Advanced ARG (Alternate Reality Game) investigation toolkit for Claude Code. Features 6 specialized opus-powered agents that work autonomously in a flat architecture - each agent investigates directly, cracks puzzles through original analysis, and recommends next steps for Claude Code to orchestrate.

"BE RELENTLESS. BE THOROUGH. CRACK THE ARG."

This toolkit prioritizes direct investigation over community search. The agents probe, analyze, decode, and follow puzzle chains themselves - only referencing community findings after exhausting original investigation.

┌─────────────────────────────────────────────────────────────────┐
│                    FLAT AGENT ARCHITECTURE                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  User Request                                                    │
│       │                                                          │
│       ▼                                                          │
│  ┌─────────┐                                                     │
│  │ Claude  │  Decides which specialist to spawn based on input   │
│  │  Code   │                                                     │
│  └────┬────┘                                                     │
│       │                                                          │
│       ▼ Spawns ONE agent at a time                               │
│  ┌─────────────────────────────────────────────────────────┐     │
│  │  SELF-SUFFICIENT AGENTS (work independently)            │     │
│  │                                                         │     │
│  │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐   │     │
│  │  │  stego   │ │  crypto  │ │  osint   │ │  media   │   │     │
│  │  │ analyst  │ │ decoder  │ │  recon   │ │ forensic │   │     │
│  │  └──────────┘ └──────────┘ └──────────┘ └──────────┘   │     │
│  │  ┌──────────┐ ┌──────────┐                             │     │
│  │  │   web    │ │   arg    │ ← Guide + Direct Investigator│     │
│  │  │ analyst  │ │orchestr. │                             │     │
│  │  └──────────┘ └──────────┘                             │     │
│  └─────────────────────────────────────────────────────────┘     │
│       │                                                          │
│       ▼ Returns structured findings                              │
│  ┌─────────┐                                                     │
│  │ Claude  │  Reads report, decides next agent to spawn          │
│  │  Code   │                                                     │
│  └────┬────┘                                                     │
│       │                                                          │
│       ▼ Spawns next recommended agent...                         │
│                                                                  │
│  📁 ~/Downloads/${ARG_NAME}_ARG_Investigation/                   │
│       └── All findings saved to ARG-specific folder              │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

Key Architecture Features:

• No hierarchical orchestration - Claude Code spawns agents directly
• Self-sufficient agents - Each creates its own investigation folder if needed
• Structured output - Agents return findings with 🚀 RECOMMENDED NEXT AGENTS
• ARG-specific folders - Each investigation gets its own folder named after the ARG

# Clone the repo
git clone https://github.com/CMLKevin/ClaudeCode_ARGBuster.git

# Start Claude Code with the plugin loaded
claude --plugin-dir ./ClaudeCode_ARGBuster

# Copy to Claude Code plugins directory
cp -r ClaudeCode_ARGBuster ~/.claude/plugins/local/arg-investigation

# Start Claude Code with the plugin
claude --plugin-dir ~/.claude/plugins/local/arg-investigation

Add to your ~/.zshrc or ~/.bashrc:

alias claude-arg='claude --plugin-dir ~/.claude/plugins/local/arg-investigation'

Then use claude-arg to start Claude Code with ARG capabilities.

# After starting Claude with the plugin loaded:
/arg https://mysterious-arg-site.com    # Full investigation
/decode SGVsbG8gV29ybGQ=                 # Quick decode
/stego:spectrogram ~/audio.mp3          # Audio spectrogram

Claude Code spawns the appropriate agent based on what you have:

What It Does:

• Provides investigation methodology and checklists
• Direct browser automation for site investigation
• Agent selection guidance for Claude Code
• Reference for common ARG patterns and hiding techniques

When to Use:

• When you need guidance on HOW to investigate
• When you want direct browser-based investigation
• When unsure which specialist to use

Capabilities:

• Image: LSB extraction (all channels), color channel separation, bit plane analysis
• Audio: Spectrogram generation (multiple ranges), phase analysis, reversed audio
• Tools: exiftool, binwalk, sox, convert, zbarimg, tesseract

Recommends Next: crypto-decoder (encoded data), media-forensics (embedded files)

5-Tier Encoding Detection Matrix:

Advanced Cryptanalysis:

• Index of Coincidence (IC) analysis for cipher identification
• Kasiski Examination for Vigenère key length detection
• Automated Vigenère cracker with chi-squared frequency analysis
• Rail Fence brute-forcer (2-10 rails)
• Substitution cipher frequency analysis
• Multi-layer decode chain tracking
• ARG keyword dictionary attack

Recommends Next: web-analyst (decoded URLs), stego-analyst (decoded reveals image clues)

Research Capabilities:

• WHOIS (including historical changes)
• DNS records (A, MX, TXT, NS, CNAME, SPF, DMARC)
• SSL certificates via crt.sh (find subdomains)
• Wayback Machine deep dive
• Username/email cross-platform search
• Reverse WHOIS (other domains by same registrant)

Community Cross-Reference: Checks GameDetectives, Reddit ARG communities, ARGNet after own investigation

Recommends Next: web-analyst (discovered subdomains), crypto-decoder (encoded TXT records)

Capabilities:

• Magic bytes validation (detect disguised files)
• Embedded file extraction (binwalk, foremost)
• Comprehensive metadata analysis (exiftool)
• QR code detection (zbarimg)
• OCR text extraction (tesseract)
• Hash verification
• Polyglot file detection

Recommends Next: crypto-decoder (extracted text), stego-analyst (extracted images)

Mandatory Investigation Protocol:

1. Extract ALL hidden elements (7 detection methods)
2. Probe 50+ common ARG paths
3. Analyze raw source (Base64, hex, comments, data-* attributes)
4. Execute and analyze JavaScript
5. Check console messages for hidden clues
6. Recursive investigation of discovered URLs

Browser Automation (claude-in-chrome MCP):

• read_page - Accessibility tree examination
• javascript_tool - Inspect localStorage, sessionStorage, variables
• read_console_messages - Hidden console.log clues
• navigate - Follow discovered links
• computer (screenshot) - Visual analysis

Recommends Next: crypto-decoder (encoded content), osint-recon (new domains), stego-analyst (images)

Each ARG investigation gets its own folder:

~/Downloads/${ARG_NAME}_ARG_Investigation/
├── clues/          # KEY FINDINGS - discovered secrets, decoded messages
├── reports/        # Auto-generated investigation reports
├── spectrograms/   # Audio spectrograms
├── extracted/      # Downloaded & extracted files
└── logs/           # Raw analysis logs

Examples:

• ~/Downloads/cicada_ARG_Investigation/
• ~/Downloads/deltarune_ARG_Investigation/
• ~/Downloads/mysterious_ARG_Investigation/

All agents document findings in real-time:

Each agent ends its analysis with structured output:

## 🔍 ANALYSIS COMPLETE

### Findings Summary
- [Key discoveries]

### Files Created
- $ARG_DIR/clues/[findings].txt

### 🚀 RECOMMENDED NEXT AGENTS
1. **crypto-decoder** - [WHY: Found Base64 in hidden element]
2. **osint-recon** - [WHY: Discovered new subdomain]

### Investigation Leads
- [URLs to follow]
- [Patterns to investigate]

Claude Code reads these recommendations and decides which agent to spawn next.

# macOS
brew install exiftool binwalk sox ffmpeg zbar tesseract imagemagick foremost

# Python
pip3 install pillow

Add these permissions to ~/.claude/settings.json for unrestricted web fetching:

{
  "permissions": {
    "allow": [
      "Bash(curl:*)",
      "Bash(wget:*)"
    ]
  }
}

Note: The built-in WebFetch tool has domain verification that may fail on some networks. Using curl via Bash bypasses this limitation and provides more control over headers, cookies, and redirects.

# 1. Start with a mysterious website
User: "Investigate https://mysterious-arg.com"

# 2. Claude Code spawns web-analyst
CC → web-analyst → Finds hidden Base64 in data-secret attribute
                 → Recommends: crypto-decoder

# 3. Claude Code spawns crypto-decoder
CC → crypto-decoder → Decodes to URL: puzzle.mysterious-arg.com
                    → Recommends: osint-recon, web-analyst

# 4. Claude Code spawns osint-recon
CC → osint-recon → Finds 5 subdomains via crt.sh
                 → Recommends: web-analyst for each

# 5. Investigation continues until puzzle is solved

After completing their own investigation, agents cross-reference with:

• Reddit: r/ARG, r/gamedetectives, r/codes, r/cicada
• Game Detectives Wiki: wiki.gamedetectives.net
• ARGNet: argn.com
• Unfiction: forums.unfiction.com

This identifies novel discoveries the community may have missed.

Author: Kevin Lin Version: 1.2.0

"The truth is out there... hidden in LSBs, spectrograms, and Base64."