A couple of months ago I posted about running five model families through Claude Code on ordinary subscriptions. I also mentioned it drastically saves my Claude usage + much much more… This is what changed since, and what it's done ;
• Recent Results : Since that post the system found, triaged and got paid for a second critical-severity vulnerability. That's two paid criticals now, plus the two production client sites it already ran. Still my daily driver, not a demo.
• Models : added grok and removed Kimi, Now : Claude, Codex, Gemini (through Google's agy CLI) and Grok. Kimi is gone; it wasn't being used. Claude, Codex and Gemini still run on the subscriptions you already pay for. Grok is the one exception and needs an xAI API key. For security work the specialists lean on Mythos and Opus on the Claude side and Daybreak on the Codex side.
The routing is interchangeable. Every specialist is bound to a model in one file, with a backup from a different family and a review route. My defaults come from benchmarks and from what actually did the job best in use, but if you'd rather use something else, you just ask the coordinator to swap the model for that specialist. No code.
• How it works, unchanged at the core : A coordinator runs as a Claude Code session. You describe a task in plain English, it writes a Markdown task file (which specialist, which model, what files it may touch, what counts as done), and hands it to a freshly spawned CLI in its own git worktree. 71 specialists: ordinary ones like backend-engineer and code-reviewer, and less ordinary ones like experimental-attacker, red-team-operator, reverse-engineer, threat-modeler, impact-validator, and a skeptic whose whole job is to argue with the others. Media roles still come online if you hook up ElevenLabs and Higgsfield.
• Improved focus on long tasks : This was my biggest problem: over a long session the coordinator would drift, or forget what it owed me. Three things fixed it. A hook re-anchors the coordinator on the active task every single turn and refuses to dispatch work when it has lost the thread. Every piece of work has a one-page charter: the ask, every mid-session request I raise (folded in, queued, or dropped), and the test for "done". And a board carries unfinished work across sessions, so something raised on Tuesday gets picked up Wednesday instead of dying with the chat.
• Security work : Bounty mode confirms what's in scope before testing, reproduces the impact, and runs controls to rule out false positives before anything is called a finding. Semgrep and Slither run as plain CLIs. Research now runs across three provider families in parallel, then gets synthesized and source-checked.
• Review : A reviewer from a different model family, read-only: it can pass or block, it can't rewrite. It's mandatory when a change trips one of the risk triggers; otherwise the coordinator verifies and closes. A REJECT is a useful result, not a failed run.
• Gates :Deleting files, changing credentials, touching production, publishing, outreach: refused before a worker even starts, and deletion is refused again at merge unless an exact pre-approved file list allows it.
• It remembers : What a run learns is written to private Markdown outside the repo and read back before the next run. Notes carry where they came from; a newer note doesn't silently win.
• Honest limits : macOS only for now. You need tmux, fswatch, jq, Python 3.13, uv, and the vendor CLIs signed in. Workers run on your machine with your permissions; the write scope is enforced at merge, not while the worker runs, so treat it as an autonomy tool, not a sandbox.
Repo (MIT): https://github.com/mtarcure/claude-vibe-squad
A live board, seven specialists running in parallel: [https://github.com/mtarcure/claude-vibe-squad/raw/main/assets/demo/phase3-swarm.gif\](https://github.com/mtarcure/claude-vibe-squad/raw/main/assets/demo/phase3-swarm.gif)
Disclosure : I built this. It’s free. Open source, MIT, Python and Bash, Markdown all the way down. v2.0.0 went out today.
Happy to have holes poked in it. 🙂