Tools

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

Backend development plugin with 8 subagents for backend architecture, GraphQL, event sourcing, Temporal, TDD orchestration and more, a feature development command, and 9 skills on API design, microservices, CQRS, sagas and more. Part of the wshobson/agents marketplace.

Cross-platform shell built around structured data: pipelines pass tables instead of plain text, and you can open and query JSON, CSV, TOML and more directly. Default builds include nu --mcp, which serves it to agents as an MCP server.

Send files and folders between any two computers with one command: end-to-end encryption (PAKE), direct peer-to-peer with relay fallback, resumable transfers and proxy support, with no server setup or port forwarding.

Official Anthropic finance skill that checks Excel for formula errors like #REF!, numbers hardcoded in formulas, sum ranges that miss rows and mixed units; on full models it also checks the balance sheet balances and cash ties. Lists issues and fixes and asks before changing anything.

Converts PDFs, images, PPTX, DOCX, XLSX, EPUB and more into Markdown, JSON or HTML, preserving tables, formulas and layout, with optional LLM help for higher accuracy. Needs Python 3.10+ and PyTorch; large-scale commercial use of the model weights needs a paid license.

Official Anthropic skill for cleaning messy Excel exports: trims spaces, standardizes case and dates, converts text numbers, dedupes, and flags mixed types, garbled text and errors. Keeps originals via helper-column formulas and confirms each step. Works in Claude for Excel; local files need Python.

PostHog's official hosted MCP: lets agents query product analytics with HogQL, manage feature flags and A/B experiments, and investigate errors and session replays. Sign in to PostHog to authorize; tool calls are free, though a few LLM-powered tools count toward AI usage.

Community collection maintained under GitHub's official org with hundreds of skills following the Agent Skills spec, plus custom agents, instructions and plugins across many languages, frameworks and workflows. Content is third-party; install single skills with gh skills install.

Community skill collection in GitHub's official repo: 400+ skills following the Agent Skills spec, covering codebase onboarding, testing, cloud and DevOps, agent security and more. Install individual skills with gh skills install.

Community collection under GitHub's official org: Copilot custom agents, instructions, skills, hooks and plugins. It's also the default plugin marketplace in Copilot CLI and VS Code; install with copilot plugin install. Content is third-party, so review before installing.

A smarter cd that remembers your directories, ranking them by frequency and recency so you can jump with a fragment of the name. Add zoxide init to your shell config after installing.

Static analysis for shell scripts: flags syntax errors and common bash/sh pitfalls such as quoting and variable expansion, with suggested fixes. Good for checking agent-generated scripts and easy to add to CI.

Multi-agent orchestration plugin for Claude Code: /team coordinates subagents through a staged plan, requirements, execution, verification and fix pipeline, /autopilot drives tasks autonomously, and it can dispatch Codex, Gemini and other CLIs in tmux to work in parallel.

ByteDance's open-source multimodal agent CLI: operates browsers via vision or the DOM and calls terminal, file and MCP tools to complete tasks, with a Web UI and headless server mode. Needs Node.js 22+ and a model API key.

Browser automation MCP server open-sourced by ByteDance in the UI-TARS-desktop repo: drives pages through Puppeteer accessibility data with an optional vision mode, running locally over stdio or remotely over SSE or Streamable HTTP.

All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.

Define multi-container apps in compose.yaml and bring up services, databases, caches and the rest with one docker compose up, handy for agents setting up local dev and test dependencies. Maintained by Docker; included with Docker Desktop on macOS.

Detects your CPU, memory and GPU and scores open models on whether they run, speed, quality and context, then works with local runtimes like Ollama, llama.cpp and MLX to download and benchmark them. recommend --json gives agent-friendly output.

Local model gateway that routes requests from Claude Code, Codex and other coding agents to providers like DeepSeek, Kimi, Gemini and OpenRouter, with failover, rule-based routing and request logs. Bring your own API keys.

Alibaba's open-source Java production diagnostics tool: inspect method arguments and timing, threads and GC, class loading and decompiled code, and generate flame graphs without changing code or restarting the JVM. Supports JDK 8+ via an interactive CLI.

Headless browser written from scratch in Zig for AI agents and automation, using less memory and running faster than headless Chrome in official benchmarks. fetch turns pages into Markdown, and it can serve CDP or MCP. Telemetry is on by default (an env var disables it); Windows needs WSL.

HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.

Command runner that saves and runs project commands in a justfile, with make-inspired but simpler syntax. Agents can use just --list to discover a project's build, test and deploy commands and run them directly.