heyGRC for coding agents

GRC compliance review for your pull requests. heyGRC reviews each PR against ISO 27001, SOC 2, GDPR, the EU AI Act, DORA, NIS 2 and your own company profile, then posts inline findings, a neutral check run, and a sticky summary comment. Public repositories are free.

By Better ISMS.

This plugin does not review code on your machine. It is a setup skill that installs and configures the heyGRC GitHub App. Reviews run server-side.

Install

Claude Code

/plugin marketplace add better-isms/heygrc-plugin
/plugin install heygrc@heygrc

Then run /heygrc:review.

Cursor

Load the repo as an Agent Plugin (root plugin.json) from Customize, or submit/install from the Cursor Marketplace once listed. Local test: symlink this repo into ~/.cursor/plugins/local/heygrc.

Codex CLI

codex plugin marketplace add better-isms/heygrc-plugin

Then /plugins and install heygrc.

GitHub Copilot CLI

Copilot CLI reads .claude-plugin/marketplace.json:

copilot plugin marketplace add better-isms/heygrc-plugin
copilot plugin install heygrc@heygrc

Any Agent Skills client

npx skills add better-isms/heygrc-plugin

Gemini CLI

gemini extensions install https://github.com/better-isms/heygrc-plugin

Also indexed in the Gemini CLI extension gallery (geminicli.com/extensions).

After install, ask the agent to set up heyGRC compliance review. Full steps: SETUP.md.

Where it is listed

OpenAI / ChatGPT Plugins Directory: https://chatgpt.com/plugins/plugins_6a886769f0fc8191a0d42669abca1f98
skills.sh: https://skills.sh/better-isms/heygrc-plugin
SkillsMP (auto-indexed)
The heyGRC GitHub App itself is on the GitHub Marketplace: https://github.com/marketplace/heygrc

What it does

heyGRC runs as a GitHub App, so reviews happen server-side, not on your machine. On each pull request it posts:

Inline findings on the exact lines that touch a compliance obligation, each with a control reference and a short reason.
A neutral check run. heyGRC never fails a check or blocks a merge.
One sticky summary comment per PR, updated in place.

Pricing

Public repositories: always free.
Private repositories: free up to 25 reviews per month. Claiming your install starts a 14-day unlimited-private trial; after that, on-demand private reviews are $0.49 each.

See pricing and plans.

License

MIT. See LICENSE.