Herramientas

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

Netlify's official plugin with skills for Functions, Edge Functions, Blobs, databases, forms, caching, netlify.toml configuration and deploys, plus the hosted Netlify MCP (OAuth sign-in on first use).

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

From IMG.LY: gives agents the CE.SDK design engine to create editable posters, flyers, social graphics and videos by chat, resize for each platform, import PSD, InDesign and PDF, and export print-ready PDFs with CMYK and bleed. Needs Node.js 22.15+ (WSL on Windows); the engine is free locally.

Pika's official plugin: 9 one-shot workflows (podcasts, explainer videos, UGC ads, brand books, founder product videos) that work from a URL or product image, backed by 58 image, video, music and editing tools. Needs a Pika account; credit-based, with free credits on sign-up.

Perso AI's official plugin: dub videos into other languages with lip sync, transcribe to SRT, translate and burn in subtitles, cut vertical clips. Subtitle and clip tools are free and local; dubbing, lip sync and transcription need a Perso account, billed per second. Needs Node.js 18+.

Lets agents upload, download and list files in Tencent Cloud Object Storage (COS), and use Cloud Infinite for image processing, QR code recognition, document-to-PDF conversion, video frame capture and natural-language search. Maintained by Tencent Cloud; needs a SecretId and SecretKey.

Meitu's official skills: one prompt gets agents posters, covers, sticker packs, ID photos and multi-angle e-commerce product shots, plus background removal, image restoration, image-to-video and music or voiceover for videos. Needs MeituHub AK/SK keys (free credits for new users) and meitu-cli.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

Builds product launch, promo and feature announcement videos with Remotion (React): asks nine questions about product, audience, duration, voiceover and channel, proposes 2-3 visual directions, writes a storyboard.json, then codes scenes and optional voiceover.

AWS's official plugin for startups: answers AWS Activate credit eligibility and 60+ startup perks, gives architecture and cost advice by funding stage, team size and runway, and plans migrations from GCP, Azure or Heroku. Perk lookups need no AWS account; migrations need your repo.

ModelScope's official MCP: search models, datasets, Studio apps, papers and MCP servers and view details, plus text-to-image and image-to-image generation. Needs a ModelScope API token.

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

Grafana's official plugin marketplace with three plugins: the hosted Grafana Cloud MCP, the local mcp-grafana and Grafana Assistant, covering dashboards, data sources, Prometheus and Loki queries, alerting and incident management. Works with Claude Code and Codex.

Spotify's official ads plugin: create campaigns, set audience targeting, manage creatives, pull delivery reports and diagnose delivery issues; new items and edits are saved as drafts by default. Needs a Spotify developer app with Ads API access, an ad account, and Python 3.8+ or uv.

Preconfigures the Datadog MCP in Claude Code to query logs, metrics, traces, dashboards and monitors in plain language while troubleshooting production. Maintained by Datadog; needs a Datadog account (OAuth or API key). In preview.

Cartesia's official voice MCP: turn text into natural speech, transcribe recordings, clone voices and localize a voice into other languages from chat, for course narration, audio content and voiceovers. Hosted; sign in with your Cartesia account in the browser. Free tier available.

Dropbox's official plugin (Claude, Codex and Cursor versions): search and browse Dropbox files, read and summarize documents, create shared links, send file requests to collect materials, and organize folders, confirming a list before deleting. Respects existing permissions; needs Dropbox sign-in.

Cloudinary's official MCP servers: upload, search and transform images and videos by chat, manage upload presets and structured metadata, and run AI content analysis, moderation and auto-tagging. Needs a Cloudinary account (some features paid); the command adds only the asset management server.

PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.

PagerDuty's official plugin: analyzes your current git diff against the service's past incidents and change events, gives a 0-5 risk score and suggestions before you commit, and can create PagerDuty SRE Agent skills (early access program required). Needs a PagerDuty API token.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

Sentry's official plugin: skills for SDK setup across platforms, production issue debugging, Sentry-aware code review and alert configuration, plus the hosted Sentry MCP to query errors and stack traces. Needs a Sentry account.