Tools

HR and compliance plugin with HR and legal advisor subagents plus employment contract and GDPR skills, for drafting hiring materials, onboarding, offboarding and performance policies, employment contracts, privacy policies, terms of service and DPAs. Mainly US and EU rules.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Large multi-domain plugin marketplace: 99 plugins bundle hundreds of skills, agents and slash commands covering engineering, marketing, product, project management, regulatory and quality, finance and C-level advisory. Also offers install options for Codex, Gemini CLI and others.

A collection of 380+ skills across engineering, product, marketing, compliance, finance and executive advisory roles, with many standard-library Python scripts. Claude Code can install them by domain as plugins; works with Codex, Gemini CLI and a dozen other agents.

Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first.

Official AWS MCP that validates CloudFormation templates for syntax and security compliance, diagnoses deployment failures, and searches CloudFormation and CDK docs, code samples and best practices. Replaces the deprecated Cloud Control API server; needs AWS credentials.

Pre-termination check for high-risk factors (recent complaints, protected leave, discrimination or retaliation, thin documentation), reviews severance and separation agreements, and looks up state final-pay deadlines. US-focused; needs web or a legal database. Lawyer review required. By Anthropic.

Anthropic's official legal plugin marketplace: 13 plugins covering commercial contracts, privacy, product counsel, M&A, employment, regulatory, AI governance, litigation and IP, plus plugins for law school clinics and law students. All output is a draft for attorney review.

Anthropic's official employment law plugin: reviews hiring and termination risk by jurisdiction, classifies workers, tracks leave deadlines, manages internal investigations, and drafts policies with state supplements. Focused on US state law; output needs attorney review.

Answers wage and hour questions for a specific state or country, such as worker classification, overtime, meal and rest breaks, leave and final pay, citing the law for each point and flagging when judgment is needed. US-focused; needs web or a legal database. Lawyer review required. By Anthropic.

When revising an employee handbook, compares proposed changes clause by clause with the current version, finds knock-on effects (such as PTO changes affecting final pay) and state supplement changes, and flags risks of cutting existing benefits. US-focused; needs legal review. By Anthropic.

Drafts employee policies such as remote work, parental leave and PTO, generates state or country supplements where rules differ, and flags laws in flux. Mostly US states; needs web access for regulations and is best installed with the employment-legal plugin. Lawyer review required. By Anthropic.

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

Scans codebases and dependencies for open-source licenses, copyright notices and package manifests, detecting licenses by full-text matching, with output in JSON, SPDX, CycloneDX and more, for open-source compliance reviews.

The Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings.

The HR department of headcount's company-style agent org: 12 skills for org design, hiring, pay and levels, performance, employee relations, compliance, benefits and leave, on/offboarding, payroll, workforce planning and training. No account needed; have HR or a lawyer check compliance.

German-language HR plugin for German startups of about 100 people: employment contracts, DATEV payroll handoff, personnel files and data protection, AGG complaints, works councils, absences, benefits and dismissals under German labor law. German law only; have a lawyer or HR pro review.

A large skill library for non-engineering teams: 372 skills covering project management, marketing, executive advisory, legal (NDA triage, contract review, privacy, DPIAs), SOC 2 and GDPR compliance, HR and finance. Add it from the Claude desktop plugin page. Have legal output reviewed.

Official FSFE command-line tool that checks every file in a project for copyright and license information per the REUSE spec, adds headers in bulk, downloads license texts and generates an SPDX bill of materials. Needs Python; have legal review the results.

Reviews employment agreements, NDAs, service agreements and other common contracts: flags risky clauses (unlimited liability, unilateral termination, auto-renewal), checks for missing terms and suggests edits to negotiate. US, EU, UK and China law. No account; have a lawyer review.

Official MCP and skills from freee, Japan's cloud accounting service: accounting, invoices, HR and payroll, timesheets, fixed assets and tax filings. Remote server with freee OAuth recommended; freee Sign e-contracts are local-only for now. Have an accountant check results.

Drafts an employee handbook for small firms without dedicated HR: interviews the owner on actual practice, then writes plain-language attendance, leave, pay, conduct and anti-harassment policies, flagging clauses to check against local law. Based on US state rules; needs employment lawyer review.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

Wingspan's official plugin: ask about your contractor roster, who is missing W-9s or other compliance docs, what is due this month and why a payment is stuck; also invite contractors and log draft bills. Writes are previewed and it never sends money. Needs a Wingspan payer account; US-focused.