LH-114214: Add SCCFM agent plugin

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "sccfm-devkit",
+  "interface": {
+    "displayName": "Cisco SCC Firewall Manager"
+  },
+  "plugins": [
+    {
+      "name": "sccfm",
+      "source": {
+        "source": "local",
+        "path": "./plugins/sccfm"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Security"
+    }
+  ]
+}

.claude-plugin/marketplace.json

@@ -0,0 +1,24 @@
+{
+  "name": "sccfm-devkit",
+  "description": "Cisco SCC Firewall Manager plugins for AI coding agents",
+  "owner": {
+    "name": "Cisco DevNet",
+    "url": "https://developer.cisco.com"
+  },
+  "plugins": [
+    {
+      "name": "sccfm",
+      "source": "./plugins/sccfm",
+      "displayName": "SCC Firewall Manager",
+      "description": "Install, configure, and safely operate sccfm-cli and the cisco.sccfm Ansible collection.",
+      "category": "security",
+      "tags": [
+        "cisco",
+        "sccfm",
+        "firewall-manager",
+        "security",
+        "ansible"
+      ]
+    }
+  ]
+}

.gitignore

@@ -33,6 +33,9 @@ results/
 
 # Local Codex/agent runtime metadata
 .agents/*
+!.agents/plugins/
+.agents/plugins/*
+!.agents/plugins/marketplace.json
 !.agents/skills/
 .agents/skills/*
 !.agents/skills/sccfm-cli

README.md

@@ -12,6 +12,7 @@ package with the `sccfm-cli` and `sccfm-cli-interactive` commands, a reusable
 ## Table of Contents
 
 - [Getting started](#getting-started)
+- [Claude Code and Codex plugin](#claude-code-and-codex-plugin)
 - [Commands](#commands)
 - [Python library](#python-library)
 - [Ansible collection](#ansible-collection)
@@ -38,6 +39,42 @@ Python 3.12.4, `.venv/` hosts the project runtime, and `.venv/.poetry/` hosts Po
 was created by an older version of the script that installed Poetry into the project runtime,
 remove `.venv/` once and rerun the setup script.
 
+## Claude Code and Codex plugin
+
+The repository contains an `sccfm` agent plugin for Claude Code and Codex. It
+bundles guided installation and authentication setup with the canonical
+`sccfm-cli` and `cisco.sccfm` Ansible skills.
+
+Claude Code:
+
+```text
+/plugin marketplace add CiscoDevNet/sccfm-devkit
+/plugin install sccfm@sccfm-devkit
+```
+
+Codex:
+
+```bash
+codex plugin marketplace add CiscoDevNet/sccfm-devkit
+codex plugin add sccfm@sccfm-devkit
+```
+
+After installation, ask the agent to `Set up SCC Firewall Manager for this
+machine.` The setup checks Python and `pipx`, proposes a version-matched CLI and
+Ansible installation plan, waits for the exact `INSTALL SCCFM X.Y.Z`
+confirmation, and directs token entry to the CLI's hidden local prompt rather
+than chat.
+
+The operational skills can execute schema-proven read-only commands. Mutating
+commands require a typed `EXECUTE <exact shell command>` confirmation; broad or
+bulk changes require two confirmations. Claude Code and Codex load a shared
+pre-command hook backed by the same one-use approval guard. See
+[`plugins/sccfm/README.md`](https://github.com/CiscoDevNet/sccfm-devkit/blob/main/plugins/sccfm/README.md)
+for installation and local validation, and
+[`docs/agent-plugin.md`](https://ciscodevnet.github.io/sccfm-devkit/agent-plugin.html)
+for the complete capability and
+end-user workflow.
+
 ## Commands
 
 - `sccfm-cli configure --region REGION [--config-path PATH]`: Stores the SCCFM region (`int`, `us`, `eu`, `apj`, `au`, `uae`, `in`, or `ci`) and API token in the canonical named-profile store. The token comes from `SCCFM_API_TOKEN` or an interactive hidden prompt. Direct `--api-token` input remains available for compatibility but can expose the token in shell history and process listings. On POSIX systems, the default directory uses mode `0700` and the file uses `0600`; on Windows, the store inherits the user's profile-directory ACLs.

cisco_sccfm_cli/commands/tests/test_sccfm_cli_skill.py

@@ -51,7 +51,8 @@ def test_cisco_sccfm_cli_skill_should_cover_schema_driven_operation() -> None:
         "Class A",
         "Class B",
         "Class C",
-        "EXECUTE sccfm-cli <schema command path> <target-summary>",
+        "EXECUTE <exact shell command>",
+        "SCCFM_APPROVAL_COMMAND: <exact shell command>",
         "Match User Intent Conservatively",
         "schema export",
         "not validated against live state",