How do their APIs compare?

Based on what I can actually retrieve, these two repos aren't really comparable at the level of a traditional REST/HTTP "API" — they're both Claude Code plugin/agent-harness ecosystems, not backend services with request/response endpoints. Here's the honest breakdown:

affaan-m/ecc

• Its "API surface" is primarily a Python LLM abstraction layer, not a web API. Under src/llm/, there's a provider-adapter pattern: adapt_messages_for_provider(messages, provider, tools) dispatches to a per-provider builder via get_provider_builder(provider) and calls .build(messages, tools) [src/llm/prompt/builder.py:L119-L126]. Individual providers like astraflow.py and atlas.py each implement a private helper _parse_tool_arguments(raw_arguments) that safely parses tool-call JSON arguments, falling back to {"raw": ...} or {"value": ...} on non-dict results [src/llm/providers/atlas.py:L26-L39, src/llm/providers/astraflow.py:L25-L38] — these two are near-identical implementations across providers, suggesting a shared internal contract each provider adapter must satisfy.
• It also exposes a CLI entry point rather than a network API: src/llm/__main__.py just calls llm.cli.selector.main() [src/llm/main.py:L1-L8].
• Its distribution "API" (in the sense of public identifiers) is explicitly documented in the README: GitHub repo affaan-m/ECC, npm package ecc-universal, and marketplace/plugin identifier ecc@ecc — intentionally three different names for validator/namespace reasons [README.md:L351-L360]. SECURITY.md further warns that packages like @chil_ntl/ecc-cli or anything named everything-claude-code/opencode-ecc are not official ECC surfaces unless explicitly documented [SECURITY.md:L52-L75].

affaan-m/everything-claude-code

• It has no code-level API at all in what's retrieved — it's a Claude Code plugin bundle, not a library or service. Its "interface" is a set of slash commands and an agent directory: .claude-plugin/plugin.json and marketplace.json define plugin metadata and a self-hosted marketplace catalog, and agents/ contains 36 markdown-defined subagents (e.g. planner.md, architect.md, tdd-guide.md, code-reviewer.md, etc.) for task delegation [README.zh-CN.md:L232-L271].
• Its "public API" for users is slash commands like /tdd, /plan, /e2e, /code-review, /build-fix, /learn, /skill-create [CLAUDE.md:L43-L52], plus generic categories of deployment/testing/code-gen commands per CONTRIBUTING.md [CONTRIBUTING.md:L43-L50].
• It reuses the same npm packages as ECC (ecc-universal, ecc-agentshield) in its README badges, implying it's a downstream/companion distribution rather than a separately packaged API [README.zh-CN.md:L1-L18].

Bottom line: affaan-m/ecc has an actual code-level API (Python provider-adapter functions for LLM message/tool handling, plus a CLI), while affaan-m/everything-claude-code's "API" is really a declarative plugin manifest + slash-command surface with no comparable programmatic functions retrieved. SECURITY.md in ECC explicitly flags everything-claude-code-style names as something to NOT assume is an official ECC-maintained package [SECURITY.md:L52-L75], which is worth noting if you're trying to determine trust/provenance between the two.

FOLLOW_UPS:

• What does the provider-adapter pattern look like in ecc?
• How do the 36 subagents in everything-claude-code get invoked?
• What does ECC's SECURITY.md say about unofficial packages?