01 — Tech Stack

There is essentially no source code shipping at runtime — the artifacts are markdown and JSON/YAML manifests interpreted by Claude Code / Cowork / the Managed Agents API. The languages below are for the tooling that builds, validates, and deploys those manifests.

Languages

Key dependencies

Python (used by scripts/)

pyyaml          # YAML loading for manifests + frontmatter      (check.py:21, deploy-managed-agent.sh:35, validate.py:18)
jsonschema      # Schema validation in orchestrate.py + validate.py  (orchestrate.py:21, validate.py:14)
anthropic       # SDK for the Managed Agents preview endpoint   (orchestrate.py:20)

There is no requirements.txt at repo root; the scripts assert imports inline and exit with an actionable error (check.py:19-23):

try:
    import yaml
except ImportError:
    print("ERROR: requires pyyaml (pip install pyyaml)", file=sys.stderr)
    sys.exit(2)

One skill (plugins/agent-plugins/pitch-agent/skills/dcf-model/) carries its own requirements.txt and scripts/recalc.py — that's runtime support for headless .xlsx recalculation via LibreOffice (referenced in SKILL.md:801-841). It is Claude's runtime, not the deploy pipeline's.

Bash / shell tools

scripts/deploy-managed-agent.sh:34-35 asserts jq and python3 + pyyaml. The script also uses curl, zip, and standard POSIX utilities. The CI (.github/workflows/secret-scan.yml) installs gitleaks v8.28.0 with a pinned SHA-256.

Claude / Anthropic platform

The repo runs on top of three Anthropic APIs / surfaces:

MCP connectors (data plane)

The financial-analysis vertical centralizes 11 third-party MCP servers in one .mcp.json. Quoted from plugins/vertical-plugins/financial-analysis/.mcp.json:

The managed-agent variant injects MCP URLs from environment variables (agent.yaml has ${CAPIQ_MCP_URL}, ${DALOOPA_MCP_URL}, etc.) so different deployments can point at different vendors or internal proxies. scripts/deploy-managed-agent.sh:43-51 whitelists ${VAR} values to [A-Za-z0-9._/:@-] to prevent shell-injection from a hostile env value.

Why these choices (where it's apparent)

1. No build step. "Everything is file-based — markdown and JSON, no build step." (README.md:99). The repo is editable in any text editor and ships as-is to the marketplace.
2. YAML for manifests, JSON for outputs. YAML is human-friendly and supports comments + env-var substitution. JSON is what POST /v1/agents consumes. The deploy script bridges with python3 -c 'import yaml,json; json.dump(yaml.safe_load(...))' (deploy-managed-agent.sh:36-52).
3. Bash + jq instead of a Python deploy CLI. The script is a series of curl-and-transform steps, naturally expressed as a pipeline. It would be longer in Python without being clearer.
4. pyyaml + jsonschema only. Validation is a CI tier-zero concern — check.py blocks merges; orchestrate.py and validate.py re-use the same schemas at runtime.
5. anthropic SDK in orchestrate.py — uses client.beta.agents.sessions.stream(...) and .steer(...) with a # type: ignore[attr-defined] (orchestrate.py:68,79) because the Managed Agents endpoint is preview and the SDK type stubs lag.

Repo-wide invariants

These are mechanically enforced:

This level of structural enforcement is unusual for a content-only repo — it's there because the failure mode of a stale skill bundle isn't a build error, it's an agent silently using outdated guidance in production.