Tools

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

One command extracts or summarizes web pages, PDFs, YouTube videos, podcasts and media files, with JSON output. Summaries can use many model APIs, local models or a logged-in Codex or Claude CLI; plain extraction needs no key. Also has a browser sidebar extension.

Lets coding agents control real Chrome with short Puppeteer scripts, with named pages that keep state across calls, accessibility-tree snapshots and screenshots for self-testing web changes. Install the dev-browser CLI globally first; macOS and glibc Linux only.

Lets agents build, run, test and debug iOS and macOS projects and control simulators and physical devices, with a CLI mode too. Formerly XcodeBuildMCP, now maintained by Sentry; macOS only, requires Xcode 16 or later.

Veteran suite of CSV command-line tools: in2csv converts Excel and JSON to CSV, csvcut, csvgrep and csvsort filter and sort, csvstat computes statistics, and csvsql runs SQL directly against CSV files.

Google's official skills for building ADK agents: dev workflow, scaffolding, the ADK Python API, evaluation with LLM judges and adaptive rubrics, deployment to Agent Runtime, Cloud Run or GKE, publishing and observability. Works with agents-cli; local dev needs only an AI Studio key.

250+ MCP tools for Ghidra: decompilation, cross-references, data-flow analysis, bulk renaming and commenting, P-code emulation and live debugging, with headless mode support. Requires Java 21 and Ghidra 12.1, and the plugin must be built and deployed first.

Veteran command-line task manager with projects, tags, priorities, due dates and custom reports, JSON export, and a rich ecosystem of hooks and extensions, well suited for agents that record and track tasks.

Community-maintained MCP for Jira and Confluence: search with JQL/CQL and create or update issues, pages and comments. Supports both Cloud and Server/Data Center deployments; needs an API token or personal access token.

The .NET team's official skill collection, grouped into plugins: ASP.NET Core, Blazor, MAUI, EF Core data access, MSBuild troubleshooting, performance diagnostics, testing, and framework upgrades and migrations. Maintained by Microsoft; install via the Claude Code or Codex plugin marketplace.

Full-featured Jira CLI: filter, create, transition, assign and link issues and manage epics and sprints, with --plain text output that agents can read. Works with Cloud and self-hosted Jira; set up an API token and run jira init.

Reference for Vitest 5: config, CLI, the test, describe and expect APIs, hooks, mocking with vi, snapshots, coverage, fixtures, concurrency, filtering and tags, reporters, benchmarks, test environments, type testing and multi-project setups. Generated by Anthony Fu from the official docs.

Semi-automated research assistant for CS and AI researchers that links ideation, Zotero literature management, experiment analysis and reporting, paper writing and reviewer responses, and keeps project knowledge in Obsidian. Branches for Codex and other agents exist.

Semi-automated research workflow for computer science and AI researchers: ideation, Zotero literature management, experiment analysis and reports, paper writing and polishing, and rebuttals, with optional Obsidian knowledge base. 40+ skills; also installable as a Claude Code plugin.

draw.io's official MCP: opens XML, CSV or Mermaid diagrams generated by the agent directly in the draw.io editor, good for flowcharts and architecture diagrams. A no-install remote version can also render diagrams inline in the chat.

Turns any codebase into an interactive browser course: real code with plain-language explanations, animations, hover glossaries and scenario quizzes. Built for people who build software with AI but can't read code, and useful for intro programming classes. Needs only an agent and the repo.

Community Playwright browser automation MCP from ExecuteAutomation (not Microsoft's official one): navigate, click, fill forms, screenshot and scrape page text, plus send HTTP requests, assert network responses and record actions into test code, with 143 device emulations built in.

Excalidraw's official MCP App: streams hand-drawn-style architecture diagrams and flowcharts into the conversation, with full-screen editing. Remote endpoint at https://mcp.excalidraw.com; requires a client that supports MCP Apps, such as Claude or ChatGPT.

macOS screen capture, accessibility-tree inspection and native UI automation, served over MCP so agents can see the screen and click, type and operate menus. Requires macOS 15+ with Screen Recording and Accessibility permissions granted.

macOS screenshot and UI automation CLI: capture the screen, read the accessibility tree for structured UI elements, then click, type, and switch windows and menus. Also runs as an MCP server for Claude Code and Codex. Needs macOS 15+ with Screen Recording and Accessibility permissions.

Detects shot changes in video and splits long footage into scenes, exporting cut lists and per-scene thumbnails, useful for shot analysis, organizing footage and finding edit points. Runs locally; needs Python 3.10+, plus FFmpeg or mkvmerge for splitting.

LM Studio's official CLI: list, load and unload local models, start and stop the local API server, and check status and logs; ls, ps and other commands support --json output for scripts and agents. Requires the LM Studio desktop app.

From Callstack: lets coding agents drive and verify iOS, Android, HarmonyOS and desktop apps through accessibility snapshots, with taps, form filling, screenshots, logs and performance sampling, plus a built-in MCP server. Requires Node.js 22.12+.

From Callstack: lets coding agents inspect, operate and verify apps on iOS, Android and HarmonyOS simulators and real devices, reading accessibility snapshots, taking screenshots and recordings, and capturing logs and performance data. Ships both a CLI and a built-in MCP server.