Tools

Anthropic's terminal coding agent: understands your codebase, edits code, runs commands and handles git workflows, with plugins, MCP and a headless mode (claude -p). Sign in with a Claude account or set an API key.

Reviews pull requests with several parallel subagents, scores each finding by confidence to filter out false positives, and can post the results as PR comments. Official Anthropic plugin; requires a logged-in GitHub CLI.

GitHub's official CLI: manage pull requests, issues, releases and Actions workflows from the terminal. Most commands support --json output that agents can parse, and an official agent skill is available. Run gh auth login first.

GitHub's official MCP server: lets agents read and write repositories and code, manage issues and pull requests, and check Actions workflows and code-scanning alerts. Use the hosted remote server or run it locally in Docker; needs a personal access token or OAuth.

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

Six specialized review subagents that check comment accuracy, test coverage, silent failures, type design, code style and simplification opportunities. Run them individually or all at once. Official Anthropic plugin.

Skill pack from YC president Garry Tan: slash commands such as /office-hours, /plan-ceo-review, /review, /qa and /ship play CEO, engineering manager, designer, QA and release engineer. Needs Git and Bun; clone the repo and run ./setup as the README describes.

Addy Osmani's production-grade engineering skill pack covering spec, planning, implementation, testing, review and shipping, with commands like /spec, /plan, /build, /test, /review and /ship. Supports both Claude Code and Codex.

Engineering skill collection spanning define, plan, build, verify, review and ship, with /spec, /plan, /build, /test, /review and /ship commands, including TDD, code review and web performance audits. By Addy Osmani.

Drives Alibaba's open-source ocr CLI to review Git changes (working tree, a commit or a branch diff), grouping line-level comments by severity and fixing them on request. Needs an LLM endpoint (Anthropic, OpenAI and other protocols); installs the CLI if missing. By Alibaba.

Connects GitHub's official remote MCP server to manage issues and PRs, review code, search repos and call the GitHub API from Claude Code. Requires GITHUB_PERSONAL_ACCESS_TOKEN.

Connects GitLab's official remote MCP server (beta) so Claude can work with repos, merge requests, CI/CD pipelines, issues and wikis on GitLab.com. MCP access must be enabled on the top-level group, with browser OAuth. In Anthropic's official plugin marketplace.

Orchestrates multi-agent teams using Claude Code's experimental Agent Teams feature: parallel multi-angle code review, competing-hypothesis debugging and feature work split by file ownership. Enable CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS first.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

Reviews UI code against Vercel's Web Interface Guidelines, covering accessibility, focus, forms, animation, typography, dark mode and more, listing issues as file:line. Fetches the latest rules before each review. Maintained by Vercel.

Everyday software engineering plugin: standup summaries, code review, structured debugging, architecture decision records, incident response and pre-deploy checks. Official from Anthropic, built mainly for Cowork but also usable in Claude Code.

FormatJS's official localization review skill for software translators: read-only checks of UI strings and translations for ICU syntax, placeholders, terminology consistency and locale formats for dates, numbers and currency, listing issues with evidence and minimal fixes. Never edits files.

Bundles 60+ full-stack specialist skills into one plugin: experts for 12 languages including Python, TypeScript, Go, Rust and Java, and frameworks like React, Django and Spring Boot, activated automatically by request. Also includes Jira and Confluence workflow commands (needs Atlassian MCP).

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

Community-maintained GitLab MCP server: manage projects, merge requests, issues, pipelines, wikis and releases, with support for self-hosted instances and a read-only mode. Needs a GitLab personal access token or OAuth.

Manages stacked branches and dependent pull requests with the gh stack GitHub CLI extension: splits work into layered branches with one PR each, then handles push, submit, sync, rebase and merge, using flags that keep commands non-interactive for agents. Official GitHub skill.

Official SonarSource server: connects to SonarQube Server or Cloud so agents can query code issues, quality gates, security hotspots and dependency risks, and analyze file contents directly. Needs a SonarQube token; Docker is the recommended way to run it.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.

Diffs a live page's accessibility violations against a baseline, stashing uncommitted changes by default or comparing with a branch, and reports new, fixed and pre-existing WCAG issues with selectors and fixes. Locates only, no edits. Runs AccessLint's Chrome and CLI tools via npx.