Инструменты

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.

Data engineering plugin from the wshobson/agents marketplace: a data engineer subagent, a data pipeline command, and skills for Airflow DAGs, dbt transformations, Spark tuning and data quality, to help build ETL and data warehouses.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

MLOps plugin from the wshobson/agents marketplace: data scientist, ML engineer and MLOps engineer subagents and a /ml-pipeline command that runs the pipeline in phases from data analysis and training to deployment and monitoring, plus ML pipeline and recommender system skills.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Connects Claude Code to the Pyright language server for static type checking and code intelligence in Python. Install pyright first with npm, pip or pipx. Official Anthropic plugin.

Data analysis plugin: writes queries in each SQL dialect, explores datasets, runs statistical tests, charts with Python and builds interactive HTML dashboards, then reviews methods and conclusions before sharing. Connects to Snowflake, BigQuery and other warehouses. Official from Anthropic.

Google's official skill library and plugin marketplace: nearly 150 skills focused on Google Cloud (GKE, BigQuery, Cloud Run, IAM and more), plus 17 product plugins pairing skills with MCP for Cloud SQL, Spanner, AlloyDB, BigQuery, GCS and others.

Lets agents work with the Hugging Face Hub through the hf CLI: search and download models and datasets, manage repos and Spaces, and run training and evaluation jobs on cloud GPUs, with more workflow skills installable as needed. Maintained by Hugging Face.

Anthropic's official AI governance plugin: tiers AI use cases against your internal register, runs impact assessments across applicable laws such as the EU AI Act, reviews vendor AI terms for training-data and liability risk, and periodically checks for drift between AI policy and practice.

Privacy compliance plugin: decides whether processing activities need a PIA or DPIA, generates privacy impact assessments, reviews DPAs from the controller or processor side, and drafts DSAR responses within statutory deadlines. Official from Anthropic.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

AWS's generally available agent toolkit and plugin marketplace: plugins such as aws-core, aws-agents and aws-data-analytics bundle the AWS MCP Server with evaluated skills for IaC, serverless, containers and billing. Calling AWS APIs requires configured credentials.

Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+.

dbt Labs' official plugin marketplace with dbt and dbt-migration plugins: write models and unit tests, build semantic-layer metrics, govern with dbt Mesh, debug failed jobs, and handle version upgrades and cross-platform migrations. Most skills need an existing dbt project.

Astronomer's official data engineering plugin: write Airflow DAGs to best practices, debug pipeline failures, trace data lineage, profile warehouse tables and migrate from Airflow 2 to 3, with a built-in Airflow MCP server and session hooks.

Official Databricks plugin with skills for the CLI and auth, Genie data queries, Apps, Lakebase, Lakeflow jobs and pipelines, Model Serving and DABs deployment, plus hooks for prompt routing, session context and auth failure hints. Needs a Databricks account.

Firecrawl's official plugin: brings the Firecrawl CLI in as skills so Claude Code can search the web, scrape pages to Markdown, map site links or crawl whole sites. Install firecrawl-cli and set an API key first; self-hosting supported.

MongoDB's official plugin: runs the MongoDB MCP locally via npx and adds skills for query generation, index tuning, schema design, and full-text and vector search. Connects to self-hosted or Atlas databases with a connection string.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.

Helps agents add Auth0 authentication to apps: detects 35+ frameworks and covers login, MFA, SSO, RBAC, JWT validation, migration from other auth providers, and tenant security audits. Maintained by Auth0; needs an Auth0 account (free sign-up).