ParaQualis Skills — life-sciences regulatory & CSV toolkit for Claude Code

A complete Claude Code toolkit for computer-system validation (CSV) and life-sciences regulatory work. Covers GAMP 5 (2nd ed., including AI/ML), 21 CFR Part 11, EU GMP Annex 11, the live eCFR, and openFDA — and ships a parallel sub-agent engine (/qualify:build, /qualify:requirements, /qualify:review) that drafts a full IQ / OQ / PQ qualification pack for any application in minutes.

Install in one command and you get 18 slash commands, 2 auto-invoked advisor skills, 3 specialist sub-agents, and a document-protection hook. The qualification engine writes its output to <your-app>/Qualification/ in Markdown, branded Word, and Excel. All output is stamped DRAFT pending review by appropriately qualified and authorized personnel — the generator is itself a GxP-impacting tool that needs its own qualification before its output is relied upon.

Copyright © 2026 ParaQualis LLC. Released under the MIT License. See SECURITY.md for vulnerability reporting, and CHANGELOG.md for release history.

New here? Start with docs/OVERVIEW.md — the whole toolkit at a glance, with a live catalog of every command, skill, and sub-agent (auto-generated, so it never drifts). Then docs/how-to-qualify.md for the /qualify:* engine.

Say hello

We're a small team, and the plugin has no telemetry — so the only way we know who uses it is if you tell us. If you're using ParaQualis GxP, we'd love to hear who you are and what you're validating: hello@paraqualis.com, or introduce yourself in Discussions. Feature requests, gaps, and "this didn't work for our QMS" are all welcome.

Install

/plugin marketplace add paraqualis/paraqualis-gxp
/plugin install paraqualis-gxp@paraqualis

The openFDA MCP server is bundled and needs Python ≥ 3.10 with pip install -r requirements.txt (everything else works without it). See docs/minimum-configuration.md.

What's here

Commands are grouped into families. Each family is a folder under commands/; the folder name becomes the command's namespace prefix (/family:command).

| Command | What it does | |---|---| | /gamp:assess | Categorize a system against GAMP 5 (2nd ed.) software categories and recommend proportionate validation rigor. | | /gamp:testplan | Draft a risk-based GAMP 5 validation test plan (IQ/OQ/PQ), scaled to category and risk. | | /cfr21-11:auditprep | Prepare for an FDA inspection against 21 CFR Part 11 — likely questions, evidence to assemble, weak points. | | /cfr21-11:gap | Gap-assess a system/process against Part 11, with severity and remediation. | | /cfr21-11:checklist | Generate a tailored Part 11 controls checklist for validation or audit. | | /eCFR:structure | Show the structure (headings only, no content) two levels below any eCFR reference — any Title. | | /eCFR:text | Fetch the full current regulatory text of a CFR section or part. | | /eCFR:search | Full-text search the eCFR and return matching citations with excerpts. | | /eCFR:changes | Show a part's amendment history — which sections changed and when. | | /eCFR:compare | Compare a section/part between two dates and show exactly what wording changed. | | /eu-annex11:gap | Gap-assess a system against EU GMP Annex 11, by clause, with severity and remediation. | | /eu-annex11:checklist | Generate a tailored Annex 11 controls checklist for validation or inspection readiness. | | /eu-annex11:auditprep | Prepare for an EU GMP inspection against Annex 11 — likely questions, evidence, weak points. | | /eu-annex11:crosswalk | Map Annex 11 against 21 CFR Part 11 — alignment, divergence, and what satisfies both. | | /qualify:build | Build a draft IQ/OQ/PQ qualification pack — discover the stack, schema(s), seed data, and approved requirements, then fan out to the xQ subagents in parallel. | | /qualify:requirements | Author a draft User Requirements Specification (URS) when none exists — discharging the regulatory obligation to define requirements, structured so each one is testable and feeds PQ traceability. | | /qualify:review | Review an existing pack — report what's complete, where gaps remain, detect drift against the current system, and plan closure of the gaps an AI can close. | | /openfda:setup | Detect an openFDA API key; if missing, walk the user through getting a free one (instant) and saving it to a shell file of their choice. |

The eCFR: family pulls live from the public eCFR API at runtime (no key required) and works for any CFR Title, not just 21. The eu-annex11: family reflects the established Annex 11 (2011) and flags the July 2025 draft revision + Annex 22 (AI) as draft.

Tools (MCP server): mcp-servers/openfda/ exposes the FDA open data API to Claude as callable tools (recalls, drug labels, adverse events). Opt-in — pip install mcp + a one-line registration; see its README.

Skills

Skills live under skills/ and are auto-invoked by Claude when a request matches their description — no slash command to type. Each is a folder with a SKILL.md (name + description + instructions) and optional bundled reference files.

| Skill | What it does | |---|---| | part11-advisor | Always-available 21 CFR Part 11 expertise. Fires on any electronic-records/signatures, audit-trail, or Part 11 compliance question, and reasons against the verbatim Part 11 text bundled at reference/21-cfr-part-11.md. | | gamp-advisor | Always-available GAMP 5 (2nd ed.) CSV expertise, including AI/ML & GenAI validation (per the ISPE GAMP Guide: Artificial Intelligence, July 2025, and EU draft Annex 22). Fires on software-category, validation-rigor, IQ/OQ/PQ-scope, or AI-system questions, reasoning against bundled framework references (original summaries — GAMP 5 and the ISPE AI Guide are ISPE-copyrighted, so their text is not reproduced). |

Subagents

Subagents live under agents/ and are specialized sub-Claudes the main agent delegates to, each in its own isolated context. That isolation lets several run in parallel. /qualify:build (generate) and /qualify:review (verify) orchestrate these three concurrently:

| Subagent | Stage | Examines | |---|---|---| | iq-qualifier | Installation Qualification | the tech stack — runtimes, dependencies, infra, config | | oq-qualifier | Operational Qualification | how it's built — functions, config logic, tests, pipeline | | pq-qualifier | Performance Qualification | does it do its job — intended use, requirements ↔ behaviour |

They produce draft, traceable evidence (/qualify:build) or pre-check an existing pack (/qualify:review); each command assembles the consolidated package. All output is stamped draft pending review by appropriately qualified and authorized personnel — the generator itself is a GxP-impacting tool that would require its own qualification before its output is relied upon.

Every item follows the xQ Qualification Protocol: a Requirement paired with an executable test (a script/query that is itself a pack artifact in scripts/), acceptance criteria, and an execution record — plus an ID scheme, automated-vs-manual marking, a regulatory traceability matrix, and a three-layer evidence model for AI/ML systems.

Hooks

Hooks live under hooks/ and are scripts Claude Code runs automatically on an event (before/after a tool, on a prompt, when it finishes). Unlike a command or skill, a hook is deterministic — it always fires, with no model turn — which makes hooks the right place for safety and governance controls.

| Hook | Event | What it does | |---|---|---| | protect-approved-documents.py | PreToolUse | Blocks any edit to a file containing the marker <!-- PARAQUALIS-LOCK: approved -->. Approved records can't be overwritten in place; revise via a new version under change control. | | welcome-once.py | SessionStart | Shows a one-line "say hello" note the first time the plugin runs, then never again. Local marker file only; no network. |

Register a hook in settings.json (see hooks/README.md for user vs. project scope). The plugin bundles this hook automatically via hooks/hooks.json.

Plugin (one-command install)

The whole toolkit is packaged as a Claude Code plugin — the manifest lives in .claude-plugin/plugin.json and a single-plugin marketplace in .claude-plugin/marketplace.json. The existing commands/, skills/, agents/, and hooks/ folders are auto-discovered, so installing pulls in everything at once:

/plugin marketplace add paraqualis/paraqualis-gxp
/plugin install paraqualis-gxp@paraqualis

(The GitHub path requires the repo to be public; to test locally, point the first command at the repo folder instead.) install.sh + symlinks remain the local dev workflow; the plugin is the distribution path. The openFDA MCP server is bundled in the plugin (plugin.json → mcpServers, so installing registers it); it requires Python ≥ 3.10 with pip install -r requirements.txt (or pip install mcp). See its README and docs/minimum-configuration.md.

Using the qualification engine

The engine is three commands in the qualify: family — start at whichever fits:

• /qualify:build <app> — generate the IQ/OQ/PQ pack. IQ and OQ never wait on a requirements doc; only PQ traces to one. The command searches for the spec and asks you to point to it (it can have any name, sit in a subfolder, or live outside the repo) before treating it as missing. If there genuinely is none, it still completes IQ, OQ, and partial PQ, raises a critical finding, and offers to author a draft URS inline.
• /qualify:requirements <app> — author a draft URS when none exists (a regulatory obligation under GAMP 5 / EU Annex 11 cl.4). It first confirms one doesn't already exist — offering to supplement rather than duplicate — then writes to <app>/Qualification/requirements/URS.md for review and approval.
• /qualify:review <app> — report what's complete, what's outstanding, and drift against the current system, then plan gap-closure (AI-closable vs. human/witnessed). If the pack or the requirements are missing it prompts you and — on your go-ahead — can kick off the other two commands to establish them first.

Hand-offs always happen on your go-ahead, never silently.

Full usage guide: docs/how-to-qualify.md (also available as a Word document, authored by ParaQualis LLC) — how to qualify any application, what to tell Claude, how to trigger the /qualify:* commands, what to expect, every output in the Qualification/ directory, and the gap-closure loop.

Install from source (dev workflow)

For one-command end-user install, see Plugin above. The from-source path below is the development workflow — edit a file and it's live immediately:

git clone git@github.com:paraqualis/paraqualis-gxp.git
cd paraqualis-gxp
./install.sh

install.sh symlinks each command family into ~/.claude/commands/ and each skill into ~/.claude/skills/, so they stay live globally while this repo remains the single source of truth. Edit anything here and the change is live everywhere immediately — no copy step. The installer self-heals: stale links from renamed or removed items are pruned automatically. Restart Claude Code after installing so it re-scans the commands and skills folders.

Repo layout

.
├── commands/
│   ├── gamp/