# Tools > Every listed resource, editors’ picks first. The filters below can be combined. - Search: append `?q=` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README. - Filter by type: append `?type=` to the URL. - Filter by profession: append `?profession=` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions - Filter by tag: append `?tag=` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags Type Plugin, Resources for ML / AI or Security: 44 items. > - ML / AI: Model training, evaluation and LLM application development. > - Security: Code audits, vulnerability triage, penetration testing and compliance. - [Claude Security](https://hebbmind.com/pt-BR/plugin/claude-security.md): [Plugin] Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin. - [ECC](https://hebbmind.com/pt-BR/plugin/ecc.md): [Plugin] A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support. - [prompts.chat](https://hebbmind.com/pt-BR/plugin/prompts-chat.md): [Plugin] Official Claude Code plugin for the prompts.chat library: search prompts and Agent Skills from your coding assistant, fill in variables and improve prompts with AI. Includes commands, subagents and a remote MCP; saving your own prompts needs an API key. - [Agent SDK Dev](https://hebbmind.com/pt-BR/plugin/agent-sdk-dev.md): [Plugin] Scaffolds a Claude Agent SDK project in Python or TypeScript interactively with /new-sdk-app, then a verifier agent checks dependencies, config and code against official best practices. Maintained by Anthropic. - [Plugin Dev](https://hebbmind.com/pt-BR/plugin/plugin-dev.md): [Plugin] Toolkit for building Claude Code plugins: 7 skills on plugin structure, hooks, MCP integration, commands, subagents and skill writing, a guided eight-phase create command, and subagents for agent generation, plugin validation and skill review. Maintained by Anthropic. - [Ruflo](https://hebbmind.com/pt-BR/plugin/ruflo.md): [Plugin] Multi-agent orchestration framework for Claude Code and Codex, formerly Claude Flow: swarm coordination, self-learning memory and cross-machine federated communication. The marketplace offers 30+ plugins; full features need npx ruflo init. - [career-ops](https://hebbmind.com/pt-BR/plugin/career-ops.md): [Plugin] Job search system that runs in your local AI coding CLI: scans job portals, scores roles with a structured A-H evaluation and a 1-5 rating, flags fake listings, tailors ATS resumes and cover letters, and tracks applications. Never submits for you. Needs Node.js. - [wshobson/agents](https://hebbmind.com/pt-BR/plugin/wshobson-agents.md): [Plugin] Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content. - [Machine Learning Ops](https://hebbmind.com/pt-BR/plugin/machine-learning-ops.md): [Plugin] MLOps plugin from the wshobson/agents marketplace: data scientist, ML engineer and MLOps engineer subagents and a /ml-pipeline command that runs the pipeline in phases from data analysis and training to deployment and monitoring, plus ML pipeline and recommender system skills. - [Security Scanning](https://hebbmind.com/pt-BR/plugin/security-scanning.md): [Plugin] Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees. - [LLM Application Dev](https://hebbmind.com/pt-BR/plugin/llm-application-dev.md): [Plugin] Plugin for building LLM apps: LangGraph agents with memory and tool use, hybrid-search RAG, vector index tuning, prompt optimization and LLM evaluation. Includes 3 subagents and 8 skills. - [Quantitative Trading](https://hebbmind.com/pt-BR/plugin/quantitative-trading.md): [Plugin] Quant trading plugin from the wshobson/agents marketplace: quant analyst and risk manager subagents plus backtesting and risk metrics skills for strategy backtests, portfolio optimization and risk measures like VaR, Sharpe ratio and max drawdown. Needs local Python; not investment advice. - [Session Report](https://hebbmind.com/pt-BR/plugin/session-report.md): [Plugin] Official Anthropic plugin that reads local session logs in ~/.claude/projects and generates an interactive HTML usage report covering tokens, cache hit rate, subagents, skills and the most expensive prompts, with optimization tips. Needs Node.js. - [Security Guidance](https://hebbmind.com/pt-BR/plugin/security-guidance.md): [Plugin] Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access. - [MCP Server Dev](https://hebbmind.com/pt-BR/plugin/mcp-server-dev.md): [Plugin] Designs and builds MCP servers: first picks a deployment model among remote HTTP, MCPB bundles and local stdio, then guides tool design, auth and in-chat interactive components. Maintained by Anthropic. - [Pyright LSP](https://hebbmind.com/pt-BR/plugin/pyright-lsp.md): [Plugin] Connects Claude Code to the Pyright language server for static type checking and code intelligence in Python. Install pyright first with npm, pip or pipx. Official Anthropic plugin. - [Skill Creator](https://hebbmind.com/pt-BR/plugin/skill-creator.md): [Plugin] Creates or improves Agent Skills from scratch: writes eval cases to test them, runs benchmarks with variance analysis, and tunes descriptions for more accurate triggering. Maintained by Anthropic. - [Google Skills](https://hebbmind.com/pt-BR/plugin/google-skills.md): [Plugin] Google's official skill library and plugin marketplace: nearly 150 skills focused on Google Cloud (GKE, BigQuery, Cloud Run, IAM and more), plus 17 product plugins pairing skills with MCP for Cloud SQL, Spanner, AlloyDB, BigQuery, GCS and others. - [Agent Skills for Context Engineering](https://hebbmind.com/pt-BR/plugin/agent-skills-for-context-engineering.md): [Plugin] Context and harness engineering skills covering context compression and optimization, multi-agent architectures, memory systems, tool design and LLM-as-judge evaluation, activated automatically by task. Aimed at building production-grade agent systems. - [AI Research Skills](https://hebbmind.com/pt-BR/plugin/ai-research-skills.md): [Plugin] Plugin marketplace for AI research with nearly 100 skills in 23 categories, from ideation, fine-tuning and post-training to distributed training, inference serving, evaluation and paper writing, coordinated end to end by the autoresearch skill. - [Hugging Face Skills](https://hebbmind.com/pt-BR/plugin/huggingface-skills.md): [Plugin] Lets agents work with the Hugging Face Hub through the hf CLI: search and download models and datasets, manage repos and Spaces, and run training and evaluation jobs on cloud GPUs, with more workflow skills installable as needed. Maintained by Hugging Face. - [AI Governance Legal](https://hebbmind.com/pt-BR/plugin/ai-governance-legal.md): [Plugin] Anthropic's official AI governance plugin: tiers AI use cases against your internal register, runs impact assessments across applicable laws such as the EU AI Act, reviews vendor AI terms for training-data and liability risk, and periodically checks for drift between AI policy and practice. - [Privacy Legal](https://hebbmind.com/pt-BR/plugin/privacy-legal.md): [Plugin] Privacy compliance plugin: decides whether processing activities need a PIA or DPIA, generates privacy impact assessments, reviews DPAs from the controller or processor side, and drafts DSAR responses within statutory deadlines. Official from Anthropic. - [Harness](https://hebbmind.com/pt-BR/plugin/harness.md): [Plugin] Say build a harness for this project and it designs a domain-specific agent team, generating subagent definitions, companion skills and orchestration, validates them and keeps evolving them from feedback. Supports workflow orchestration, persistent agent teams and subagent delegation. - [Trail of Bits Skills](https://hebbmind.com/pt-BR/plugin/trailofbits-skills.md): [Plugin] Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too. - [OpenAI Developers](https://hebbmind.com/pt-BR/plugin/openai-developers.md): [Plugin] Build with OpenAI best practices inside Codex: call the OpenAI API, build and deploy agents with the Agents SDK, create ChatGPT apps and prepare submission materials, and create API keys directly. Maintained by OpenAI; Codex only. - [Codex Security](https://hebbmind.com/pt-BR/plugin/codex-security.md): [Plugin] Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access. - [Claude Scholar](https://hebbmind.com/pt-BR/plugin/claude-scholar.md): [Plugin] Semi-automated research assistant for CS and AI researchers that links ideation, Zotero literature management, experiment analysis and reporting, paper writing and reviewer responses, and keeps project knowledge in Obsidian. Branches for Codex and other agents exist. - [NVIDIA Agent Skills](https://hebbmind.com/pt-BR/plugin/nvidia-skills.md): [Plugin] NVIDIA's official plugin that finds and installs the right skills from NVIDIA's catalog for your task, spanning CUDA acceleration, NIM inference, NeMo training, RAG blueprints, Omniverse simulation and robotics. Listed in both the Claude and Codex official marketplaces. - [Agent Toolkit for AWS](https://hebbmind.com/pt-BR/plugin/agent-toolkit-for-aws.md): [Plugin] AWS's generally available agent toolkit and plugin marketplace: plugins such as aws-core, aws-agents and aws-data-analytics bundle the AWS MCP Server with evaluated skills for IaC, serverless, containers and billing. Calling AWS APIs requires configured credentials. - [CC Safety Net](https://hebbmind.com/pt-BR/plugin/cc-safety-net.md): [Plugin] Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+. - [Simulink Agentic Toolkit](https://hebbmind.com/pt-BR/plugin/simulink-agentic-toolkit.md): [Plugin] MathWorks' official toolkit for reading, building, modifying and testing Simulink models via the MATLAB MCP server, with skills for control design, Simscape, code generation and compliance checks. Needs licensed MATLAB R2023a+ and Simulink; run the official installer in MATLAB first. - [MATLAB Agentic Toolkit](https://hebbmind.com/pt-BR/plugin/matlab-agentic-toolkit.md): [Plugin] MathWorks' official toolkit: set up the MCP server via the MATLAB installer so agents can run code, run tests and do static checks; domain skill sets for signal processing, controls, statistics and machine learning install as Claude Code plugins. Needs MATLAB R2021a+. - [Oh My Paper](https://hebbmind.com/pt-BR/plugin/oh-my-paper.md): [Plugin] A research plugin for Claude Code: commands like /omp:survey, /omp:experiment and /omp:write chain literature review, topic selection, experiments, writing and self-review, with 5 specialized agents and 34 research skills that remember project progress across sessions. Experiments lean toward ML. - [phd-skills](https://hebbmind.com/pt-BR/plugin/phd-skills.md): [Plugin] Research guardrails for PhD students: reproduce arXiv papers, debug training anomalies with evidence, compare runs at matched epochs, check paper-code consistency, verify BibTeX, find literature gaps and predict reviewer comments. No MCP or extra dependencies; mostly for ML research. - [Databricks Agent Skills](https://hebbmind.com/pt-BR/plugin/databricks-agent-skills.md): [Plugin] Official Databricks plugin with skills for the CLI and auth, Genie data queries, Apps, Lakebase, Lakeflow jobs and pipelines, Model Serving and DABs deployment, plus hooks for prompt routing, session context and auth failure hints. Needs a Databricks account. - [Firecrawl Plugin for Claude Code](https://hebbmind.com/pt-BR/plugin/firecrawl-claude-plugin.md): [Plugin] Firecrawl's official plugin: brings the Firecrawl CLI in as skills so Claude Code can search the web, scrape pages to Markdown, map site links or crawl whole sites. Install firecrawl-cli and set an API key first; self-hosting supported. - [SonarQube](https://hebbmind.com/pt-BR/plugin/sonarqube-agent-plugins.md): [Plugin] Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker. - [MLflow Skills](https://hebbmind.com/pt-BR/plugin/mlflow-skills.md): [Plugin] MLflow's official skills plugin: lets coding agents add MLflow Tracing to LLM apps, analyze failed traces, build evaluation datasets and scorers, and query token and latency metrics, closing the instrument, evaluate, iterate loop. Needs MLflow 3.8+. - [Pinecone Plugin for Claude Code](https://hebbmind.com/pt-BR/plugin/pinecone-claude-code-plugin.md): [Plugin] Pinecone's official plugin: bundles the Pinecone MCP server and /pinecone skill commands to create vector indexes, upsert data, search in plain language, or build a document Q&A assistant with citations from Claude Code. Needs a Pinecone API key (free sign-up); Assistant features also need uv. - [Auth0](https://hebbmind.com/pt-BR/plugin/auth0.md): [Plugin] Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up). - [Langfuse Observability Plugin](https://hebbmind.com/pt-BR/plugin/claude-observability-plugin.md): [Plugin] Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+. - [Semgrep Guardian](https://hebbmind.com/pt-BR/plugin/semgrep-plugin.md): [Plugin] Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login. - [Vanta](https://hebbmind.com/pt-BR/plugin/vanta-mcp-plugin.md): [Plugin] Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.