The Complete Tool Catalog

Analyze MCP server source code for security vulnerabilities, permission overreach, and suspicious patterns. Get risk scores and security grades.

Scan text, files, and inputs for 31+ prompt injection attack patterns including role switching, hidden instructions, data exfiltration, and jailbreak attempts.

Detect leaked API keys, tokens, passwords, and credentials in code. Supports AWS, GitHub, OpenAI, Stripe, and 40+ provider patterns.

Visualize and compare MCP server permission scopes. See attack surface scores and understand what each tool can access.

Scan package.json, requirements.txt, Cargo.toml, and go.mod for known CVEs. Offline database of vulnerabilities, no API needed.

Strip dangerous patterns from code before execution: eval(), exec(), system calls, network requests. Configurable allowlists.

Verify AI-generated outputs match expected schemas, types, and constraints. Catch malformed JSON, invalid SQL, broken HTML before it ships.

Log and alert on file system operations during agent execution. See exactly which files were read, written, or deleted.

Monitor and log all outgoing network requests from MCP servers. Detect unexpected data exfiltration or phone-home behavior.

Detect exposed credentials and automatically rotate them. Supports .env files, config files, and CI/CD secrets.

Generate compliance-ready audit logs of all agent actions: files modified, commands run, APIs called. Export as JSON, CSV, or Markdown reports.

Run untrusted code in an isolated sandbox with configurable resource limits. Prevent filesystem, network, and process access.

Calculate cyclomatic complexity, cognitive complexity, maintainability index, and Halstead metrics for any codebase. Supports JS/TS, Python, Go, Rust, Java.

Find unused functions, variables, imports, exports, and CSS classes across your codebase. Supports tree-shaking analysis.

Detect copy-paste patterns and near-duplicate code blocks. Suggest extraction into shared functions or modules.

Measure TypeScript type coverage percentage. Find implicit 'any' types, missing return types, and untyped parameters.

Find circular dependencies between modules. Visualize dependency chains and suggest breaking points.

Map all public interfaces, exported functions, and API endpoints. Detect breaking changes between versions.

Apply and enforce consistent code formatting beyond what Prettier/ESLint do: naming conventions, file organization, import ordering.

Find outdated, misleading, or redundant comments. Detect TODO/FIXME/HACK markers. Score comment-to-code ratio.

Identify untested code paths, uncovered branches, and functions without test files. Prioritize by risk and complexity.

Analyze regex patterns for correctness, performance (ReDoS risk), and readability. Test against sample inputs.

Generate visual dependency graphs, module maps, and architecture diagrams from source code. Output as Mermaid, DOT, or JSON.

Auto-generate architecture documentation from code analysis: module responsibilities, data flows, integration points.

Discover and catalog all API routes, endpoints, middleware, and handlers. Supports Express, Fastify, Next.js, Django, Flask, Rails.

Parse migration files, ORM models, and SQL schemas to generate ER diagrams and relationship maps.

Catalog all environment variables used across the codebase. Detect missing .env entries, unused vars, and inconsistencies.

Validate JSON, YAML, TOML, and INI config files against schemas. Detect typos, missing required fields, and type mismatches.

Analyze git history patterns: hotspot files, churn rate, contributor patterns, commit message quality, branch age.

Catalog all TODO, FIXME, HACK, XXX, and WORKAROUND markers. Prioritize by age, severity, and location.

Scan all dependencies for license compatibility. Flag GPL contamination, missing licenses, and compliance risks.

Parse CI/CD configs (GitHub Actions, GitLab CI, CircleCI) and visualize build stages, dependencies, and bottlenecks.

Generate unit tests from function signatures, JSDoc comments, and usage patterns. Supports Jest, Vitest, pytest, Go testing.

Create realistic test fixtures from database schemas, API responses, and TypeScript types. Faker-powered data generation.

Generate a mock API server from OpenAPI/Swagger specs. Serve realistic responses without hitting real APIs.

Capture and compare output snapshots. Detect UI changes, API response drift, and CLI output differences.

Analyze function signatures and generate boundary value test cases: empty strings, zero, negative numbers, unicode, huge inputs.

Verify API contracts between frontend and backend. Detect schema mismatches, missing fields, and type incompatibilities.

Check HTML output for WCAG 2.1 compliance: missing alt text, color contrast, keyboard navigation, ARIA labels, heading hierarchy.

Run micro-benchmarks on functions and compare performance across implementations. Track regression over time.

Compare test results, API responses, and behavior between git commits. Flag regressions with precise cause identification.

Mutate source code and verify tests catch the mutations. Find weak tests that pass even when code is broken.

Transform between data formats: JSON, CSV, XML, YAML, TOML, TSV. Handle nested structures, arrays, and custom delimiters.

Infer JSON Schema, TypeScript types, or Zod schemas from data samples. Handle nullable fields, enums, and nested objects.

Replace PII (names, emails, phone numbers, addresses, SSNs) with realistic fake data. Consistent replacement across files.

Verify file integrity: valid JSON, well-formed XML, correct CSV headers, valid images. Check encoding, line endings, BOM markers.

Compress PNG, JPEG, SVG, and WebP images without quality loss. Generate responsive sizes and modern formats.

Clean and optimize SVG files: remove metadata, simplify paths, minify, remove unused defs. Reduce file sizes by 30-80%.

Validate markdown syntax, fix heading hierarchy, broken links, inconsistent list styles, and missing alt text.

Parse structured and unstructured logs into queryable data. Support for JSON logs, syslog, Apache, Nginx, and custom formats.

Analyze SQL queries for performance: missing indexes, N+1 patterns, full table scans, suboptimal joins. Suggest improvements.

Intelligently merge configuration files: handle conflicts, preserve comments, maintain ordering. Support for JSON, YAML, TOML.

Version, manage, and A/B test prompt templates. Track which prompts produce the best results over time.

Cache AI responses for identical or similar inputs. Reduce API costs and latency for repeated operations.

Analyze and optimize what fits in the context window. Prioritize recent, relevant, and high-value content. Track token budgets.

Monitor token usage across sessions, tasks, and tools. Set budgets, get alerts, and optimize for cost efficiency.

Cross-reference AI claims against source code, documentation, and known facts. Flag potentially fabricated function names, APIs, or configuration options.

Link AI-generated claims and suggestions to their source: which file, which commit, which documentation page informed each decision.

Save conversation state at decision points and branch to explore alternatives. Compare outcomes and merge the best approach.

Break complex tasks into smaller, parallelizable subtasks. Identify dependencies, estimate effort, and suggest execution order.

Validate MCP tool calls before execution: check parameters, verify permissions, estimate side effects. Dry-run mode available.

Give your agent persistent memory across sessions: learned patterns, user preferences, project conventions, past decisions.

Generate conventional commit messages from staged diffs. Analyze changes and produce semantic, descriptive messages.

Generate pull request descriptions from commit history and code diffs. Include summary, test plan, and breaking changes.

Automated code review against configurable standards: security, performance, accessibility, maintainability, test coverage.

Generate database migration scripts from schema diffs. Support for Prisma, Knex, TypeORM, Django, Alembic.

Auto-generate changelogs from git history, PR descriptions, and conventional commits. Output as CHANGELOG.md or JSON.

Analyze changes and suggest the correct version bump (major/minor/patch). Update package.json, tags, and references.

Identify stale, merged, and orphaned branches. Safe cleanup with dry-run mode and protection for active branches.

Install and manage git hooks: pre-commit, pre-push, commit-msg. Template library with common hooks for linting, testing, secrets scanning.

Understand monorepo structure: find affected packages from changes, resolve workspace dependencies, identify build order.

Generate user-facing release notes from technical changelogs. Transform developer commit messages into product updates.

Analyze and optimize Dockerfiles: multi-stage builds, layer caching, image size reduction, security best practices.

Generate docker-compose.yml from application analysis: detect databases, caches, message queues, and service dependencies.

Generate Nginx reverse proxy, SSL, and caching configurations from application requirements.

Check SSL certificate expiration, chain validity, and security configuration for domains and local certs.

Check port availability, find what's listening, and resolve port conflicts. Local-only scanning for development use.

Track CPU, memory, and disk usage of running processes. Detect resource leaks and runaway processes.

Find large files, duplicate files, and wasted space. Identify node_modules, build artifacts, and temp files consuming disk.

Validate cron expressions, show next N execution times, and convert between cron formats (Linux, AWS, Kubernetes).

Generate GitHub Actions workflows from project analysis: CI, CD, release automation, dependency updates.

Parse and analyze Terraform plans: highlight destructive changes, cost estimates, security implications.

Generate comprehensive README.md from code analysis: project structure, installation, usage, API docs, contributing guide.

Generate OpenAPI/Swagger specs from code, route handlers, and TypeScript types. Produce interactive API docs.

Add documentation comments to functions, classes, and interfaces. Infer parameter types, return values, and descriptions from code.

Generate Mermaid, PlantUML, and D2 diagrams from code: sequence diagrams, class diagrams, flowcharts, ER diagrams.

Create operational runbooks from code, configs, and infrastructure: incident response, deployment procedures, troubleshooting guides.

Create ADRs (Architecture Decision Records) with context, decision, consequences, and alternatives considered.

Build a project-specific glossary from code: extract domain terms, acronyms, and technical jargon with definitions.

Create new developer onboarding guides: setup instructions, codebase tour, key concepts, common tasks, and troubleshooting.

Categorize and prioritize errors from logs and stack traces. Identify root causes, frequency patterns, and affected code paths.

Profile Node.js, Python, and Go applications: identify CPU bottlenecks, memory hotspots, and slow database queries.

Detect memory leaks in Node.js applications: growing arrays, unclosed connections, event listener accumulation, circular references.

Monitor API endpoint health: response times, status codes, payload validation. Run locally against dev or staging environments.

Measure and track API response times over time. Generate percentile reports (p50, p95, p99) and identify degradation.

Generate reports on system resource usage: CPU, memory, disk, network. Track trends and set alerting thresholds.

Collect and search logs from multiple local services. Tail, filter, and correlate logs across processes.

Generate flame graphs from CPU profiles. Visualize where time is spent in your application with interactive SVG output.

Search the web from your agent. Currently uses Brave Search API.

Create PRs, manage issues, search code on GitHub. Requires GitHub API token.

Send messages, read channels, and manage Slack workspaces from your agent.

View issues, stack traces, and error trends from Sentry. Debug production errors with full context.

Read and write Notion pages, databases, and wikis. Sync project docs with your codebase.

Manage issues, projects, and sprints in Linear from your agent.

Read files from Google Drive, search documents, and sync specs with your project.

Manage Workers, KV, R2, D1, and DNS from your agent. Deploy and configure edge infrastructure.

Connect to PostgreSQL databases, run queries, inspect schemas, and manage data.

Generate images from text descriptions using AI image generation APIs.