Tools

Scans container images, filesystem directories and SBOMs for known vulnerabilities across major Linux distro packages and many language ecosystems, ranks risk by EPSS and KEV, and filters results with OpenVEX. Good for vulnerability gates in CI. Maintained by Anchore.

curl for gRPC: call any gRPC method with JSON, including bidirectional streaming, browse service definitions via server reflection, proto source files or protosets, with TLS and mutual TLS support.

Lets agents call thousands of ready-made scrapers and automation Actors from Apify Store to pull data from social media, search engines, maps, e-commerce sites and more. Maintained by Apify; needs an Apify account (OAuth) or API token.

Simon Willison's LLM CLI and Python library: call OpenAI, Claude, Gemini and local models from the terminal, with conversations logged to SQLite automatically, plus embeddings, structured extraction, tool calling and a plugin system.

From Zilliz: indexes your codebase as vectors in Milvus or Zilliz Cloud so coding agents find relevant code by semantic search, cutting context costs in large repos. Needs an embedding model (OpenAI, VoyageAI, Ollama and others) and a vector database.

Estimates cloud costs of Terraform, Terragrunt, CloudFormation and AWS CDK changes before deployment and checks them against FinOps policies, in the terminal, editor, AI agents or CI. Requires an Infracost account; a free tier is available.

A du replacement written in Rust that shows disk usage as a directory tree with proportion bars, making large files and folders easy to spot. Filter by depth, count or regex, and output JSON with -j for agents to parse.

ByteDance's open-source, general software engineering agent: trae-cli edits files and runs commands from natural language, supports multiple model providers and MCP, and records full execution trajectories. Transparent design suits agent research and customization. Needs your own model API key.

Document layout skill by tw93 with eight templates (resume, one-pager, long doc, formal letter, portfolio, slides, research report and more) that render polished PDF, PNG or editable PPT and check layout and content gaps. Supports English, Chinese, Japanese and Korean. Needs Python (WeasyPrint).

Bundles 60+ full-stack specialist skills into one plugin: experts for 12 languages including Python, TypeScript, Go, Rust and Java, and frameworks like React, Django and Spring Boot, activated automatically by request. Also includes Jira and Confluence workflow commands (needs Atlassian MCP).

MySQL terminal client with smart autocompletion and syntax highlighting, also compatible with MariaDB and TiDB. Supports --execute and batch mode with CSV or table output, so agents can run SQL directly.

Connects to the Arize Phoenix observability platform so agents can query LLM traces and sessions, manage prompts, browse datasets and read experiment evaluation results. Maintained by Arize; needs a self-hosted or cloud Phoenix instance.

Lets Claude Code, Codex and other agents call Gemini, GPT, Ollama and other models to collaborate on code review, debugging, planning and multi-model consensus, and can bridge to other CLI agents. Configure at least one provider (API key or local Ollama). Formerly Zen MCP.

Reads local session files to report token usage and cost by project, model, task and branch for Claude Code, Codex, Cursor and dozens of other coding agents, no sign-up needed. Also offers config optimization tips, quota checks and spend-cap hooks. Needs Node.js 22.13+.

Publishes SQLite databases as browsable, queryable web pages and JSON APIs, with SQL queries, metadata and plugins, and deploys to Cloud Run and other platforms with datasette publish. Great for data exploration and data journalism. Needs Python 3.10+.

Scans files and directories for personal data such as names, emails and credit card numbers using Presidio Analyzer, with configurable entity types, confidence thresholds and ignore rules. Needs Python 3.10+ and a spaCy language model.

GitHub's official terminal coding agent, sharing its harness with the Copilot coding agent and shipping with the GitHub MCP built in. Work with repos, issues and PRs in natural language, approving each action before it runs. Requires a Copilot subscription.

Open-source AI presentation generator that builds slides from a topic or uploaded documents and exports PPTX or PDF, with a built-in MCP endpoint for agents. Good for lesson decks and reports. Self-host with Docker and configure an LLM API key, then have an admin create an MCP key.

Google's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental).

Lets agents fine-tune language and vision models with TRL or Unsloth on Hugging Face Jobs cloud GPUs, supporting SFT, DPO, GRPO and reward models, and convert results to GGUF for local use. Requires an HF Pro or higher paid plan. Maintained by Hugging Face.

Hugging Face's official skills: manage Hub models and datasets with the hf CLI, fine-tune language and vision models, run model evaluations, and build Gradio apps deployed to Spaces. Needs an HF account; cloud training on HF Jobs requires a paid plan.

Lets agents work with the Hugging Face Hub through the hf CLI: search and download models and datasets, manage repos and Spaces, and run training and evaluation jobs on cloud GPUs, with more workflow skills installable as needed. Maintained by Hugging Face.

Teaches agents the Hugging Face Hub CLI hf: search and download models, manage datasets, Spaces, Buckets and repos, and run Jobs and inference endpoints. The skill content is generated from your local CLI, so install hf first. Maintained by Hugging Face.

OpenAI's official security CLI and TypeScript SDK: scans codebases to find, validate and fix security vulnerabilities, and can draft a SECURITY.md policy. Needs Node.js 22.13+, Python 3.10+, and a ChatGPT sign-in or API key.