| 42crunch-api-security-testing | 42Crunch integrates with Claude Code to automatically audit OpenAPI specifications, identify OWASP-aligned vulnerabilities like BOLA/BFLA, and apply AI-driven fixes within a continuous security validation cycle. | Security | 42Crunch |
| agentforce-adlc | A workflow tool supporting the full lifecycle of Agentforce agents, covering authoring, discovery, scaffolding, deployment, testing, and optimization of .agent files. | Development | — |
| ai-plugins | Endor Labs is a security tool that installs via endorctl to analyze software supply chains, identifying, ranking, and remediating vulnerabilities and related risks. | — | — |
| aikido | Aikido Security integrates with Claude Code via its MCP server to perform static application security testing, secrets detection, and infrastructure-as-code vulnerability scanning. | — | — |
| auth0 | Enterprise-grade authentication tool that adds login, single sign-on, multi-factor authentication, and access control to applications, with framework-specific implementation guidance. | Security | Auth0 |
| aws-agents-for-devsecops | AWS DevOps Agent and AWS Security Agent assist software teams by investigating incidents, reviewing code, conducting user acceptance testing before releases, scanning for vulnerabilities, and performing penetration tests. | Development | Amazon Web Services |
| aws-startup-advisor | This tool offers tailored AWS guidance for startups on architecture, cost, security, and migration, from initial setup to production infrastructure, including credits, exclusive offers, and multi-account support. | Development | Amazon Web Services |
| claude-security | Performs in-depth code vulnerability scanning within Claude Code sessions at adjustable effort levels, verifying findings via code-based tallying and generating agent-panel-checked patches for optional application. | Security | Anthropic |
| coderabbit | CodeRabbit is an AI-powered code review tool combining specialized architecture with 40+ static analyzers to detect bugs, vulnerabilities, and logic errors, using AST-based context analysis and project guidelines, offering actionable fixes at no cost. | Productivity | — |
| crowdsec | A Claude skill that assists with operating CrowdSec across bare-metal, Docker, Kubernetes, and OPNsense setups—covering bouncers, WAF/AppSec, hub content, and troubleshooting via cscli and LAPI/CAPI, excluding new rule authoring. | Security | CrowdSec |
| crowdstrike-falcon-foundry | CrowdStrike Falcon Foundry provides development skills for creating cybersecurity applications on the Falcon platform, covering UI building, data collections, functions, workflows, API integration, security design patterns, and debugging techniques. | Security | CrowdStrike |
| crowdstrike-falcon-fusion | A toolkit for building and running CrowdStrike Falcon Fusion automation workflows, covering discovery of live actions, schema-validated YAML creation, workflow import/release, execution tracking, and managing Falcon Next-Gen SIEM lookup files. | Security | CrowdStrike |
| discord | Discord messaging bridge featuring built-in access control, allowing management of pairing, allowlists, and policies through /discord:access. | Productivity | — |
| duende-skills | A Claude Code extension providing development skills and agents for Duende, addressing OAuth/OIDC, IdentityServer, token handling, ASP.NET Core auth, BFF patterns, and secure identity system design. | Security | Duende Software |
| firebase | An MCP-based plugin linking Claude Code to Google Firebase, enabling direct management of backend resources during coding sessions. Specific commands, auth scopes, and configuration details are undocumented. | Database | — |
| google-cloud-storage | Enables a coding agent to perform Google Cloud Storage tasks via natural-language commands, including bucket/object management, FUSE mounting, error diagnosis, security audits (SAIF), and Terraform/client code generation; requires a GCP project and gcloud ADC authentication. | Deployment | Google LLC |
| jfrog | This tool integrates the JFrog Platform with Claude Code, enabling access to Artifactory repositories, security findings, package safety data, SDLC workflows, and platform administration tasks. | Security | JFrog Ltd. |
| netsuite-suitecloud | A guidance tool for building NetSuite SuiteCloud solutions, covering SuiteScript record handling and upgrades, SDF object and role/permission management, UIF single-page app development, OWASP-based secure coding, documentation practices, and SAFE Guide standards. | Development | Oracle NetSuite |
| nightvision | Provides skills for configuring scan targets/authentication/scope, triaging scan results, extracting OpenAPI specs from source code, and integrating scanning into CI/CD pipelines; portable across agent tools like Claude Code, Codex, and Cursor. | — | — |
| qodo | Qodo Skills offers a library of reusable AI agent capabilities enhancing Claude for software development, enabling code quality checks, testing, security scanning, and compliance validation throughout the SDLC. | Development | Qodo |
| security-guidance | This tool checks Claude-generated code for security issues, combining pattern-based edit warnings, LLM diff review, and commit analysis to detect injection, XSS, SSRF, hardcoded secrets, and other vulnerabilities. | Security | Anthropic |
| semgrep | Semgrep detects security vulnerabilities as code is written, helping guide Claude toward producing secure code from the outset. | Security | — |
| sonarqube | Integrates SonarQube into AI coding agents, automatically checking code quality, security, and secrets across 40+ languages using hooks, CLI, MCP server, and slash commands. | Security | SonarSource |
| sonatype-guide | An MCP server from Sonatype Guide that analyzes software dependencies for security vulnerabilities, recommends safer versions, and evaluates component quality metrics for supply chain assessment. | Security | — |
| spotify-ads-api | Enables managing Spotify ad campaigns via natural language conversation, covering campaign, ad set, and ad creation, reporting, and OAuth authentication handling. | Productivity | — |
| stackhawk-api | Interacts with the StackHawk platform API to retrieve security posture reports, vulnerability findings, and application management data, assisting agents with authentication, data retrieval, and presenting results. | Security | StackHawk |
| stackhawk-hawkscan | Integrates HawkScan DAST scanning into Claude Code by creating stackhawk.yml configuration files, executing scans through CLI or Docker, and converting security findings into prioritized remediation tasks for coding agents. | Security | StackHawk |
| supabase | Enables database management, authentication, storage handling, and real-time subscriptions for Supabase projects, allowing SQL query execution and direct backend interaction via MCP integration. | Database | — |
| vanta | Vanta plugin links Claude Code with Vanta's compliance platform via Vanta MCP server, using remediation guidance and local repo context to speed up fixing compliance test failures. | Security | Vanta |
| vanta-mcp-plugin | Vanta plugin links Claude Code to Vanta's compliance platform via Vanta MCP server, combining remediation guidance with local repo context to fix compliance failures. | Security | Vanta |
| workos | Provides WorkOS integration guidance covering AuthKit, single sign-on, Directory Sync, role-based access control, Vault, Audit Logs, migration processes, and API documentation references. | Security | WorkOS |
| zscaler | Administers Zscaler's cloud security suite—ZPA, ZIA, ZDX, ZCC, EASM, and Z-Insights—enabling policy configuration, connectivity troubleshooting, security audits, and incident investigation across these components. | Security | Zscaler |