Tools

Official Cloudflare Tunnel client: exposes local services to the internet without opening firewall ports and can proxy TCP access like SSH and RDP. Named tunnels need a Cloudflare account and domain; quick tunnels work without signing in.

Lightweight command-line processor with jq-like syntax for reading, modifying and converting YAML, JSON, XML, INI, CSV and more, including in-place config edits. A single dependency-free Go binary.

Lets agents call thousands of ready-made scrapers and automation Actors from Apify Store to pull data from social media, search engines, maps, e-commerce sites and more. Maintained by Apify; needs an Apify account (OAuth) or API token.

Version datasets and models the way Git versions code: data lives in remote storage like S3 or GCS while versions are tracked in your Git repo. Also offers reproducible pipelines and local experiment tracking, rerunning only the steps affected by a change.

Multi-language git hook manager: declare formatting, lint, secret scanning and other hooks in .pre-commit-config.yaml to run automatically before each commit, or have the agent self-check with pre-commit run --all-files before committing.

Bundles a whole web page with its CSS, images, fonts and scripts into a single HTML file that opens offline exactly as it looked, good for archiving pages or handing them to an agent for offline analysis. It does not run JavaScript, so pre-render dynamic pages with a headless browser.

Loads and unloads environment variables per directory: reads .envrc (and optionally .env) when you enter a project and restores the environment when you leave, so configs and secrets do not leak between projects. Hook it into bash, zsh, fish or another shell first.

Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first.

Command-line framework for warehouse modeling and ELT transformations: write models in SQL and let dbt handle dependencies, data tests and documentation. v2 is rewritten in Rust as a single binary. Maintained by dbt Labs; needs a data warehouse connection.

Classic network discovery and security auditing tool: host discovery, port scanning, service version and OS detection, plus vulnerability checks with NSE scripts. Only scan networks you are authorized to test.

MiniMax's official Excel skill: read, analyze, create, edit and validate xlsx files and fix broken formulas. Edits existing files at the XML level to keep formatting, formulas and pivot tables; writes results as formulas with finance-style color coding. Needs Python (pandas); LibreOffice optional.

PostgreSQL command-line client with smart autocompletion and syntax highlighting. Compatible with psql environment variables, and -c runs a statement and exits, so agents can query databases non-interactively.

Scans container images, filesystem directories and SBOMs for known vulnerabilities across major Linux distro packages and many language ecosystems, ranks risk by EPSS and KEV, and filters results with OpenVEX. Good for vulnerability gates in CI. Maintained by Anchore.

curl for gRPC: call any gRPC method with JSON, including bidirectional streaming, browse service definitions via server reflection, proto source files or protosets, with TLS and mutual TLS support.

Simon Willison's LLM CLI and Python library: call OpenAI, Claude, Gemini and local models from the terminal, with conversations logged to SQLite automatically, plus embeddings, structured extraction, tool calling and a plugin system.

A du replacement written in Rust that shows disk usage as a directory tree with proportion bars, making large files and folders easy to spot. Filter by depth, count or regex, and output JSON with -j for agents to parse.

Estimates cloud costs of Terraform, Terragrunt, CloudFormation and AWS CDK changes before deployment and checks them against FinOps policies, in the terminal, editor, AI agents or CI. Requires an Infracost account; a free tier is available.

Bundles 60+ full-stack specialist skills into one plugin: experts for 12 languages including Python, TypeScript, Go, Rust and Java, and frameworks like React, Django and Spring Boot, activated automatically by request. Also includes Jira and Confluence workflow commands (needs Atlassian MCP).

MySQL terminal client with smart autocompletion and syntax highlighting, also compatible with MariaDB and TiDB. Supports --execute and batch mode with CSV or table output, so agents can run SQL directly.

Scans files and directories for personal data such as names, emails and credit card numbers using Presidio Analyzer, with configurable entity types, confidence thresholds and ignore rules. Needs Python 3.10+ and a spaCy language model.

Publishes SQLite databases as browsable, queryable web pages and JSON APIs, with SQL queries, metadata and plugins, and deploys to Cloud Run and other platforms with datasette publish. Great for data exploration and data journalism. Needs Python 3.10+.

Google's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental).

GitHub's official terminal coding agent, sharing its harness with the Copilot coding agent and shipping with the GitHub MCP built in. Work with repos, issues and PRs in natural language, approving each action before it runs. Requires a Copilot subscription.

Lets agents work with the Hugging Face Hub through the hf CLI: search and download models and datasets, manage repos and Spaces, and run training and evaluation jobs on cloud GPUs, with more workflow skills installable as needed. Maintained by Hugging Face.