Tools

Anthropic's terminal coding agent: understands your codebase, edits code, runs commands and handles git workflows, with plugins, MCP and a headless mode (claude -p). Sign in with a Claude account or set an API key.

GitHub's official CLI: manage pull requests, issues, releases and Actions workflows from the terminal. Most commands support --json output that agents can parse, and an official agent skill is available. Run gh auth login first.

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

GitHub's official MCP server: lets agents read and write repositories and code, manage issues and pull requests, and check Actions workflows and code-scanning alerts. Use the hosted remote server or run it locally in Docker; needs a personal access token or OAuth.

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

Connects GitHub's official remote MCP server to manage issues and PRs, review code, search repos and call the GitHub API from Claude Code. Requires GITHUB_PERSONAL_ACCESS_TOKEN.

Connects GitLab's official remote MCP server (beta) so Claude can work with repos, merge requests, CI/CD pipelines, issues and wikis on GitLab.com. MCP access must be enabled on the top-level group, with browser OAuth. In Anthropic's official plugin marketplace.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

Everyday software engineering plugin: standup summaries, code review, structured debugging, architecture decision records, incident response and pre-deploy checks. Official from Anthropic, built mainly for Cowork but also usable in Claude Code.

Bundles 60+ full-stack specialist skills into one plugin: experts for 12 languages including Python, TypeScript, Go, Rust and Java, and frameworks like React, Django and Spring Boot, activated automatically by request. Also includes Jira and Confluence workflow commands (needs Atlassian MCP).

OpenAI's official security CLI and TypeScript SDK: scans codebases to find, validate and fix security vulnerabilities, and can draft a SECURITY.md policy. Needs Node.js 22.13+, Python 3.10+, and a ChatGPT sign-in or API key.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

Community-maintained GitLab MCP server: manage projects, merge requests, issues, pipelines, wikis and releases, with support for self-hosted instances and a read-only mode. Needs a GitLab personal access token or OAuth.

Manages stacked branches and dependent pull requests with the gh stack GitHub CLI extension: splits work into layered branches with one PR each, then handles push, submit, sync, rebase and merge, using flags that keep commands non-interactive for agents. Official GitHub skill.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.

Official SonarSource server: connects to SonarQube Server or Cloud so agents can query code issues, quality gates, security hotspots and dependency risks, and analyze file contents directly. Needs a SonarQube token; Docker is the recommended way to run it.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.

PagerDuty's official plugin: analyzes your current git diff against the service's past incidents and change events, gives a 0-5 risk score and suggestions before you commit, and can create PagerDuty SRE Agent skills (early access program required). Needs a PagerDuty API token.