Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.
C-Rank Grade: B (Solid) - 56/100
External PR Merge Rate: 70%
Response Time: <1h
First Timer Success: 69%
GRCEngClub/claude-grc-engineering has a recorded first-timer success rate of 69.2%. Repositories ranked B typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in GRCEngClub/claude-grc-engineering respond to incoming external pull requests in approximately 0.0 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 56.1 places GRCEngClub/claude-grc-engineering in the B tier.
The external contributor pull request merge rate for GRCEngClub/claude-grc-engineering is 69.8%, based on public PR activity from non-core contributors.
GRCEngClub/claude-grc-engineering currently has 5 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.
Active maintainer team in GRCEngClub/claude-grc-engineering welcoming community pull requests and bug fixes.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/GRCEngClub/claude-grc-engineering?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 13:00 UTC (13:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 13:00 to 17:00 UTC (13:00 - 17:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~4 hours (87% approval). Large PRs (>500 lines) take ~0 hours (31% approval). Keep your diff compact for rapid review.
Context A bunch of framework plugins ship an /<framework>:evidence-checklist command that generates audit-ready evidence collection lists for a given control or domain. Examples: plugins/frameworks/gdpr/commands/evidence-checklist.md plugins/frameworks/hitrust/commands/evidence-checklist.md The pci-dss plugin doesn't have one yet. PCI DSS 4.0.1 evidence is one of the most-asked-for artifacts for any organization that touches cardholder data — assessors want a clean per-requirement evidence binder. What to do Read 2 or 3 existing evidence-checklist.md commands to internalize the shape (GDPR + HITRUST are best). Create plugins/frameworks/pci-dss/commands/evidence-checklist.md that: Accepts a requirement (e.g., 1.4.1, 8.3.6, 12.10) or a top-level requirement number (e.g., 4, 8). Optionally accepts --saq <A|A-EP|B|B-IP|C|C-VT|D|P2PE> so the checklist scopes to the SAQ the org actually uses. Default D (the merchant default for "everything in scope"). Optionally accepts --export <markd
Context A bunch of framework plugins ship an /<framework>:evidence-checklist command that generates audit-ready evidence collection lists for a given control or family. Examples: plugins/frameworks/gdpr/commands/evidence-checklist.md plugins/frameworks/hitrust/commands/evidence-checklist.md plugins/frameworks/cmmc/commands/evidence-checklist.md The nist-800-53 plugin doesn't have one yet, which is surprising — NIST 800-53 r5 evidence collection is a daily activity for any FedRAMP, StateRAMP, or federal-contractor program. What to do Read 2 or 3 existing evidence-checklist.md commands to internalize the shape (GDPR + HITRUST are best for this). Create plugins/frameworks/nist-800-53/commands/evidence-checklist.md that: Accepts a control ID (e.g., AC-2, AU-3, SC-13) or a control family (e.g., AC, AU, SC). Optionally accepts --baseline <low|moderate|high> so the checklist depth tracks impact level. Default moderate. Optionally accepts --export <markdown|json|csv>. Default markdown. I
Context A bunch of framework plugins follow a convention of shipping an /<framework>:evidence-checklist command that generates audit-ready evidence collection lists for a given control or domain. Examples: plugins/frameworks/gdpr/commands/evidence-checklist.md plugins/frameworks/hitrust/commands/evidence-checklist.md plugins/frameworks/cmmc/commands/evidence-checklist.md plugins/frameworks/nist-csf-20/commands/evidence-checklist.md The iso27001 plugin doesn't have one yet. This is the most-requested framework command for ISO 27001:2022 audit prep. What to do Read 2 or 3 existing evidence-checklist.md commands to internalize the shape (the GDPR and HITRUST ones above are the best references — they show full output examples). Create plugins/frameworks/iso27001/commands/evidence-checklist.md that: Accepts an Annex A control ID (e.g., A.5.15, A.8.24) or a control domain (e.g., Organizational, Technological). Optionally accepts --export <format> with markdown, json, and csv options. D
Context Every connector plugin in plugins/connectors/ ships sample v1 Finding documents under tests/fixtures/findings/<connector>/ that exercise the contract test (tests/validate-contract-fixtures.sh). Two connectors are missing fixtures: gcp-inspector and okta-inspector (filed separately). Adding fixtures is a great first issue because it: Teaches the schemas/finding.schema.json v1 contract directly. Lets you touch one connector's logic without needing GCP credentials. Has a clean, mechanical acceptance check (CI runs the contract test). What to do Read the GCP inspector scripts under plugins/connectors/gcp-inspector/scripts/ and the commands/collect.md doc to understand the resource types and SCF controls it evaluates. Look at the existing fixture pattern: tests/fixtures/findings/aws-inspector/001-s3-unencrypted.json. Create at least 3 fixtures under tests/fixtures/findings/gcp-inspector/ covering the status mix the connector actually produces: One pass finding (e.g., uniform buc
Context Every connector plugin in plugins/connectors/ ships sample v1 Finding documents under tests/fixtures/findings/<connector>/ that exercise the contract test (tests/validate-contract-fixtures.sh). Two connectors are missing fixtures: okta-inspector and gcp-inspector (filed separately). Adding fixtures is a great first issue because it: Teaches the schemas/finding.schema.json v1 contract directly. Touches one connector's logic enough to ground you, without requiring you to call Okta. Has a clean, mechanical acceptance check (CI runs the contract test). What to do Read plugins/connectors/okta-inspector/scripts/collect.js and commands/collect.md to understand the kinds of resources the connector emits (auth policies, users, factors, etc.) and the SCF controls it evaluates (IAC-01.2, IAC-06, IAC-15, etc.). Look at the existing fixture pattern: tests/fixtures/findings/aws-inspector/001-s3-unencrypted.json. Create at least 3 fixtures under tests/fixtures/findings/okta-inspector/ that
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to GRCEngClub/claude-grc-engineering, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of GRCEngClub/claude-grc-engineering acknowledge new external contributions in approximately <1 hour. Out of all submitted pull requests from non-core authors in the last 180-day window, 69.8% were successfully merged into the primary branch.
GRCEngClub/claude-grc-engineering has a recorded first-timer success rate of 69.2%. Repositories ranked Solid typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~<1 hour. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 56.1 places GRCEngClub/claude-grc-engineering in the Solid tier.
The external pull request merge rate is 69.8%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, GRCEngClub/claude-grc-engineering currently has 5 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for GRCEngClub/claude-grc-engineering are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.