Tools

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

A collection of 380+ skills across engineering, product, marketing, compliance, finance and executive advisory roles, with many standard-library Python scripts. Claude Code can install them by domain as plugins; works with Codex, Gemini CLI and a dozen other agents.

Large multi-domain plugin marketplace: 99 plugins bundle hundreds of skills, agents and slash commands covering engineering, marketing, product, project management, regulatory and quality, finance and C-level advisory. Also offers install options for Codex, Gemini CLI and others.

Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first.

Official AWS MCP that validates CloudFormation templates for syntax and security compliance, diagnoses deployment failures, and searches CloudFormation and CDK docs, code samples and best practices. Replaces the deprecated Cloud Control API server; needs AWS credentials.

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

Searches Korean statutes, case law, administrative rules and local ordinances via the Korean Ministry of Government Legislation's Open API, verifies whether cited provisions and cases exist, and compares versions over time. Needs a free API key and Node.js; have a lawyer review results.

Scans codebases and dependencies for open-source licenses, copyright notices and package manifests, detecting licenses by full-text matching, with output in JSON, SPDX, CycloneDX and more, for open-source compliance reviews.

The Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings.

Official FSFE command-line tool that checks every file in a project for copyright and license information per the REUSE spec, adds headers in bulk, downloads license texts and generates an SPDX bill of materials. Needs Python; have legal review the results.

Queries SEC EDGAR 10-K, 10-Q and 8-K filings, XBRL financial statements and insider trades, with links to the source documents for checking; for investment research and compliance due diligence. Free, no API key; needs uv and a SEC_EDGAR_USER_AGENT with your name and email.

UK legal research service from i.AI, the UK government's AI incubator, with a remote MCP: semantic search over UK legislation, amendments and explanatory notes. Connect directly, no account. Officially experimental; case law is temporarily disabled and results need a lawyer's review.

Vaquill's official legal research MCP: search US federal and state codes, CFR, constitutions, court rules and the Federal Register, resolve Bluebook citations to statute text, plus Indian law. Needs a credit-based API key (non-commercial users can request free credits). A lawyer must review.

Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.