Tools

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Scans your codebase and recommends the best hooks, skills, MCP servers, subagents and slash commands by category. Analysis only, no file changes; a quick way to set up Claude Code for a project. Official Anthropic plugin.

HashiCorp's official Terraform plugin: runs the Terraform MCP Server in Docker against the Terraform Registry and HCP Terraform API to look up provider and module docs and help write IaC. Needs Docker; TFE_TOKEN is optional.

Connects Claude Code to the Pyright language server for static type checking and code intelligence in Python. Install pyright first with npm, pip or pipx. Official Anthropic plugin.

Official Anthropic plugin that reads local session logs in ~/.claude/projects and generates an interactive HTML usage report covering tokens, cache hit rate, subagents, skills and the most expensive prompts, with optimization tips. Needs Node.js.

Connects Claude Code to gopls, Go's official language server, for code intelligence, refactoring and analysis. Install gopls with go install and add Go's bin directory to PATH first. Official Anthropic plugin.

Creates or improves Agent Skills from scratch: writes eval cases to test them, runs benchmarks with variance analysis, and tunes descriptions for more accurate triggering. Maintained by Anthropic.

Release automation for iOS and Android: lanes orchestrate builds, code signing management, screenshot generation and uploads to the App Store and Google Play, and agents can call a project's existing lanes directly.

Plugin for building LLM apps: LangGraph agents with memory and tool use, hybrid-search RAG, vector index tuning, prompt optimization and LLM evaluation. Includes 3 subagents and 8 skills.

Kubernetes operations plugin from the wshobson/agents marketplace: a kubernetes-architect subagent plus four skills for manifest generation, Helm chart scaffolding, GitOps workflows and security policies. Community-maintained.

MLOps plugin from the wshobson/agents marketplace: data scientist, ML engineer and MLOps engineer subagents and a /ml-pipeline command that runs the pipeline in phases from data analysis and training to deployment and monitoring, plus ML pipeline and recommender system skills.

Quant trading plugin from the wshobson/agents marketplace: quant analyst and risk manager subagents plus backtesting and risk metrics skills for strategy backtests, portfolio optimization and risk measures like VaR, Sharpe ratio and max drawdown. Needs local Python; not investment advice.

EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

Cross-platform shell built around structured data: pipelines pass tables instead of plain text, and you can open and query JSON, CSV, TOML and more directly. Default builds include nu --mcp, which serves it to agents as an MCP server.

Send files and folders between any two computers with one command: end-to-end encryption (PAKE), direct peer-to-peer with relay fallback, resumable transfers and proxy support, with no server setup or port forwarding.

Converts PDFs, images, PPTX, DOCX, XLSX, EPUB and more into Markdown, JSON or HTML, preserving tables, formulas and layout, with optional LLM help for higher accuracy. Needs Python 3.10+ and PyTorch; large-scale commercial use of the model weights needs a paid license.

Static analysis for shell scripts: flags syntax errors and common bash/sh pitfalls such as quoting and variable expansion, with suggested fixes. Good for checking agent-generated scripts and easy to add to CI.

A smarter cd that remembers your directories, ranking them by frequency and recency so you can jump with a fragment of the name. Add zoxide init to your shell config after installing.

Community skill collection in GitHub's official repo: 400+ skills following the Agent Skills spec, covering codebase onboarding, testing, cloud and DevOps, agent security and more. Install individual skills with gh skills install.

Browser automation MCP server open-sourced by ByteDance in the UI-TARS-desktop repo: drives pages through Puppeteer accessibility data with an optional vision mode, running locally over stdio or remotely over SSE or Streamable HTTP.

ByteDance's open-source multimodal agent CLI: operates browsers via vision or the DOM and calls terminal, file and MCP tools to complete tasks, with a Web UI and headless server mode. Needs Node.js 22+ and a model API key.