Tools

Generates hook rules from a one-line description or by analyzing recent conversations. Rules are Markdown files with match conditions that block or warn on dangerous commands and unwanted patterns, and take effect without a restart. Official Anthropic plugin.

Astral's extremely fast Python linter and formatter written in Rust, replacing Flake8, isort and Black, with 900+ built-in rules and auto-fix.

Connects Claude Code to the Pyright language server for static type checking and code intelligence in Python. Install pyright first with npm, pip or pipx. Official Anthropic plugin.

Connects Claude Code to gopls, Go's official language server, for code intelligence, refactoring and analysis. Install gopls with go install and add Go's bin directory to PATH first. Official Anthropic plugin.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

Static analysis for shell scripts: flags syntax errors and common bash/sh pitfalls such as quoting and variable expansion, with suggested fixes. Good for checking agent-generated scripts and easy to add to CI.

Semgrep's official MCP server, now part of the main semgrep repo and started with semgrep mcp: lets agents run static security scans, find issues with custom rules and inspect syntax trees. Requires the Semgrep CLI; connecting to the AppSec platform needs SEMGREP_APP_TOKEN.

Semantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.

Multi-language git hook manager: declare formatting, lint, secret scanning and other hooks in .pre-commit-config.yaml to run automatically before each commit, or have the agent self-check with pre-commit run --all-files before committing.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.

Official SonarSource server: connects to SonarQube Server or Cloud so agents can query code issues, quality gates, security hotspots and dependency risks, and analyze file contents directly. Needs a SonarQube token; Docker is the recommended way to run it.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.