The Agency is a library of agent definitions: Markdown files that each describe one specialist, such as a frontend developer, a code reviewer, an SRE, a paid media buyer or a game designer, with an identity, a mission, rules, a checklist and the deliverables it should produce. There are about 300 of them, grouped into divisions like engineering, design, marketing, sales, security, testing and product. An install script copies them into Claude Code's agents folder, and a converter produces versions for Cursor, Copilot, Gemini CLI, Codex, OpenCode, Aider, Windsurf and several others.
It is worth a look because the files are substantial rather than one-line role prompts: the code reviewer, for example, runs to about 76 lines of rules, checklists and examples, and you can install a single division or a single agent instead of the whole roster. The README also lists runbooks that name a team of agents for a job, such as building a startup MVP.
Two honest limits. These are prompts, not software, so the quality of the result depends on your model and on how well a given persona fits your task, and the writing is enthusiastic in places. And at about 164,000 stars it is far more starred than most prompt libraries; the fork count (about 26,000), 109 contributors and steady merged pull requests suggest real use, but judge it on the files you actually install.
- Repository: github.com/msitarzewski/agency-agents
- Licence: MIT (MIT License)
- Language: Shell. Stars: 164.1K. Forks: 26.5K. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit b37b5bb
Who it is for
Claude Code, Cursor and Copilot users who want ready-made specialist subagents, and anyone writing their own agent prompts who wants a large set of examples to borrow structure from.
Getting started
1. Clone the repository
git clone https://github.com/msitarzewski/agency-agents && cd agency-agents2. Install every agent into Claude Code
./scripts/install.sh --tool claude-code3. Or install only the divisions you want
./scripts/install.sh --tool claude-code --division engineering,securityFor other tools, run ./scripts/convert.sh first and then ./scripts/install.sh, which detects what you have installed. The README also points to a separate desktop app that installs the same agents; it lives in another repository and was not part of this scan.
Safety scan
We cloned msitarzewski/agency-agents at commit b37b5bb on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The three secret hits are in security/security-senior-secops.md, lines 46 to 48: the bare -----BEGIN RSA/EC/PGP PRIVATE KEY----- header lines, listed as patterns that the secops agent should look for. There is no key material after them.
- No suspicious code patterns, no committed binaries and no bare-IP URLs across 384 files, about 88,000 lines of them Markdown. The only external host in the code is github.com.
- Two shell installers: scripts/install.sh (about 1,800 lines) and integrations/mcp-memory/setup.sh (75 lines). Neither uses sudo, edits your shell profile or pipes a download into a shell; they copy files into each tool's config folder.
- No lockfiles, so no dependency advisories. Six workflows using only GitHub's own actions, none triggered by pull_request_target. Licence, security policy and contributing guide are present.
- Agent files are instructions your coding agent will follow with its own permissions. They read as plain role descriptions, but as with any prompt pack, skim the ones you install.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 3 candidates found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 6 workflows. None use pull_request_target. No third-party actions. |
| Network hosts | 1 distinct host referenced from source; most often github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (3, redacted)
| Where | Rule | Match |
|---|---|---|
| security/security-senior-secops.md:46 | private-key | -----B…--- (31 chars) |
| security/security-senior-secops.md:47 | private-key | -----B…--- (30 chars) |
| security/security-senior-secops.md:48 | private-key | -----B…--- (31 chars) |
Installer scripts (2)
- integrations/mcp-memory/setup.sh, 75 lines
- scripts/install.sh, 1,802 lines
By the numbers
| Stars | 164.1K |
|---|---|
| Forks | 26.5K |
| Contributors | 109 |
| Commits | 840 |
| Open issues | 29 |
| Open pull requests | 160 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | Shell |
| Project age | 1 year |
| Last push | Oct 25, 2026 |
| Tracked files | 384 |
| Lines of code | 95.6K |
| Checkout size | 5 MB |
Lines by language: Markdown 87.5K, Shell 6,027, Python 1,268, JSON 378, YAML 364, PowerShell 38.
Questions
Is The Agency free?
Yes. The repository is MIT-licensed, so you can use, change and redistribute the agent files for any purpose, including commercial work. Running them still needs Claude Code, Cursor or another tool, under that tool's pricing.
Which tools does it work with?
Claude Code directly, since the files use its subagent format. The convert script produces versions for GitHub Copilot, Cursor, Gemini CLI, Codex, OpenCode, Aider, Windsurf, Kimi Code, Antigravity and a few more, and install.sh copies them into the right place for each.
Do I have to install all 300 agents?
No. Use --division to install one or more groups, or --agent to pick individual agents by name, and ./scripts/install.sh --list teams shows every group with its agent count. The README notes that OpenCode currently drops agents beyond about 119, so installing a subset helps there.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.