ツール

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

Diffusion model inference in pure C/C++: one sd-cli command runs SD, FLUX, Qwen Image, Wan and more locally to create or edit images and short videos, with Metal acceleration on Mac. No cloud needed; bring your own model weights and use a release binary or build from source.

Scrapes web pages into Markdown or structured data, with full-site crawling, sitemaps, web search and interaction with dynamic pages. Maintained by Firecrawl; the cloud needs an API key (self-hosting is possible), and the keyless hosted endpoint only offers scrape, search and parse.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Build with OpenAI best practices inside Codex: call the OpenAI API, build and deploy agents with the Agents SDK, create ChatGPT apps and prepare submission materials, and create API keys directly. Maintained by OpenAI; Codex only.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

Creates, edits and validates reproducible Python and SQL Jupyter notebooks: organizes cells as reports or tutorials, checks conclusions against actual output and reruns top to bottom before handoff. Maintained by OpenAI in the Data Analytics plugin of openai/plugins.

OpenAI's official Codex plugin for equity investors: earnings previews and recaps, DCF, three-statement and comps valuation, model updates, long/short pitches, catalyst calendars, sizing and hedging, and investment memos. Works with FactSet and PitchBook (paid) or uploads and public sources.

Open-source LLM evaluation platform: one opencompass command picks the model and datasets and runs the evaluation across hundreds of benchmarks. Works with local Hugging Face models and API models, with vLLM and LMDeploy for faster inference.

Converts and two-way syncs Jupyter notebooks with plain Python scripts or Markdown, so agents can edit research and teaching notebooks like ordinary text and diffs stay readable. Needs a local Python environment; install with pip.

Cleans a LaTeX project before arXiv submission: removes comments, auxiliary files and unused .tex files and images, and can compress images, so internal notes are not published with the source. From Google Research; installable with Homebrew on macOS.

Python library and CLI for extracting main web content: fetches pages, crawls via sitemaps and RSS feeds, strips headers, footers and other noise, and outputs TXT, Markdown, JSON, XML and more with metadata. Also processes downloaded HTML offline.

Anthropic's official OS-level sandbox CLI: restricts file and network access for agents, MCP servers and any command without containers, using sandbox-exec on macOS and bubblewrap on Linux. Currently a research preview.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

Veteran suite of CSV command-line tools: in2csv converts Excel and JSON to CSV, csvcut, csvgrep and csvsort filter and sort, csvstat computes statistics, and csvsql runs SQL directly against CSV files.

Google's official skills for building ADK agents: dev workflow, scaffolding, the ADK Python API, evaluation with LLM judges and adaptive rubrics, deployment to Agent Runtime, Cloud Run or GKE, publishing and observability. Works with agents-cli; local dev needs only an AI Studio key.

Live stock and crypto quotes in the terminal with portfolio profit and loss tracking, using Yahoo Finance and Coinbase data. The main view is an interactive dashboard; ticker print exports holdings from your config at current prices as JSON or CSV for scripts and agents.

Language and toolset for double-entry bookkeeping in text files: bean-check validates the ledger, bean-format normalizes it, and Fava or beanquery handle reports and queries. Plain-text ledgers are easy for agents to generate and keep in version control.

Classic plain-text double-entry accounting CLI: entries live in a text file and it produces balance, register, budget and other reports directly, with no database or hidden state, so agents can easily read and write ledgers, reconcile and report.

250+ MCP tools for Ghidra: decompilation, cross-references, data-flow analysis, bulk renaming and commenting, P-code emulation and live debugging, with headless mode support. Requires Java 21 and Ghidra 12.1, and the plugin must be built and deployed first.

Semi-automated research assistant for CS and AI researchers that links ideation, Zotero literature management, experiment analysis and reporting, paper writing and reviewer responses, and keeps project knowledge in Obsidian. Branches for Codex and other agents exist.

Semi-automated research workflow for computer science and AI researchers: ideation, Zotero literature management, experiment analysis and reports, paper writing and polishing, and rebuttals, with optional Obsidian knowledge base. 40+ skills; also installable as a Claude Code plugin.

Self-hosted open-source bookkeeping app with a built-in MCP server: AI logs expenses in natural language and queries transactions, balances, categories, tags and exchange rates, keeping data on your server. Deploy via Docker or package, set enable_mcp, and create a token in security settings.

Official skill for the open-source, self-hosted ezBookkeeping app: lets agents log transactions and query records in natural language, and read accounts, categories, tags and exchange rates. Deploy ezBookkeeping first (Docker supported) and configure its URL and API token.