# Tools

> Every listed resource, editors’ picks first. The filters below can be combined.

- Search: append `?q=<keywords>` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README.
- Filter by type: append `?type=<cli|skill|plugin|mcp>` to the URL.
- Filter by profession: append `?profession=<profession id>` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions
- Filter by tag: append `?tag=<tag>` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags

Resources for QA or DevOps / SRE or ML / AI, Tagged `pentesting`: 5 items.

> - QA: Functional testing, test automation and quality assurance.
> - DevOps / SRE: Deployment, monitoring, cloud resources and reliability.
> - ML / AI: Model training, evaluation and LLM application development.

- [Anthropic Cybersecurity Skills](https://hebbmind.com/skill/anthropic-cybersecurity-skills.md): [Skill] Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.
- [Nuclei](https://hebbmind.com/cli/nuclei.md): [CLI] Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test.
- [Nmap](https://hebbmind.com/cli/nmap.md): [CLI] Classic network discovery and security auditing tool: host discovery, port scanning, service version and OS detection, plus vulnerability checks with NSE scripts. Only scan networks you are authorized to test.
- [garak](https://hebbmind.com/cli/garak.md): [CLI] NVIDIA's open-source LLM vulnerability scanner that probes for prompt injection, jailbreaks, data leakage, hallucination and harmful content, supporting OpenAI, Hugging Face, Bedrock and most REST-accessible models. Scanning cloud models needs their API keys.
- [Burp Suite MCP Server](https://hebbmind.com/mcp/portswigger-mcp-server.md): [MCP] PortSwigger's official Burp Suite extension that lets agents read proxy history, send HTTP requests and create Repeater tabs; with Burp Pro it can also read scan results and use Collaborator. Install from the BApp Store; listens on 127.0.0.1:9876 by default.