Tools

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Scans your codebase and recommends the best hooks, skills, MCP servers, subagents and slash commands by category. Analysis only, no file changes; a quick way to set up Claude Code for a project. Official Anthropic plugin.

Anthropic's official plugin marketplace, built into Claude Code by default, with 300+ official and partner plugins for development, security, design and office collaboration. Browse and install with /plugin.

Wraps Microsoft's Playwright MCP so agents can drive a real browser to navigate, click, fill forms and take screenshots for end-to-end tests and page checks. In Anthropic's official marketplace; needs Node.js.

Connects GitHub's official remote MCP server to manage issues and PRs, review code, search repos and call the GitHub API from Claude Code. Requires GITHUB_PERSONAL_ACCESS_TOKEN.

Official Anthropic plugin that reads local session logs in ~/.claude/projects and generates an interactive HTML usage report covering tokens, cache hit rate, subagents, skills and the most expensive prompts, with optimization tips. Needs Node.js.

Connects Claude Code to gopls, Go's official language server, for code intelligence, refactoring and analysis. Install gopls with go install and add Go's bin directory to PATH first. Official Anthropic plugin.

Connects Claude Code to the Pyright language server for static type checking and code intelligence in Python. Install pyright first with npm, pip or pipx. Official Anthropic plugin.

Creates or improves Agent Skills from scratch: writes eval cases to test them, runs benchmarks with variance analysis, and tunes descriptions for more accurate triggering. Maintained by Anthropic.

Designs and builds MCP servers: first picks a deployment model among remote HTTP, MCPB bundles and local stdio, then guides tool design, auth and in-chat interactive components. Maintained by Anthropic.

Lightweight multi-protocol command-line downloader that fetches in parallel segments from multiple sources over HTTP(S), FTP, SFTP, BitTorrent and Metalink. Resumes downloads, reads URLs in bulk from text files and offers a JSON-RPC interface for scripts or agents.

Command-line tool for transferring data by URL over 20+ protocols including HTTP(S), FTP, SFTP, WebSocket and MQTT; a staple for agents calling APIs and downloading files. Preinstalled on macOS and most Linux distributions.

Release automation for iOS and Android: lanes orchestrate builds, code signing management, screenshot generation and uploads to the App Store and Google Play, and agents can call a project's existing lanes directly.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

Kubernetes operations plugin from the wshobson/agents marketplace: a kubernetes-architect subagent plus four skills for manifest generation, Helm chart scaffolding, GitOps workflows and security policies. Community-maintained.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions.

Accessibility review plugin with an audit command, a UI validation subagent, and WCAG 2.2 and screen reader testing skills. Before design reviews or launch, the agent checks contrast, keyboard use and screen reader support and suggests fixes. For Claude Code; automated checks need Node.js.

Quant trading plugin from the wshobson/agents marketplace: quant analyst and risk manager subagents plus backtesting and risk metrics skills for strategy backtests, portfolio optimization and risk measures like VaR, Sharpe ratio and max drawdown. Needs local Python; not investment advice.

Business analytics plugin from the wshobson/agents marketplace: KPI dashboard design and data storytelling skills plus a business analyst subagent to choose metrics, plan dashboard layouts and turn data into reports executives or investors understand. Methods and templates only; no data connections.

MLOps plugin from the wshobson/agents marketplace: data scientist, ML engineer and MLOps engineer subagents and a /ml-pipeline command that runs the pipeline in phases from data analysis and training to deployment and monitoring, plus ML pipeline and recommender system skills.

Orchestrates multi-agent teams using Claude Code's experimental Agent Teams feature: parallel multi-angle code review, competing-hypothesis debugging and feature work split by file ownership. Enable CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS first.

Plugin for building LLM apps: LangGraph agents with memory and tool use, hybrid-search RAG, vector index tuning, prompt optimization and LLM evaluation. Includes 3 subagents and 8 skills.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.