도구

HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.

Lightweight command-line JSON processor that slices, filters, maps and transforms JSON with concise expressions and no runtime dependencies. A staple for agents parsing API responses and logs.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Anthropic's official data skill that guides agents to write, translate and optimize SQL across Snowflake, BigQuery, Databricks, PostgreSQL and other warehouse dialects, including CTEs, window functions and analytical aggregations.

Data analysis plugin: writes queries in each SQL dialect, explores datasets, runs statistical tests, charts with Python and builds interactive HTML dashboards, then reviews methods and conclusions before sharing. Connects to Snowflake, BigQuery and other warehouses. Official from Anthropic.

Compliance skill from Anthropic's official operations plugin: maps controls, owners and evidence for SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, schedules audits, runs gap analyses, and outputs audit-readiness checklists and evidence collection plans. Have legal or compliance experts review.

Reviews UI code against Vercel's Web Interface Guidelines, covering accessibility, focus, forms, animation, typography, dark mode and more, listing issues as file:line. Fetches the latest rules before each review. Maintained by Vercel.

Vercel's React Native and Expo best practices ranked by impact, covering list scrolling performance, Reanimated animations, navigation, UI patterns, state management and monorepo setup. Maintained by Vercel.

Runs the cognee memory engine as an MCP server whose remember, recall and forget tools write documents and conversations into a knowledge graph and vector store for cross-session retrieval. Start it with Docker or uv first; needs an LLM API key by default, or connect to Cognee Cloud.

Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test.

Writes conversations and business data into Graphiti's temporal knowledge graph so agents can retrieve long-term memory by entity, fact and time. Open source from Zep; start FalkorDB or Neo4j and the server with Docker first, and configure an LLM API key.

Grafana's load and performance testing tool: write test scripts in JavaScript covering HTTP, WebSocket, gRPC and browsers, set threshold assertions and run them in CI.

Gives coding agents IDE-like symbol-level code search, editing and refactoring via language servers (LSP) across 40+ languages, with cross-session memory. An optional paid JetBrains plugin backend adds breakpoint debugging. Install with uv first.

Official web auditing tool from the Google Chrome team: score pages on performance, accessibility, best practices and SEO from the command line and get HTML, JSON or CSV reports, so agents can iterate on a page. Needs Node 22+ and Chrome.

Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.

Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.

CLI and library for evaluating and red-teaming LLM apps: compare prompts and model outputs in bulk, scan for security vulnerabilities and plug into CI/CD, with evals running locally. Now part of OpenAI and still open source under MIT.

160+ specialized Claude Code subagents, packaged as plugins in 10 categories such as core development, languages, infrastructure, testing and security, and data and AI, so you install only what you need.

Open-source reverse engineering framework and CLI: disassemble, debug, emulate and patch binaries across many architectures and file formats, scriptable through r2pipe or built-in JavaScript.

Manages BigQuery datasets, tables and jobs with the bq and gcloud CLIs, runs SQL queries and loads data, with references for client libraries, MCP and Terraform. Google's official skill; requires a Google Cloud project.

Google's official skill library, focused on Google Cloud: 100+ skills for gcloud, Cloud Run, GKE, BigQuery, IAM, monitoring and logging, and the Well-Architected Framework, plus Ads and Analytics.

Google's official skill library and plugin marketplace: nearly 150 skills focused on Google Cloud (GKE, BigQuery, Cloud Run, IAM and more), plus 17 product plugins pairing skills with MCP for Cloud SQL, Spanner, AlloyDB, BigQuery, GCS and others.

Encrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project.

Scripts terminal sessions in .tape files and records them to GIF, MP4 or WebM, great for CLI demos and docs; text snapshot output also enables terminal integration tests. By Charm; requires ttyd and ffmpeg.