Tools

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

From TUM's Chair of Geoinformatics (a 3DCityDB co-developer): query CityGML 3D city models in 3DCityDB v5 in plain language, covering both spatial and semantic attributes, with read-only SQL. Needs a deployed 3DCityDB database and Python; register it from the folder with your .env config.

Grafana's official plugin marketplace with three plugins: the hosted Grafana Cloud MCP, the local mcp-grafana and Grafana Assistant, covering dashboards, data sources, Prometheus and Loki queries, alerting and incident management. Works with Claude Code and Codex.

Strips AI writing patterns from prose: filler openers, emphasis crutches, business jargon, formulaic contrasts, tricolons, em dashes and bold-first bullets, in favor of active voice and specifics. Scores reviews on five dimensions. Covers manuscripts, grants, blogs, newsletters and memos.

Preconfigures the Datadog MCP in Claude Code to query logs, metrics, traces, dashboards and monitors in plain language while troubleshooting production. Maintained by Datadog; needs a Datadog account (OAuth or API key). In preview.

OpenCage's official MCP: geocode addresses and place names, reverse geocode coordinates (with admin area, time zone and more), and check API quota. For small lookups; use its CLI for batches. Needs an OpenCage API key (free trial), Node.js 20+, and manual setup from a repo clone.

SNOMED International's official MCP: search and validate SNOMED CT terms, browse concept hierarchies and expand value sets in the International, US, UK, Australian and other editions. Hosted, no account. Unlicensed use is evaluation only, not for coding records. Clinicians should review.

Vaquill's official legal research MCP: search US federal and state codes, CFR, constitutions, court rules and the Federal Register, resolve Bluebook citations to statute text, plus Indian law. Needs a credit-based API key (non-commercial users can request free credits). A lawyer must review.

PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.

PagerDuty's official plugin: analyzes your current git diff against the service's past incidents and change events, gives a 0-5 risk score and suggestions before you commit, and can create PagerDuty SRE Agent skills (early access program required). Needs a PagerDuty API token.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

Sentry's official plugin: skills for SDK setup across platforms, production issue debugging, Sentry-aware code review and alert configuration, plus the hosted Sentry MCP to query errors and stack traces. Needs a Sentry account.

LogRocket's official plugin: when users report problems, agents pull up their session replays, network requests and errors and analyze the cause, so support doesn't have to keep asking for repro steps. Needs Claude Code and a site or app on paid LogRocket (14-day trial); sign in on first use.