ツール

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.

Skill pack from YC president Garry Tan: slash commands such as /office-hours, /plan-ceo-review, /review, /qa and /ship play CEO, engineering manager, designer, QA and release engineer. Needs Git and Bun; clone the repo and run ./setup as the README describes.

Collection of 2,400+ installable SKILL.md skills across development, security, cloud and ops, AI, marketing and more, with the AAS Core local MCP and an installer that help agents search, pick skills and preview install plans. Formerly antigravity-awesome-skills.

Drives Alibaba's open-source ocr CLI to review Git changes (working tree, a commit or a branch diff), grouping line-level comments by severity and fixing them on request. Needs an LLM endpoint (Anthropic, OpenAI and other protocols); installs the CLI if missing. By Alibaba.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.

Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.

Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.

Semantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.

Semgrep's official MCP server, now part of the main semgrep repo and started with semgrep mcp: lets agents run static security scans, find issues with custom rules and inspect syntax trees. Requires the Semgrep CLI; connecting to the AppSec platform needs SEMGREP_APP_TOKEN.

Google's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental).

OpenAI's official security CLI and TypeScript SDK: scans codebases to find, validate and fix security vulnerabilities, and can draft a SECURITY.md policy. Needs Node.js 22.13+, Python 3.10+, and a ChatGPT sign-in or API key.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.

Official SonarSource server: connects to SonarQube Server or Cloud so agents can query code issues, quality gates, security hotspots and dependency risks, and analyze file contents directly. Needs a SonarQube token; Docker is the recommended way to run it.

Lets agents run the CodeRabbit CLI to review local changes, listing bugs and security issues by severity, and fix unresolved CodeRabbit comments on a PR after you confirm each one. Maintained by CodeRabbit; needs the CLI installed and signed in. Free tier available.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).