ツール

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

Netlify's official plugin with skills for Functions, Edge Functions, Blobs, databases, forms, caching, netlify.toml configuration and deploys, plus the hosted Netlify MCP (OAuth sign-in on first use).

Official MCP for Paddle, the merchant of record: manage products and prices, customers, subscriptions, transactions and refunds from chat, download invoice PDFs and generate financial reports. Needs a Paddle Billing account and API key; start in sandbox with read-only or non-destructive tools.

Official CLI for Weblate, the open-source translation platform: check translation progress for projects and components, upload and download translation files, lock components, and commit or push repository changes. Hosted or self-hosted; needs the server URL, an API key and Python.

Lets agents search Help Scout conversations, see a customer's or organization's full history and pull reports like CSAT; add a Docs API key to search the knowledge base. Write actions (draft replies, internal notes, tags) are off by default. Needs App ID and Secret from a Help Scout private app.

Supabase's official plugin: Supabase and Postgres best-practice skills plus the Supabase remote MCP to manage projects, run SQL, design schemas and RLS policies, and handle auth and storage. Needs a Supabase account.

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

Postman's official plugin: sets up the Postman MCP server so Claude Code can sync collections, run API tests and diagnose failures, generate client code, create mocks and docs, and run OWASP API security checks. Needs a Postman account.

Lets agents upload, download and list files in Tencent Cloud Object Storage (COS), and use Cloud Infinite for image processing, QR code recognition, document-to-PDF conversion, video frame capture and natural-language search. Maintained by Tencent Cloud; needs a SecretId and SecretKey.

Community-built MCP for the Genesys Cloud contact center: supervisors and QA staff can check queue volumes, sample conversations, and read call quality, sentiment, topics and transcripts. Needs an OAuth client in your Genesys Cloud org with per-tool permissions, and Node.js. Still in development.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

Browser Use's official plugin: connects the Browser Use MCP so Claude can drive your local Chrome or a cloud browser to browse, extract data, fill forms, test sites and take screenshots. Needs uv; cloud browsers need sign-in or an API key.

HubSpot's official skills for running the CRM via the hubspot CLI: look up customers and history, filter audiences, dedupe records, advance deals, build sales reports and route support tickets. Needs the HubSpot Agent CLI (beta) signed in; dry-run bulk edits first; some features need paid plans.

Teamwork.com's official MCP: query and update projects, tasks, milestones and time logs in plain language, and handle Desk support tickets and Spaces wiki pages, with role-based tool sets (e.g. project manager, support). Needs a Teamwork.com account with AI/MCP enabled by an admin.

HubSpot's official skill: agents use the HubSpot Agent CLI to create and triage tickets, move them through pipeline stages, queue by priority, bulk-update status and log resolutions. Needs the HubSpot Agent CLI (beta), signed in, plus the repo's bulk-operations skill. Edits live data; try a sandbox.

AWS's official plugin for startups: answers AWS Activate credit eligibility and 60+ startup perks, gives architecture and cost advice by funding stage, team size and runway, and plans migrations from GCP, Azure or Heroku. Perk lookups need no AWS account; migrations need your repo.

ModelScope's official MCP: search models, datasets, Studio apps, papers and MCP servers and view details, plus text-to-image and image-to-image generation. Needs a ModelScope API token.

Community MCP for Weblate, the open-source translation platform (self-hosted or hosted): translators can find untranslated or needs-editing strings in plain language, write translations in bulk, and check per-language progress and change history. Needs your Weblate API URL and token, and Node.js.

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

Chatwoot's official CLI: AI can search conversations, reply to customers, add private notes, assign, label, prioritize and resolve, and look up help center articles; a bundled skill sets safety rules for customer-visible replies. Needs a Chatwoot account (cloud or self-hosted) and API key.

Health-checks Linear projects for targets at risk of slipping, In Progress issues with no comment in over 7 days, orphan issues without milestones, and common anti-patterns. Reads and comments only, never mass-creates or restructures. Can run from a Cursor Automation. Needs the Linear MCP.

Bootstraps Linear tracking for a repo: checks for an existing project, anchors milestones to a North Star, backfills Done work only with evidence from the CHANGELOG, roadmap or git log, wires blockedBy links, and writes the protocol into CLAUDE.md, AGENTS.md or Cursor rules. Needs the Linear MCP.

Syncs, audits or rescues an existing Linear project against repo reality: enumerates issues, milestones, labels and docs, scores it on a 20-point rubric with a gap list, asks per category before any write, fixes orphans, milestones and dependencies, then re-scores. Needs the Linear MCP.