도구

MLflow's official skills plugin: lets coding agents add MLflow Tracing to LLM apps, analyze failed traces, build evaluation datasets and scorers, and query token and latency metrics, closing the instrument, evaluate, iterate loop. Needs MLflow 3.8+.

Pinecone's official plugin: bundles the Pinecone MCP server and /pinecone skill commands to create vector indexes, upsert data, search in plain language, or build a document Q&A assistant with citations from Claude Code. Needs a Pinecone API key (free sign-up); Assistant features also need uv.

HashiCorp's official MCP: lets agents manage Vault mounts, read and write KV secrets, enable PKI, create issuers and roles, and issue certificates. Needs a reachable Vault server and token; HashiCorp recommends using it only in trusted local environments.

TomTom's official MCP: geocoding and reverse geocoding, fuzzy and nearby search, single and multi-stop routing, reachable range, live traffic incidents, and static or dynamic maps. Needs a TomTom developer account and API key; use the hosted server (public preview) or run locally via npx.

Trivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.

Alibaba Cloud's official MCP server: through the DataWorks Open API, agents manage data development nodes and workflows, operate scheduled instances, query Data Map metadata and lineage, and configure data quality rules. Needs an Alibaba Cloud AccessKey.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).

Supabase's official plugin: Supabase and Postgres best-practice skills plus the Supabase remote MCP to manage projects, run SQL, design schemas and RLS policies, and handle auth and storage. Needs a Supabase account.

NASA's official MCP for its Common Metadata Repository: find Earth science and remote sensing datasets in plain language, check that data files exist for a given place and time, and get access services, related tools and citation info. No account to connect; downloads need an Earthdata login.

GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended.

Postman's official plugin: sets up the Postman MCP server so Claude Code can sync collections, run API tests and diagnose failures, generate client code, create mocks and docs, and run OWASP API security checks. Needs a Postman account.

Snowflake's official plugin: detects Snowflake-related requests and hands them to the Cortex Code CLI, whose 55+ built-in skills handle SQL, dynamic tables, data governance and more. Needs the cortex CLI installed and a Snowflake connection configured.

Browser Use's official plugin: connects the Browser Use MCP so Claude can drive your local Chrome or a cloud browser to browse, extract data, fill forms, test sites and take screenshots. Needs uv; cloud browsers need sign-in or an API key.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

ModelScope's official MCP: search models, datasets, Studio apps, papers and MCP servers and view details, plus text-to-image and image-to-image generation. Needs a ModelScope API token.

From TUM's Chair of Geoinformatics (a 3DCityDB co-developer): query CityGML 3D city models in 3DCityDB v5 in plain language, covering both spatial and semantic attributes, with read-only SQL. Needs a deployed 3DCityDB database and Python; register it from the folder with your .env config.

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

OpenCage's official MCP: geocode addresses and place names, reverse geocode coordinates (with admin area, time zone and more), and check API quota. For small lookups; use its CLI for batches. Needs an OpenCage API key (free trial), Node.js 20+, and manual setup from a repo clone.

PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

LogRocket's official plugin: when users report problems, agents pull up their session replays, network requests and errors and analyze the cause, so support doesn't have to keep asking for repro steps. Needs Claude Code and a site or app on paid LogRocket (14-day trial); sign in on first use.