도구

Lets agents query AWS bills, cost trends, budgets and spending anomalies, and recommends Savings Plans, Reserved Instances and rightsizing. Maintained by AWS; requires AWS credentials.

Official AWS MCP that queries CloudWatch metrics, alarms and logs, analyzes log anomaly patterns and recommends alarm settings, helping agents with root cause analysis. Requires AWS credentials.

Official AWS MCP that searches and reads AWS documentation, converts it to Markdown for agents to cite, and suggests related pages. No AWS credentials needed; requires uv.

Official AWS MCP to create and manage EKS clusters, deploy apps, manage Kubernetes resources, and read pod logs and events for troubleshooting. Read-only by default; writes need --allow-write and reading logs needs --allow-sensitive-data-access.

Official AWS MCP that validates CloudFormation templates for syntax and security compliance, diagnoses deployment failures, and searches CloudFormation and CDK docs, code samples and best practices. Replaces the deprecated Cloud Control API server; needs AWS credentials.

NetEase's open-source cross-platform UI automation framework: locates elements by image recognition to automate games and apps on Android, iOS and Windows without touching their code. airtest run executes cases and airtest report builds HTML reports.

High-accuracy retrieval-augmented Q&A over paper PDFs, text and Office documents, filling in citation metadata, checking retractions and attaching traceable sources to answers. Provides the pqa CLI and a Python library. Needs an LLM API key by default; local models can be configured.

Say build a harness for this project and it designs a domain-specific agent team, generating subagent definitions, companion skills and orchestration, validates them and keeps evolving them from feedback. Supports workflow orchestration, persistent agent teams and subagent delegation.

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

PDF command line written in pure Go with almost no external dependencies: dozens of subcommands to merge, split, crop, rotate, watermark, encrypt and decrypt, extract images and fonts, and work with forms.

Manage database schemas as code: declare the desired schema in SQL, HCL or your ORM and Atlas plans, lints and applies migrations, and can export existing databases as HCL, SQL or Mermaid ER diagrams. Supports PostgreSQL, MySQL and a dozen other databases.

Converts the output of 100+ commands such as dig, ps, ls and ifconfig, plus common file formats, into JSON so agents can parse it reliably with jq or scripts. Also usable as a Python library.

Lightweight OCR built on PaddleOCR models converted to ONNX, recognizing Chinese and English by default on CPU alone. The rapidocr CLI reads text from screenshots, photos and scanned page images. Needs Python; downloads models on first run, then works offline. Convert PDFs to images first.

asc CLI for scripting the App Store Connect API: manage builds, TestFlight, metadata, signing and review submissions to automate iOS and macOS releases from the terminal or CI. Ships with a companion agent skill pack. Needs an App Store Connect API key.

Open-source visual traceroute that shows IP geolocation, AS number and carrier for every hop, with continuous MTR probing and JSON output; the full edition can also be deployed as an MCP server.

Offline speech toolkit for Apple Silicon Macs: CLI text-to-speech (including Chinese and voice cloning) and speech-to-text, for voicing lessons and explainer videos or transcribing lectures and interviews, with data staying local. Needs an M-series Mac and Python 3.10+; MP3 export needs ffmpeg.

Turns Peng Sida's public research-writing notes into a skill: revises abstracts, introductions, methods and experiments of ML/CV/NLP papers from a reviewer's view, checks that each claim has experimental evidence, and runs a pre-submission self-check. Pure methodology, no API key.

HTTP client CLI that reimplements HTTPie's syntax in Rust with a focus on performance; key-value pairs on the command line are sent as JSON by default, making it quick to debug REST APIs.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.

Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.