Tools

Requires the agent to run the full verification commands and read the output before claiming work is done, fixed or passing, backing claims with evidence and ruling out unverified success reports. From the Superpowers workflow.

Behavior guidelines drawn from Karpathy's observations of how LLMs go wrong when coding: think before acting, keep it simple, make surgical changes only, and drive work by verifiable goals. Can also be used directly as a CLAUDE.md.

Four guidelines based on Karpathy's observations of common LLM coding mistakes: think before coding, prefer simplicity, make only necessary changes, and work toward verifiable goals. Ships as a plugin skill or works as a CLAUDE.md. Community-made, not by Karpathy.

Has the agent follow a 'don't write it if you can avoid it' ladder: ask if it's needed, then reuse existing code, the standard library, platform features and installed dependencies, writing only the minimum while keeping validation, error handling, security and accessibility.

'Laziest senior engineer' mode: checks whether the work is needed and whether existing code, the standard library or platform features cover it, then writes the minimum code while keeping validation, error handling and security. For Claude Code and Codex; its hook needs Node.js.

Six specialized review subagents that check comment accuracy, test coverage, silent failures, type design, code style and simplification opportunities. Run them individually or all at once. Official Anthropic plugin.

Generates hook rules from a one-line description or by analyzing recent conversations. Rules are Markdown files with match conditions that block or warn on dangerous commands and unwanted patterns, and take effect without a restart. Official Anthropic plugin.

Migrates React projects and shadcn components from Radix UI to Base UI, one component at a time or the whole project on request. Prefers the shadcn CLI's base variants merged with user customizations, typechecks every step, and writes a per-component report in .migration/. From the shadcn/ui repo.

Reviews code changes before merge across five axes: correctness, readability, architecture, security and performance. Works on code and PRs from you, other agents or other people, judged by whether they improve overall code health. Part of Addy Osmani's agent-skills.

Frontend design quality plugin: one skill plus 24 commands (audit, critique, polish and more) and 61 built-in deterministic rules that find common design flaws in AI-generated interfaces and fix them one by one.

Drives Alibaba's open-source ocr CLI to review Git changes (working tree, a commit or a branch diff), grouping line-level comments by severity and fixing them on request. Needs an LLM endpoint (Anthropic, OpenAI and other protocols); installs the CLI if missing. By Alibaba.

Alibaba's open-source AI code review tool: reads the Git diff, groups changed files for parallel review by subagents and returns line-level comments; the plugin adds review and delegated review commands. Install the ocr CLI and configure a model first; delegated mode needs no API key.

Alibaba's open-source AI code review CLI (ocr): a deterministic pass filters and groups files and matches rules, then an agent reads the context and writes line-level comments; ocr scan reviews a whole directory. Needs an LLM endpoint, or delegate mode to hand off to your coding agent.

Connects Claude Code to gopls, Go's official language server, for code intelligence, refactoring and analysis. Install gopls with go install and add Go's bin directory to PATH first. Official Anthropic plugin.

Connects Claude Code to a TypeScript/JavaScript language server for go-to-definition, find references and live type error checking. Install typescript-language-server globally first. Official Anthropic plugin.

Simplifies and tidies recently changed code without changing behavior: reduces nesting and redundancy, improves naming and follows the project conventions in CLAUDE.md. Official Anthropic plugin.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

Static analysis for shell scripts: flags syntax errors and common bash/sh pitfalls such as quoting and variable expansion, with suggested fixes. Good for checking agent-generated scripts and easy to add to CI.

React and Next.js performance rules from Vercel's engineering team: 70 rules ranked by impact covering request waterfalls, bundle size, server performance and re-renders, for writing, reviewing and refactoring. Maintained by Vercel.

Vercel's guide to React composition patterns: replaces boolean prop sprawl with compound components, lifted state and clean Context interfaces, including React 19 API changes. Useful for refactoring component libraries and reviewing component architecture.

All-in-one toolchain for web projects: fast formatting and linting with 500+ rules for JS, TS, JSX, JSON, CSS and GraphQL. Formatting is highly compatible with Prettier, and check --write applies all fixes in one pass.

Semantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.

Semgrep's official MCP server, now part of the main semgrep repo and started with semgrep mcp: lets agents run static security scans, find issues with custom rules and inspect syntax trees. Requires the Semgrep CLI; connecting to the AppSec platform needs SEMGREP_APP_TOKEN.

AST-based structural code search, lint and bulk rewrite tool: matches code patterns rather than text, with $VAR wildcards for nodes, making it well suited to agents doing large cross-file refactors.