A complete Claude Code toolkit for computer-system validation (CSV) and
life-sciences regulatory work. Covers GAMP 5 (2nd ed., including AI/ML),
21 CFR Part 11, EU GMP Annex 11, the live eCFR, and openFDA — and
ships a parallel sub-agent engine (/qualify:build, /qualify:requirements,
/qualify:review) that drafts a full IQ / OQ / PQ qualification pack for any
application in minutes.
Install in one command and you get 18 slash commands, 2 auto-invoked advisor
skills, 3 specialist sub-agents, and a document-protection hook. The qualification
engine writes its output to <your-app>/Qualification/ in Markdown, branded Word,
and Excel. All output is stamped DRAFT pending review by appropriately
qualified and authorized personnel — the generator is itself a GxP-impacting tool
that needs its own qualification before its output is relied upon.
Copyright © 2026 ParaQualis LLC. Released under the MIT License. See SECURITY.md for vulnerability reporting, and CHANGELOG.md for release history.
New here? Start with docs/OVERVIEW.md — the whole toolkit at a glance, with a live catalog of every command, skill, and sub-agent (auto-generated, so it never drifts). Then docs/how-to-qualify.md for the
/qualify:*engine.
/plugin marketplace add paraqualis/paraqualis-gxp
/plugin install paraqualis-gxp@paraqualis
The openFDA MCP server is bundled and needs Python ≥ 3.10 with pip install -r requirements.txt
(everything else works without it). See docs/minimum-configuration.md.
Commands are grouped into families. Each family is a folder under commands/;
the folder name becomes the command's namespace prefix (/family:command).
| Command | What it does |
|---|---|
/gamp:assess |
Categorize a system against GAMP 5 (2nd ed.) software categories and recommend proportionate validation rigor. |
/gamp:testplan |
Draft a risk-based GAMP 5 validation test plan (IQ/OQ/PQ), scaled to category and risk. |
/cfr21-11:auditprep |
Prepare for an FDA inspection against 21 CFR Part 11 — likely questions, evidence to assemble, weak points. |
/cfr21-11:gap |
Gap-assess a system/process against Part 11, with severity and remediation. |
/cfr21-11:checklist |
Generate a tailored Part 11 controls checklist for validation or audit. |
/eCFR:structure |
Show the structure (headings only, no content) two levels below any eCFR reference — any Title. |
/eCFR:text |
Fetch the full current regulatory text of a CFR section or part. |
/eCFR:search |
Full-text search the eCFR and return matching citations with excerpts. |
/eCFR:changes |
Show a part's amendment history — which sections changed and when. |
/eCFR:compare |
Compare a section/part between two dates and show exactly what wording changed. |
/eu-annex11:gap |
Gap-assess a system against EU GMP Annex 11, by clause, with severity and remediation. |
/eu-annex11:checklist |
Generate a tailored Annex 11 controls checklist for validation or inspection readiness. |
/eu-annex11:auditprep |
Prepare for an EU GMP inspection against Annex 11 — likely questions, evidence, weak points. |
/eu-annex11:crosswalk |
Map Annex 11 against 21 CFR Part 11 — alignment, divergence, and what satisfies both. |
/qualify:build |
Build a draft IQ/OQ/PQ qualification pack — discover the stack, schema(s), seed data, and approved requirements, then fan out to the xQ subagents in parallel. |
/qualify:requirements |
Author a draft User Requirements Specification (URS) when none exists — discharging the regulatory obligation to define requirements, structured so each one is testable and feeds PQ traceability. |
/qualify:review |
Review an existing pack — report what's complete, where gaps remain, detect drift against the current system, and plan closure of the gaps an AI can close. |
/openfda:setup |
Detect an openFDA API key; if missing, walk the user through getting a free one (instant) and saving it to a shell file of their choice. |
The eCFR: family pulls live from the public eCFR API
at runtime (no key required) and works for any CFR Title, not just 21. The
eu-annex11: family reflects the established Annex 11 (2011) and flags the July 2025
draft revision + Annex 22 (AI) as draft.
Tools (MCP server): mcp-servers/openfda/ exposes the FDA open data API to Claude as
callable tools (recalls, drug labels, adverse events). Opt-in — pip install mcp + a
one-line registration; see its README.
Skills live under skills/ and are auto-invoked by Claude when a request matches
their description — no slash command to type. Each is a folder with a SKILL.md
(name + description + instructions) and optional bundled reference files.
| Skill | What it does |
|---|---|
part11-advisor |
Always-available 21 CFR Part 11 expertise. Fires on any electronic-records/signatures, audit-trail, or Part 11 compliance question, and reasons against the verbatim Part 11 text bundled at reference/21-cfr-part-11.md. |
gamp-advisor |
Always-available GAMP 5 (2nd ed.) CSV expertise, including AI/ML & GenAI validation (per the ISPE GAMP Guide: Artificial Intelligence, July 2025, and EU draft Annex 22). Fires on software-category, validation-rigor, IQ/OQ/PQ-scope, or AI-system questions, reasoning against bundled framework references (original summaries — GAMP 5 and the ISPE AI Guide are ISPE-copyrighted, so their text is not reproduced). |
Subagents live under agents/ and are specialized sub-Claudes the main agent
delegates to, each in its own isolated context. That isolation lets several run
in parallel. /qualify:build (generate) and /qualify:review (verify) orchestrate these three concurrently:
| Subagent | Stage | Examines |
|---|---|---|
iq-qualifier |
Installation Qualification | the tech stack — runtimes, dependencies, infra, config |
oq-qualifier |
Operational Qualification | how it's built — functions, config logic, tests, pipeline |
pq-qualifier |
Performance Qualification | does it do its job — intended use, requirements ↔ behaviour |
They produce draft, traceable evidence (/qualify:build) or pre-check an existing
pack (/qualify:review); each command assembles the consolidated package. All output is
stamped draft pending review by appropriately qualified and authorized personnel — the generator itself is a GxP-impacting
tool that would require its own qualification before its output is relied upon.
Every item follows the xQ Qualification Protocol:
a Requirement paired with an executable test (a script/query that is itself a pack
artifact in scripts/), acceptance criteria, and an execution record — plus an ID
scheme, automated-vs-manual marking, a regulatory traceability matrix, and a three-layer
evidence model for AI/ML systems.
Hooks live under hooks/ and are scripts Claude Code runs automatically on an event
(before/after a tool, on a prompt, when it finishes). Unlike a command or skill, a hook is
deterministic — it always fires, with no model turn — which makes hooks the right place
for safety and governance controls.
| Hook | Event | What it does |
|---|---|---|
protect-approved-documents.py |
PreToolUse |
Blocks any edit to a file containing the marker <!-- PARAQUALIS-LOCK: approved -->. Approved records can't be overwritten in place; revise via a new version under change control. |
Register a hook in settings.json (see hooks/README.md for user vs.
project scope). The plugin bundles this hook automatically via hooks/hooks.json.
The whole toolkit is packaged as a Claude Code plugin — the manifest lives in
.claude-plugin/plugin.json and a single-plugin marketplace in
.claude-plugin/marketplace.json. The existing commands/, skills/, agents/, and
hooks/ folders are auto-discovered, so installing pulls in everything at once:
/plugin marketplace add paraqualis/paraqualis-gxp
/plugin install paraqualis-gxp@paraqualis
(The GitHub path requires the repo to be public; to test locally, point the first command
at the repo folder instead.) install.sh + symlinks remain the local dev workflow; the
plugin is the distribution path. The openFDA MCP server is bundled in the plugin
(plugin.json → mcpServers, so installing registers it); it requires Python ≥ 3.10 with
pip install -r requirements.txt (or pip install mcp). See its
README and docs/minimum-configuration.md.
The engine is three commands in the qualify: family — start at whichever fits:
/qualify:build <app>— generate the IQ/OQ/PQ pack. IQ and OQ never wait on a requirements doc; only PQ traces to one. The command searches for the spec and asks you to point to it (it can have any name, sit in a subfolder, or live outside the repo) before treating it as missing. If there genuinely is none, it still completes IQ, OQ, and partial PQ, raises a critical finding, and offers to author a draft URS inline./qualify:requirements <app>— author a draft URS when none exists (a regulatory obligation under GAMP 5 / EU Annex 11 cl.4). It first confirms one doesn't already exist — offering to supplement rather than duplicate — then writes to<app>/Qualification/requirements/URS.mdfor review and approval./qualify:review <app>— report what's complete, what's outstanding, and drift against the current system, then plan gap-closure (AI-closable vs. human/witnessed). If the pack or the requirements are missing it prompts you and — on your go-ahead — can kick off the other two commands to establish them first.
Hand-offs always happen on your go-ahead, never silently.
Full usage guide: docs/how-to-qualify.md (also available as a
Word document, authored by ParaQualis LLC) — how to qualify any application, what to tell
Claude, how to trigger the /qualify:* commands, what to expect, every output in the Qualification/
directory, and the gap-closure loop.
For one-command end-user install, see Plugin above. The from-source path below is the development workflow — edit a file and it's live immediately:
git clone git@github.com:paraqualis/paraqualis-gxp.git
cd paraqualis-gxp
./install.shinstall.sh symlinks each command family into ~/.claude/commands/ and each skill
into ~/.claude/skills/, so they stay live globally while this repo remains the
single source of truth. Edit anything here and the change is live everywhere
immediately — no copy step. The installer self-heals: stale links from renamed or
removed items are pruned automatically. Restart Claude Code after installing so
it re-scans the commands and skills folders.
.
├── commands/
│ ├── gamp/
│ │ ├── assess.md
│ │ └── testplan.md
│ ├── cfr21-11/
│ │ ├── auditprep.md
│ │ ├── gap.md
│ │ └── checklist.md
│ ├── eCFR/
│ │ ├── structure.md
│ │ ├── text.md
│ │ ├── search.md
│ │ ├── changes.md
│ │ └── compare.md
│ ├── eu-annex11/
│ │ ├── gap.md
│ │ ├── checklist.md
│ │ ├── auditprep.md
│ │ └── crosswalk.md
│ ├── openfda/
│ │ └── setup.md # get/configure a free openFDA API key
│ └── qualify/ # the qualification engine (split into three commands)
│ ├── build.md # generate: fans out to the xQ subagents in parallel
│ ├── requirements.md # author a draft URS when none exists
│ └── review.md # verify: status report + gap-closure plan
├── agents/ # subagents the main agent delegates to (run in parallel)
│ ├── iq-qualifier.md
│ ├── oq-qualifier.md
│ └── pq-qualifier.md
├── skills/
│ ├── part11-advisor/
│ │ ├── SKILL.md
│ │ └── reference/
│ │ └── 21-cfr-part-11.md # verbatim Part 11, bundled
│ └── gamp-advisor/
│ ├── SKILL.md
│ └── reference/
│ ├── gamp5-category-framework.md # original summary (not ISPE text)
│ └── ai-ml-validation.md # AI/ML validation themes
├── hooks/ # Claude Code event hooks (deterministic, no model turn)
│ ├── protect-approved-documents.py # PreToolUse: block edits to locked records
│ ├── hooks.json # wires the hook into the plugin (${CLAUDE_PLUGIN_ROOT})
│ └── README.md
├── .claude-plugin/ # makes the repo an installable plugin
│ ├── plugin.json # manifest
│ └── marketplace.json # single-plugin storefront
├── mcp-servers/openfda/ # openFDA MCP server (opt-in; needs `pip install mcp`)
├── docs/
│ └── xq-qualification-protocol.md # the test-case + pack abstraction for /qualify:*
├── install.sh # symlinks commands + skills + agents into ~/.claude/
├── LICENSE # MIT
└── README.md
- Every command file carries a ParaQualis LLC copyright header as a YAML comment inside the frontmatter, so it never leaks into the prompt sent to the model.
- Command bodies lead with the answer and produce decision-grade, auditable output (regulatory citations included), proportionate to risk.