Tools

Open-source browser agent project. Its browser-use CLI lets Claude Code, Codex and other agents drive your logged-in local Chrome with Python snippets, or connect to a cloud browser; also ships a Python agent library. The cloud browser needs an API key.

In-process analytical SQL database. Its CLI queries CSV, Parquet and JSON files directly with SQL, no import or server needed, so agents can sample and aggregate large files. Officially maintained.

Microsoft's cross-browser end-to-end testing framework: one API drives Chromium, Firefox and WebKit, npx playwright test runs tests in parallel and isolation, with auto-waiting and trace replay for debugging failures.

Adaptive web scraping framework: scrapling extract turns a page into Markdown, text or HTML in one command, with CSS selectors and browser rendering for dynamic pages, plus an MCP server (needs the ai extra). Needs Python 3.10+ and a browser install on first use.

Open-source, LLM-friendly web crawler that turns pages into clean Markdown for RAG and agents. Ships the crwl CLI and supports deep crawling and question-driven data extraction (extraction needs an LLM key). Free to self-host.

Command-line edition of the open-source OpenBB investment research platform: query stock prices, financial statements, macroeconomic and other financial data from the terminal, and automate data pulls with Routine scripts. Officially maintained; some sources need API keys.

Runs GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.

Official CLI (bru) for the open-source API client Bruno: runs collections stored as plain text in your repo, switches environments, outputs JSON results and imports collections from OpenAPI, making API tests easy to run in CI.

Browser automation CLI built for AI agents in native Rust: open pages, click and fill forms by refs from accessibility tree snapshots, read text and take screenshots, with compact snapshots and output limits to save context. From Vercel Labs; reuses local Chrome or installs one.

Command-line tool for transferring data by URL over 20+ protocols including HTTP(S), FTP, SFTP, WebSocket and MQTT; a staple for agents calling APIs and downloading files. Preinstalled on macOS and most Linux distributions.

Cross-platform shell built around structured data: pipelines pass tables instead of plain text, and you can open and query JSON, CSV, TOML and more directly. Default builds include nu --mcp, which serves it to agents as an MCP server.

ByteDance's open-source multimodal agent CLI: operates browsers via vision or the DOM and calls terminal, file and MCP tools to complete tasks, with a Web UI and headless server mode. Needs Node.js 22+ and a model API key.

All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.

Define multi-container apps in compose.yaml and bring up services, databases, caches and the rest with one docker compose up, handy for agents setting up local dev and test dependencies. Maintained by Docker; included with Docker Desktop on macOS.

HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.

Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test.

Grafana's load and performance testing tool: write test scripts in JavaScript covering HTTP, WebSocket, gRPC and browsers, set threshold assertions and run them in CI.

Official web auditing tool from the Google Chrome team: score pages on performance, accessibility, best practices and SEO from the command line and get HTML, JSON or CSV reports, so agents can iterate on a page. Needs Node 22+ and Chrome.

Turns websites and Electron desktop apps into deterministic CLIs, with built-in adapters for Reddit, Hacker News, Bilibili, Zhihu, Xiaohongshu and more, and lets agents operate any page through your signed-in Chrome. Needs its companion browser extension.

Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.

Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.

CLI and library for evaluating and red-teaming LLM apps: compare prompts and model outputs in bulk, scan for security vulnerabilities and plug into CI/CD, with evals running locally. Now part of OpenAI and still open source under MIT.

Open-source reverse engineering framework and CLI: disassemble, debug, emulate and patch binaries across many architectures and file formats, scriptable through r2pipe or built-in JavaScript.

Encrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project.