Tools

A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.

Toolkit for building Claude Code plugins: 7 skills on plugin structure, hooks, MCP integration, commands, subagents and skill writing, a guided eight-phase create command, and subagents for agent generation, plugin validation and skill review. Maintained by Anthropic.

Multi-agent orchestration framework formerly called Claude Flow: ruflo init gives Claude Code nearly 100 specialized subagents, swarm coordination, cross-session vector memory and hooks; add --codex to configure Codex instead. Also works as a standalone MCP server or plugin marketplace.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+.

A research plugin for Claude Code: commands like /omp:survey, /omp:experiment and /omp:write chain literature review, topic selection, experiments, writing and self-review, with 5 specialized agents and 34 research skills that remember project progress across sessions. Experiments lean toward ML.

Research guardrails for PhD students: reproduce arXiv papers, debug training anomalies with evidence, compare runs at matched epochs, check paper-code consistency, verify BibTeX, find literature gaps and predict reviewer comments. No MCP or extra dependencies; mostly for ML research.

Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.

Langfuse's official plugin: uses hooks to send prompts, model calls, token usage and cost, tool calls and subagents from Claude Code sessions to Langfuse as traces for monitoring and review. Needs Langfuse keys (self-hosting supported) and uv or Python 3.10+.

Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.