Tools

All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.

Define multi-container apps in compose.yaml and bring up services, databases, caches and the rest with one docker compose up, handy for agents setting up local dev and test dependencies. Maintained by Docker; included with Docker Desktop on macOS.

Detects your CPU, memory and GPU and scores open models on whether they run, speed, quality and context, then works with local runtimes like Ollama, llama.cpp and MLX to download and benchmark them. recommend --json gives agent-friendly output.

Local model gateway that routes requests from Claude Code, Codex and other coding agents to providers like DeepSeek, Kimi, Gemini and OpenRouter, with failover, rule-based routing and request logs. Bring your own API keys.

Alibaba's open-source Java production diagnostics tool: inspect method arguments and timing, threads and GC, class loading and decompiled code, and generate flame graphs without changing code or restarting the JVM. Supports JDK 8+ via an interactive CLI.

Headless browser written from scratch in Zig for AI agents and automation, using less memory and running faster than headless Chrome in official benchmarks. fetch turns pages into Markdown, and it can serve CDP or MCP. Telemetry is on by default (an env var disables it); Windows needs WSL.

HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.

Lets agents create and edit draw.io diagrams such as flowcharts and architecture diagrams in plain language, with live browser preview, version history and export to .drawio, PNG or SVG. Includes an embedded server; runs locally with no API key.

Command runner that saves and runs project commands in a justfile, with make-inspired but simpler syntax. Agents can use just --list to discover a project's build, test and deploy commands and run them directly.

Claude Code plugin for Next AI Draw.io that starts its Draw.io MCP server via npx. Generate and edit flowcharts, architecture and sequence diagrams in plain language, with live browser preview, version history and .drawio export. Needs Node.js.

Lightweight command-line JSON processor that slices, filters, maps and transforms JSON with concise expressions and no runtime dependencies. A staple for agents parsing API responses and logs.

Package manager for the open Agent Skills ecosystem: one command installs skills from GitHub and other sources into Claude Code, Codex, Cursor and dozens more agents, with search, update and removal. From Vercel Labs.

Trading research agent from HKU's HKUDS whose MCP server offers 70+ tools for quotes, financials, backtesting and research across A-shares, Hong Kong and US stocks and crypto. Needs local Python; HK, US and crypto research need no API key. For research only; not investment advice.

Terminal multiplexer written in Rust, an alternative to tmux, with layout files, floating and stacked panes, WebAssembly plugins and a built-in web client. Handy for running several agent sessions at once.

When a user asks whether a skill exists for some task, searches the skills.sh ecosystem with the skills CLI, then recommends and installs a fit. Maintained by Vercel Labs and shipped in the skills CLI repo.

Polyglot dev environment manager: declare Node, Python, Go and other tool versions, environment variables and project tasks in mise.toml; mise exec and mise run install tools on demand and run them, with one config shared by local and CI.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Official CLI for Tencent's open-source knowledge base platform WeKnora: upload documents, manage knowledge bases, run hybrid search and answer questions from them, or serve as a read-only MCP. Needs your own WeKnora deployment and a source build with Go 1.26+.

Daemonless, rootless container and pod manager with a Docker-compatible CLI for building, running and pushing OCI images. On macOS and Windows it runs inside a podman machine VM.

Vercel's official cost and performance skill: gathers production metrics, usage and project config, investigates only the routes and files the metrics point to, and returns ranked, doc-backed recommendations. Supports Next.js, SvelteKit and Nuxt; needs Vercel CLI v53+ logged in and linked.

Vercel's official deployment skill: checks the git remote, project link and CLI login, then deploys a preview (default) or production via git push or vercel deploy. When login isn't possible in a sandbox, it can create a claimable preview link.

Runs the cognee memory engine as an MCP server whose remember, recall and forget tools write documents and conversations into a knowledge graph and vector store for cross-session retrieval. Start it with Docker or uv first; needs an LLM API key by default, or connect to Cognee Cloud.

Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test.

Writes conversations and business data into Graphiti's temporal knowledge graph so agents can retrieve long-term memory by entity, fact and time. Open source from Zep; start FalkorDB or Neo4j and the server with Docker first, and configure an LLM API key.