Tools

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Methodology reference for US SOX 404 internal control audits: scoping significant accounts, sampling methods, workpaper and evidence standards, and classifying deficiencies, significant deficiencies and material weaknesses. Not audit or legal advice; needs professional review. By Anthropic.

For internal auditors running SOX tests: lists key controls by area (revenue, procure-to-pay, payroll, close, ITGC) and period, sets sample sizes, samples from your population, and generates test workpaper templates and deficiency assessments. Needs professional review. Official from Anthropic.

Large multi-domain plugin marketplace: 99 plugins bundle hundreds of skills, agents and slash commands covering engineering, marketing, product, project management, regulatory and quality, finance and C-level advisory. Also offers install options for Codex, Gemini CLI and others.

A collection of 380+ skills across engineering, product, marketing, compliance, finance and executive advisory roles, with many standard-library Python scripts. Claude Code can install them by domain as plugins; works with Codex, Gemini CLI and a dozen other agents.

Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first.

Official AWS MCP that validates CloudFormation templates for syntax and security compliance, diagnoses deployment failures, and searches CloudFormation and CDK docs, code samples and best practices. Replaces the deprecated Cloud Control API server; needs AWS credentials.

Answers wage and hour questions for a specific state or country, such as worker classification, overtime, meal and rest breaks, leave and final pay, citing the law for each point and flagging when judgment is needed. US-focused; needs web or a legal database. Lawyer review required. By Anthropic.

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

Scans codebases and dependencies for open-source licenses, copyright notices and package manifests, detecting licenses by full-text matching, with output in JSON, SPDX, CycloneDX and more, for open-source compliance reviews.

The Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings.

Official FSFE command-line tool that checks every file in a project for copyright and license information per the REUSE spec, adds headers in bulk, downloads license texts and generates an SPDX bill of materials. Needs Python; have legal review the results.

Official MCP and skills from freee, Japan's cloud accounting service: accounting, invoices, HR and payroll, timesheets, fixed assets and tax filings. Remote server with freee OAuth recommended; freee Sign e-contracts are local-only for now. Have an accountant check results.

Open-source European e-invoicing tool whose CLI validates, extracts and creates ZUGFeRD, Factur-X and XRechnung invoices (PDF or XML) and renders XML invoices as readable HTML or PDF, for EU invoicing compliance. Needs Java; download the Mustang-CLI jar from the project site.

MCP for an open-source tax guide library: when answering income tax, VAT and payroll tax questions, agents cite up-to-date guides covering 200+ jurisdictions, some reviewed by named licensed accountants. Hosted, no install. Reference only; check with an accountant before filing.

Open-source accounting for Swedish sole traders and limited companies: 150+ MCP tools let AI categorize bank transactions, draft entries, reconcile and prepare VAT, payroll and year-end filings, all writes needing your approval. Hosted (OAuth) or self-hosted; accountant review advised.

Queries SEC EDGAR 10-K, 10-Q and 8-K filings, XBRL financial statements and insider trades, with links to the source documents for checking; for investment research and compliance due diligence. Free, no API key; needs uv and a SEC_EDGAR_USER_AGENT with your name and email.

Python library with a CLI for Factur-X (ZUGFeRD 2.x), the French-German e-invoicing standard: combine a regular PDF invoice and XML into a Factur-X invoice, extract the XML from invoice PDFs and validate it against the official XSD; also handles Order-X and UBL. Needs Python 3.

Official MCP for Norman, a German bookkeeping and tax service: create invoices (including ZUGFeRD e-invoices), categorize transactions, match receipts, preview and file VAT returns, and prepare GmbH/UG formation documents. Needs a Norman account (OAuth); a tax advisor should review filings.

Carta's official plugin for VC and PE fund finance and IR teams: query fund NAV, performance and benchmarks, pull Form ADV data, build management company budgets and consolidated statements in Excel, and generate LP annual meeting materials. Needs a Carta fund admin account; results need review.

Avalara's official hosted MCP servers: US sales tax calculation, returns filing, e-invoicing, exemption certificates, cross-border duties and HS code classification. Needs an Avalara account (AvaTax has a 90-day trial) and browser OAuth; the command adds AvaTax. Have a tax professional review.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.

Wingspan's official plugin: ask about your contractor roster, who is missing W-9s or other compliance docs, what is due this month and why a payment is stuck; also invite contractors and log draft bills. Writes are previewed and it never sends money. Needs a Wingspan payer account; US-focused.