": {
+    "name": "Google"
+  },
+  "mcpServers": "./mcp_config.json"
+}

.codex-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "google-secops",
+  "version": "1.1.0",
+  "description": "Essential Security Operations skills for Triage, Investigation, and Hunting.",
+  "skills": "./skills/"
+}

.gitignore

@@ -0,0 +1,10 @@
+.env
+.env.local
+.env.production
+.env.development
+.env.staging
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.DS_Store
+.mcp.json

README.md

@@ -1 +1 @@
-GEMINI.md
+rules/GEMINI.md

commands/secops/detection-engineering.toml

@@ -0,0 +1 @@
+prompt = """Run the secops-detection-engineering skill for `{{args}}`."""

docs/antigravity_runtimes_config.md

@@ -0,0 +1,63 @@
+# Antigravity Runtimes & Configuration Reference
+
+This document details the directory locations, configuration file paths, and runtime behaviors across the three Google Antigravity product surfaces:
+- **Antigravity 2.0 (Desktop Standalone App)**
+- **Antigravity IDE (Visual Studio Code Extension / IDE Integration)**
+- **Antigravity CLI (`agy`)**
+
+All information in this document is sourced directly from official Google Developer documentation (`antigravity.google` and `developers.google.com`).
+
+---
+
+## Quick Comparison Matrix
+
+The table below summarizes the official global and workspace paths for each runtime environment as documented in the Google Developer Knowledge corpus.
+
+| Feature / Location | Antigravity 2.0 (Desktop Standalone App) | Antigravity IDE | Antigravity CLI (`agy`) |
+| :--- | :--- | :--- | :--- |
+| **Primary Interface** | Visual desktop application | VS Code / IDE extension | Terminal TUI |
+| **Global Plugin Bundle Path** | `~/.gemini/config/plugins/<plugin-name>/`<br>*(contains `plugin.json`, `skills/`, `mcp_config.json`)* | `~/.gemini/config/plugins/<plugin-name>/` | Not applicable (Plugins convert to CLI skills) |
+| **Workspace Plugin Bundle Path** | `<workspace-root>/.agents/plugins/<plugin-name>/` | `<workspace-root>/.agents/plugins/<plugin-name>/` | Not applicable |
+| **Global Standalone Skills Path** | `~/.gemini/config/skills/<skill-folder>/` | `~/.gemini/antigravity/skills/<skill-folder>/`<br>*(or `~/.gemini/antigravity-ide/skills/`)* | `~/.gemini/antigravity-cli/skills/` |
+| **Workspace Standalone Skills Path** | `<workspace-root>/.agents/skills/<skill-folder>/` | `<workspace-root>/.agents/skills/<skill-folder>/` | `<workspace-root>/.agents/skills/` |
+| **Global MCP Config Path** | `~/.gemini/config/plugins/<plugin-name>/mcp_config.json`<br>*(plugin-scoped)* or `~/.gemini/config/mcp_config.json`<br>*(system-wide)* | `~/.gemini/antigravity/mcp_config.json`<br>*(or `~/.gemini/config/mcp_config.json`)* | `~/.gemini/antigravity-cli/mcp_config.json` |
+| **Workspace MCP Config Path** | `<workspace-root>/.agents/plugins/<plugin-name>/mcp_config.json`<br>*(plugin-scoped)* or `<workspace-root>/.agents/mcp_config.json` | `<workspace-root>/.agents/mcp_config.json` | `<workspace-root>/.agents/mcp_config.json` |
+
+---
+
+## Key Differences & Overlapping Paths
+
+### 1. Plugin Bundling vs. Standalone Skills (Desktop Parity)
+A critical distinction in Antigravity Desktop (`agy-dsk`) is the difference between standalone skill scripts and structured plugin bundles:
+- **Plugin Bundles (Recommended)**: When a plugin manifest (`plugin.json`) is deployed to `~/.gemini/config/plugins/<plugin-name>/` (global) or `<workspace-root>/.agents/plugins/<plugin-name>/` (project, with `<workspace-root>/_agents/plugins/` as an alternate workspace path), Antigravity Desktop automatically scans and registers all skills inside the plugin's `skills/` subdirectory. This keeps plugin skills and dependencies isolated from global namespaces.
+- **Standalone Skills**: For IDE and CLI flavors (or simple standalone scripts), skills are installed directly into flavor-specific profile directories (`~/.gemini/antigravity/skills/` or `~/.gemini/antigravity-cli/skills/`).
+- **Workspace Parity**: All three runtimes standardize on `<workspace-root>/.agents/skills/` for standalone project-level skills (maintaining backward compatibility for legacy `.agent/skills/` singular syntax).
+
+### 2. Model Context Protocol (MCP) Resolution & Isolation
+- **Plugin-Scoped MCP Config**: In Antigravity Desktop, plugins define their own `mcp_config.json` directly inside their plugin root (`~/.gemini/config/plugins/<plugin-name>/mcp_config.json`). Antigravity automatically loads these servers when the plugin is active, avoiding global `~/.gemini/config/mcp_config.json` namespace pollution.
+- **Profile-Scoped MCP Config**: For IDE and CLI flavors, global MCP configurations are merged directly into their profile directories (`~/.gemini/antigravity/mcp_config.json` or `~/.gemini/antigravity-cli/mcp_config.json`).
+- **OAuth Token Cache**: Cached OAuth access tokens for `google_credentials` auth provider endpoints are stored in `~/.gemini/antigravity/mcp_oauth_tokens.json`. Expired tokens are refreshed automatically; invalid or corrupted tokens can be pruned from this file during troubleshooting.
+- **Safe Configuration Merging**: When automated deployment tools (like `scripts/install.py`) install or update MCP configs, they use parameterized template variables (`${SERVER_URL}`, `${PROJECT_ID}`) and perform safe dictionary merges. This ensures user-configured headers (such as `x-goog-user-project`) are preserved across updates without clobbering existing configuration files.
+
+### 3. Cross-Page Documentation Discrepancies & Legacy Migration
+- **Documentation Resolution Hierarchy**: General overview pages (such as [Google Antigravity Skills Overview](https://antigravity.google/docs/skills)) describe a single global skills path (`~/.gemini/config/skills/`), but product-surface specific guides ([Google Antigravity IDE Skills Guide](https://antigravity.google/docs/ide/skills) and [Google Antigravity CLI Plugins & Skills](https://antigravity.google/docs/cli/plugins)) override this with surface-specific profile paths (`~/.gemini/antigravity/skills/` and `~/.gemini/antigravity-cli/skills/`). The installer follows surface-specific paths to ensure proper isolation.
+- Legacy Gemini CLI workspace skills (`.gemini/skills/`) must be relocated to `.agents/skills/`.
+- Legacy Gemini CLI extensions can be loaded natively as plugins by adding a `plugin.json` manifest alongside `gemini-extension.json`.
+
+---
+
+## Official Documentation References
+
+The data in this document is cited directly from official Google Developer documentation:
+
+1. **Agent Skills & Directory Specs**:
+   - [Google Antigravity Skills Overview](https://antigravity.google/docs/skills)
+   - [Google Antigravity IDE Skills Guide](https://antigravity.google/docs/ide/skills)
+2. **MCP Configuration Specs**:
+   - [Google Antigravity MCP Documentation](https://antigravity.google/docs/mcp)
+   - [Google Workspace MCP Setup Guide](https://developers.google.com/workspace/guides/universal-search-mcp)
+3. **Plugin Architecture & CLI Migration**:
+   - [Google Antigravity Plugins Spec](https://antigravity.google/docs/plugins)
+   - [Google Antigravity CLI Overview & Migration](https://antigravity.google/docs/cli/overview)
+   - [Google Antigravity CLI Using & Configuration](https://antigravity.google/docs/cli/using)
+   - [Google Antigravity CLI Plugins & Skills](https://antigravity.google/docs/cli/plugins)

gemini-extension.json

@@ -4,11 +4,11 @@
   "description": "Essential Security Operations skills for Triage, Investigation, and Hunting.",
   "version": "1.1.0",
   "skills": [
-    "skills/setup-antigravity",
     "skills/triage",
     "skills/investigate",
     "skills/hunt",
-    "skills/cases"
+    "skills/cases",
+    "skills/detection-engineering"
   ],
   "settings": [
     {
@@ -38,16 +38,17 @@
     }
   ],
   "mcpServers": {
-    "remote-mcp-secops": {
-      "httpUrl": "${SERVER_URL}",
+    "google-security-operations": {
+      "serverUrl": "${SERVER_URL}",
       "authProviderType": "google_credentials",
       "oauth": {
         "scopes": [
           "https://www.googleapis.com/auth/cloud-platform"
         ]
       },
       "headers": {
-        "x-goog-user-project": "${PROJECT_ID}"
+        "x-goog-user-project": "${PROJECT_ID}",
+        "Authorization": "Bearer ${BEARER_TOKEN}"
       },
       "env": {
         "PROJECT_ID": "${PROJECT_ID}",

justfile

@@ -0,0 +1,67 @@
+# List all available targets
+list:
+  just -l
+
+# Install plugin for Antigravity Desktop
+install-agy-dsk mode="global" path=".":
+  python3 scripts/install.py --flavor=agy-dsk --mode={{mode}} --project-path={{path}}
+
+# Install skills for Antigravity IDE
+install-agy-ide mode="global" path=".":
+  python3 scripts/install.py --flavor=ide --mode={{mode}} --project-path={{path}}
+
+# Install skills for Antigravity CLI
+install-agy-cli mode="global" path=".":
+  python3 scripts/install.py --flavor=cli --mode={{mode}} --project-path={{path}}
+
+# Install for all Antigravity flavors (Desktop, IDE, CLI)
+install-agy-all mode="global" path=".":
+  python3 scripts/install.py --flavor=all --mode={{mode}} --project-path={{path}}
+
+
+
+# Uninstall plugin for Antigravity Desktop
+uninstall-agy-dsk mode="global" path=".":
+  python3 scripts/install.py --flavor=agy-dsk --uninstall --mode={{mode}} --project-path={{path}}
+
+# Uninstall skills for Antigravity IDE
+uninstall-agy-ide mode="global" path=".":
+  python3 scripts/install.py --flavor=ide --uninstall --mode={{mode}} --project-path={{path}}
+
+# Uninstall skills for Antigravity CLI
+uninstall-agy-cli mode="global" path=".":
+  python3 scripts/install.py --flavor=cli --uninstall --mode={{mode}} --project-path={{path}}
+
+# Uninstall from all Antigravity flavors
+uninstall-agy-all mode="global" path=".":
+  python3 scripts/install.py --flavor=all --uninstall --mode={{mode}} --project-path={{path}}
+
+# Uninstall Antigravity extension (alias for uninstall-agy-all)
+uninstall-agy mode="global" path=".":
+  python3 scripts/install.py --flavor=all --uninstall --mode={{mode}} --project-path={{path}}
+
+# Get plugin version from manifest
+plugin-version file="plugin.json":
+  @test/get_plugin_version.sh "{{file}}"
+
+# Install extension for Gemini CLI
+install-gemini:
+  gemini extensions install https://github.com/gemini-cli-extensions/google-secops
+
+# Install plugin for Claude Code
+install-claude mode="global":
+  #!/usr/bin/env bash
+  set -euo pipefail
+  if [ "{{mode}}" = "global" ]; then
+      claude plugin marketplace add gemini-cli-extensions/google-secops
+      claude plugin install google-secops@google-secops
+  elif [ "{{mode}}" = "local" ] || [ "{{mode}}" = "project" ] || [ "{{mode}}" = "session" ]; then
+      claude --plugin-dir "{{justfile_directory()}}"
+  else
+      echo "Error: Unknown mode '{{mode}}'. Valid options are: global, local, project, session." >&2
+      exit 1
+  fi
+
+# Run automated validation test suite
+test:
+  test/run_tests.sh

mcp_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "google-security-operations": {
+      "serverUrl": "${SERVER_URL}",
+      "authProviderType": "google_credentials",
+      "headers": {
+        "x-goog-user-project": "${PROJECT_ID}"
+      }
+    }
+  }
+}

plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "google-secops",
+  "version": "1.1.0",
+  "description": "Essential Security Operations skills for Triage, Investigation, and Hunting.",
+  "author": {
+    "name": "Google"
+  },
+  "repository": "https://github.com/gemini-cli-extensions/google-secops",
+  "license": "Apache 2.0"
+}

GEMINI.md → rules/GEMINI.md

@@ -76,23 +76,68 @@ gemini extensions install https://github.com/gemini-cli-extensions/google-secops
     gemini extensions install .
     ```
 
+### Option 3: Install as an Antigravity Plugin (via `just`)
+
+If you have `just` installed, you can use the provided recipes:
+```bash
+# Install globally for Antigravity Desktop
+just install-agy-dsk
+
+# Or install for all Antigravity runtimes (Desktop, IDE, CLI)
+just install-agy-all
+
+# Uninstall (supports specific flavors like uninstall-agy-dsk or all flavors via uninstall-agy)
+just uninstall-agy
+```
+
 ### Updating and Uninstalling
 
 *   **Update**: `gemini extensions update google-secops`
 *   **Uninstall**: `gemini extensions uninstall google-secops`
 
+## Loading as a Plugin (Antigravity, Claude Code & OpenAI Codex)
+
+You can load this extension directly as a plugin in **Antigravity**, **Claude Code**, and **OpenAI Codex**.
+
+### Antigravity Integration
+To load the extension in Antigravity, place or symlink the repository folder inside one of these directories:
+*   **Workspace-Level**: Place in `.agents/plugins/google-secops/` (active only for the current workspace).
+*   **Global-Level**: Place in `~/.gemini/config/plugins/google-secops/` (active across all workspaces).
+
+Antigravity will automatically discover the `plugin.json` manifest file at the root of the directory and expose all SecOps skills, guidelines, and rules.
+
+### Claude Code Integration
+To load the extension in Claude Code:
+*   **Workspace-Level**: Place or symlink the repository folder inside `.claude/plugins/google-secops/` at the root of your workspace.
+*   **Global-Level**: Run the `claude` command with the plugin directory flag:
+    ```bash
+    claude --plugin-dir /path/to/google-secops
+    ```
+
+Claude Code will automatically discover the `.claude-plugin/plugin.json` manifest and expose all skills under the `/google-secops:` namespace.
+
+### OpenAI Codex Integration
+To load the extension in Codex:
+*   **Workspace-Level / Manual Integration**: Place or symlink the repository folder inside `.codex-plugin/` at the root of your workspace or custom plugin marketplace directory.
+
+Codex will automatically discover the `.codex-plugin/plugin.json` manifest file at the root of the directory and register all SecOps skills.
+
+
 ## Post-Installation
 
 ### 1. Configuration
 
-During installation, you will be prompted for several parameters:
+During installation under Antigravity / Gemini CLI, you will be prompted for several parameters:
 
 *   `PROJECT_ID`: Your Google Cloud Project ID (not number).
 *   `CUSTOMER_ID`: Your Chronicle Customer UUID4.
 *   `REGION`: Your Chronicle Region (e.g., `us`, `europe-west1`).
 *   `SERVER_URL`: The regional MCP endpoint (e.g., `https://chronicle.us.rep.googleapis.com/mcp`).
 
-> **Note**: These values are persisted in `~/.gemini/extensions/google-secops/.env`. You can edit this file at any time to update your configuration.
+> **Note**: For Antigravity, these values are persisted in `~/.gemini/extensions/google-secops/.env`. You can edit this file at any time to update your configuration.
+
+#### Claude Code Configuration
+For Claude Code, the required environment variables (`PROJECT_ID`, `CUSTOMER_ID`, `REGION`, `SERVER_URL`) should be set in your shell environment or loaded using tools like `direnv` or a `.env` file in the current working directory.
 
 ### 2. Verify Skills
 
@@ -102,15 +147,12 @@ Run the following command to ensure the skills are loaded:
 /skills list
 ```
 
-You should see `secops-setup-antigravity`, `secops-triage`, etc., in the list.
+You should see `secops-triage`, etc., in the list.
 
 ## Usage
 
 ### Available Skills
 
-*   **Setup Assistant** (`secops-setup-antigravity`)
-    *   *Trigger*: "Help me set up Antigravity", "Configure Antigravity for SecOps"
-    *   *Function*: Helps configure Antigravity to also use the Remote MCP Server.
 *   **Alert Triage** (`secops-triage`)
     *   *Trigger*: "Triage alert [ID]", "Analyze case [ID]"
     *   *Function*: Orchestrates a Tier 1 triage workflow (deduplication, enrichment, classification).
@@ -123,6 +165,9 @@ You should see `secops-setup-antigravity`, `secops-triage`, etc., in the list.
 *   **Cases** (`secops-cases`)
     *   *Trigger*: "List cases", "Show recent cases", "/secops:cases"
     *   *Function*: Lists recent SOAR cases to verify connectivity.
+*   **Detection Engineering** (`secops-detection-engineering`)
+    *   *Trigger*: "Evaluate detection coverage", "Generate TDOs from blog", "Check rule coverage for TTP"
+    *   *Function*: Automates the end-to-end detection engineering workflow (threat intell extraction, TDO generation, synthetic event simulation, coverage evaluation, and YARA-L rule creation).
 
 ### Custom Commands
 
@@ -132,6 +177,7 @@ Use these shortcuts for common tasks:
 *   `/secops:investigate <CASE_ID>`
 *   `/secops:hunt <THREAT>`
 *   `/secops:cases`
+*   `/secops:detection-engineering <THREAT_INTEL>`
 
 ## Known Issues
 

rules/secops-environment.md

@@ -0,0 +1,15 @@
+---
+name: secops-environment
+description: Google SecOps environment configuration parameters including Customer ID, Project ID, Region, and Server URL.
+---
+
+# Google SecOps Environment Context
+
+When executing tools, custom commands, or skills that interact with Google SecOps (including detection engineering, alert triage, threat hunting, and case management), always use the following configured environment parameters:
+
+*   **Google Cloud Project ID (`PROJECT_ID`)**: `${PROJECT_ID}`
+*   **Chronicle Customer ID (`CUSTOMER_ID`)**: `${CUSTOMER_ID}`
+*   **Chronicle Region (`REGION`)**: `${REGION}`
+*   **Server URL (`SERVER_URL`)**: `${SERVER_URL}`
+
+Whenever a SecOps MCP tool or workflow (such as `generate_threat_detection_opportunity`, `generate_synthetic_events`, `evaluate_rule_coverage`, `get_rule`, `generate_rules`, `create_rule`, `list_cases`, `udm_search`, etc.) requires a customer ID, project ID, region, or server URL parameter, always supply these exact configured values unless explicitly overridden by the user.