Tools

Drafts US-law contracts: the agent gathers terms for standard templates (NDA, SAFE, offer letter, cloud services agreement) and outputs a DOCX to review in Word, plus guides and checklists citing source law. Use the hosted URL, or run locally for sensitive matters. Drafts only; a lawyer must review.

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

Postman's official plugin: sets up the Postman MCP server so Claude Code can sync collections, run API tests and diagnose failures, generate client code, create mocks and docs, and run OWASP API security checks. Needs a Postman account.

Browser Use's official plugin: connects the Browser Use MCP so Claude can drive your local Chrome or a cloud browser to browse, extract data, fill forms, test sites and take screenshots. Needs uv; cloud browsers need sign-in or an API key.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

EduBase's official MCP: teachers and trainers can generate questions in bulk, build question banks and exams, schedule tests, manage classes and learners, and analyze results. Needs EduBase API credentials (App ID and secret, from Integrations; code MCPGITHUB unlocks it) and Node.js.

ModelScope's official MCP: search models, datasets, Studio apps, papers and MCP servers and view details, plus text-to-image and image-to-image generation. Needs a ModelScope API token.

Apideck's official MCP: one unified API to read and write invoices, ledgers and reports in QuickBooks, Xero, NetSuite and other accounting systems, plus HR, CRM and ATS data. Needs a paid Apideck account (30-day trial), API key and App ID, with your systems connected. An accountant should review.

Himalayas' official MCP: employers post remote jobs free (with screening questions), search open-to-work candidates and check salary benchmarks by role and country; job seekers search jobs and manage their profile and application board. Searching needs no account; managing needs a browser login.

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

Carta's official equity plugin: ask about cap tables, option grants and vesting, SAFE conversions, 409A valuation history and liquidation waterfall scenarios, plus compensation benchmarks and drafting share issuances. Needs a Carta account (OAuth); collects usage telemetry. Have results reviewed.

PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

LogRocket's official plugin: when users report problems, agents pull up their session replays, network requests and errors and analyze the cause, so support doesn't have to keep asking for repro steps. Needs Claude Code and a site or app on paid LogRocket (14-day trial); sign in on first use.

Intuit's official QuickBooks plugin: health checks on profit, cash flow, balance sheet and receivables, peer benchmarking and payroll cost analysis, and drafts payment reminders, estimates and invoices, confirming before writes. Needs QuickBooks Online (official connector); have finance review.

Official plugin for Windmill performance management: write feedback and kudos for colleagues, manage 1:1 agendas and private notes about teammates, create and schedule pulse surveys, and summarize team updates. Needs a Windmill account (free up to 10 users); browser sign-in.

100Hires' official hosted ATS MCP: HR can manage candidates, job postings, pipeline stages, interview scheduling, email templates and scorecards from chat, covering its full API. Sign in via browser OAuth, nothing to install. Needs a paid 100Hires account (14-day free trial).

StackOne's official plugin connects its hosted MCP so agents can search and act across hundreds of connected business systems, from HR platforms like Workday and SAP to CRMs and Jira, for example looking up leave requests. Needs a StackOne account (free plan available) with your systems connected.

Wingspan's official plugin: ask about your contractor roster, who is missing W-9s or other compliance docs, what is due this month and why a payment is stuck; also invite contractors and log draft bills. Writes are previewed and it never sends money. Needs a Wingspan payer account; US-focused.