도구

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.

Mixpanel's official CLI, mp (with a Python library): query event trends, funnels, retention and user flows, and manage dashboards, reports and cohorts. Needs Python 3.10+ and a Mixpanel account; run mp login to authorize in the browser. Pre-release; interfaces may change.

OpenCage's official MCP: geocode addresses and place names, reverse geocode coordinates (with admin area, time zone and more), and check API quota. For small lookups; use its CLI for batches. Needs an OpenCage API key (free trial), Node.js 20+, and manual setup from a repo clone.

PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

Pendo's official product analytics plugin: summarize account activity and feedback before customer meetings, analyze feature adoption, group user feedback into themes and find session replays. Needs a Pendo subscription; authorize via /mcp after install.

Windsor.ai's official plugin: connects ad accounts on Google, Meta, TikTok and more plus 350+ data sources such as GA4 and CRMs for quick cross-channel performance reports and wasted-spend detection; asks before changing budgets or pausing ads. Needs a Windsor.ai account with data sources connected.