Tools

Audits animation code for the right timing function: springs for gestures and interruptible motion, easing for system-driven state changes, linear for progress, and no animation for high-frequency interactions. Also checks spring parameters and durations. Reports file:line findings.

HashiCorp's official MCP: lets agents manage Vault mounts, read and write KV secrets, enable PKI, create issuers and roles, and issue certificates. Needs a reachable Vault server and token; HashiCorp recommends using it only in trusted local environments.

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

DeepL's official CLI: translate text and PDF, Word, PowerPoint and Excel documents while keeping formatting, with glossaries and translation memory. Needs a DeepL API key (free plan available); install from source with Node.js 24.15+. Have legal translations reviewed.

Netlify's official plugin with skills for Functions, Edge Functions, Blobs, databases, forms, caching, netlify.toml configuration and deploys, plus the hosted Netlify MCP (OAuth sign-in on first use).

Phrase Strings' official CLI: phrase init walks you through config, then phrase push uploads language files and phrase pull fetches the latest translations; it also wraps the full API for projects, locales and keys. Needs a Phrase Strings account (paid, 14-day free trial) and an API token.

Official CLI for Weblate, the open-source translation platform: check translation progress for projects and components, upload and download translation files, lock components, and commit or push repository changes. Hosted or self-hosted; needs the server URL, an API key and Python.

Provides twelve drop-in CSS transitions, including card resize, number pop-in, badges, dropdowns, modals, panel reveals, page slides, icon swaps, success checks and error shakes, configured through shared CSS custom properties with no framework dependency and reduced-motion guards.

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

Lets agents upload, download and list files in Tencent Cloud Object Storage (COS), and use Cloud Infinite for image processing, QR code recognition, document-to-PDF conversion, video frame capture and natural-language search. Maintained by Tencent Cloud; needs a SecretId and SecretKey.

Builds compact, polished landing pages for dev tools, package demos and micro-SaaS. Picks a design fingerprint (composition, palette, type, radius, surfaces, motion) so each run looks different, features a product-native demo, and keeps zero layout shift, focus states and reduced motion.

When the agent changes a single CSS value or Tailwind class in a Next.js App Router project, a floating bar appears on the page so you can fine-tune it with arrow keys before persisting. Loads a runtime script from budge.design in app/layout.tsx.

Reads a component-contracts contract JSON, derives component-scoped tokens and builds a fully variable-bound Figma component set with all variants. Requires cc-figma-tokens to have run first, plus the figma-use and figma-generate-library skills.

Syncs component-contracts token files in W3C DTCG format into native Figma variables, building Primitives and Semantic collections with role-based scopes and web code syntax after you approve a plan. Prerequisite for cc-figma-component.

Fixes hover and click dead zones between spaced interactive elements such as chart bars, list rows, tabs and nav items by making hit targets flush and moving visual spacing inside each item, with React and Tailwind examples.

Converts absolutely positioned Paper canvas nodes to flex layout through Paper MCP: computes spacing from computed styles, preserves SVGs and images via x-paper-clone, fixes z-order and shadows, and verifies with screenshot comparison.

Turns Paper designs (via Paper MCP, Viewfinder or exported JSX) into componentized React/Next.js code: maps hierarchy and reusable components first, one component per icon, tokens in globals.css, shadcn reuse, real fonts and data-driven charts.

Verifies and repairs a Paper-derived app against its local paper-sync render: ports the real fonts, reads exact type, color and decoration values from the canonical export, screenshot-diffs the running app against the frame and separates conversion drift from newer design.

Reduces CSS custom properties and Tailwind v4 design tokens in globals.css without changing visuals: maps usage to find live tokens, deletes dead ones, collapses values similar in light and dark modes via a scripted rename map, and verifies with typecheck, lint and build.

Official CLI for Tolgee, the open-source localization platform: extract strings from code, push keys to Tolgee and pull the latest translations, and diff local files against the platform. Works with Tolgee Cloud or self-hosted; needs Node.js 18+ and a personal or project API key (tolgee login).

Browser Use's official plugin: connects the Browser Use MCP so Claude can drive your local Chrome or a cloud browser to browse, extract data, fill forms, test sites and take screenshots. Needs uv; cloud browsers need sign-in or an API key.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

Syncs design tokens between code and Figma variables: normalizes both sides, reports drift by value, alias, mode and scope in a dry run, then stops for explicit approval before writing, archives rather than deletes, and saves JSON reports. Requires the Figma MCP server; invoked manually.