Tools

16 legal project management skills: turn emails and meeting notes into matter status reports and risk registers, manage scope changes, budgets, billing and outside counsel, and generate daily matter briefs. Optional Microsoft 365 access for mail and files. Oriented to US/UK firms; review all output.

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

Airtable's official plugin for Claude Code, Codex and Cursor: connects the official Airtable MCP and adds filtering, CLI, and product, marketing and sales ops skills, so agents can create tables, define fields, read and write records, and build shared views. Needs Airtable account authorization.

DeepL's official CLI: translate text and PDF, Word, PowerPoint and Excel documents while keeping formatting, with glossaries and translation memory. Needs a DeepL API key (free plan available); install from source with Node.js 24.15+. Have legal translations reviewed.

Netlify's official plugin with skills for Functions, Edge Functions, Blobs, databases, forms, caching, netlify.toml configuration and deploys, plus the hosted Netlify MCP (OAuth sign-in on first use).

Official MCP for Paddle, the merchant of record: manage products and prices, customers, subscriptions, transactions and refunds from chat, download invoice PDFs and generate financial reports. Needs a Paddle Billing account and API key; start in sandbox with read-only or non-destructive tools.

Phrase Strings' official CLI: phrase init walks you through config, then phrase push uploads language files and phrase pull fetches the latest translations; it also wraps the full API for projects, locales and keys. Needs a Phrase Strings account (paid, 14-day free trial) and an API token.

Supabase's official plugin: Supabase and Postgres best-practice skills plus the Supabase remote MCP to manage projects, run SQL, design schemas and RLS policies, and handle auth and storage. Needs a Supabase account.

Official CLI for Weblate, the open-source translation platform: check translation progress for projects and components, upload and download translation files, lock components, and commit or push repository changes. Hosted or self-hosted; needs the server URL, an API key and Python.

Amplitude's official plugin with a remote MCP and nearly 30 analysis skills: build charts and dashboards in plain language, interpret A/B experiments, summarize user feedback, and generate daily or weekly data briefs. Needs an Amplitude account with data (free plan exists); browser sign-in.

Provides twelve drop-in CSS transitions, including card resize, number pop-in, badges, dropdowns, modals, panel reveals, page slides, icon swaps, success checks and error shakes, configured through shared CSS custom properties with no framework dependency and reduced-motion guards.

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

Postman's official plugin: sets up the Postman MCP server so Claude Code can sync collections, run API tests and diagnose failures, generate client code, create mocks and docs, and run OWASP API security checks. Needs a Postman account.

Lets agents upload, download and list files in Tencent Cloud Object Storage (COS), and use Cloud Infinite for image processing, QR code recognition, document-to-PDF conversion, video frame capture and natural-language search. Maintained by Tencent Cloud; needs a SecretId and SecretKey.

Builds compact, polished landing pages for dev tools, package demos and micro-SaaS. Picks a design fingerprint (composition, palette, type, radius, surfaces, motion) so each run looks different, features a product-native demo, and keeps zero layout shift, focus states and reduced motion.

When the agent changes a single CSS value or Tailwind class in a Next.js App Router project, a floating bar appears on the page so you can fine-tune it with arrow keys before persisting. Loads a runtime script from budge.design in app/layout.tsx.

Reads a component-contracts contract JSON, derives component-scoped tokens and builds a fully variable-bound Figma component set with all variants. Requires cc-figma-tokens to have run first, plus the figma-use and figma-generate-library skills.

Syncs component-contracts token files in W3C DTCG format into native Figma variables, building Primitives and Semantic collections with role-based scopes and web code syntax after you approve a plan. Prerequisite for cc-figma-component.

Fixes hover and click dead zones between spaced interactive elements such as chart bars, list rows, tabs and nav items by making hit targets flush and moving visual spacing inside each item, with React and Tailwind examples.

Converts absolutely positioned Paper canvas nodes to flex layout through Paper MCP: computes spacing from computed styles, preserves SVGs and images via x-paper-clone, fixes z-order and shadows, and verifies with screenshot comparison.

Turns Paper designs (via Paper MCP, Viewfinder or exported JSX) into componentized React/Next.js code: maps hierarchy and reusable components first, one component per icon, tokens in globals.css, shadcn reuse, real fonts and data-driven charts.

Verifies and repairs a Paper-derived app against its local paper-sync render: ports the real fonts, reads exact type, color and decoration values from the canonical export, screenshot-diffs the running app against the frame and separates conversion drift from newer design.

Reduces CSS custom properties and Tailwind v4 design tokens in globals.css without changing visuals: maps usage to find live tokens, deletes dead ones, collapses values similar in light and dark modes via a scripted rename map, and verifies with typecheck, lint and build.