# Anomity Catalog > Public, explainable risk profiles for AI tools, MCP servers, IDE extensions, plugins, skills, and WebMCP tools. Each entry is scored from declared trust, declared capabilities, and matched dangerous combinations. The full formula is published at https://catalog.anomity.ai/about. Every page has a Markdown twin: append `.md` to any entry URL, or send `Accept: text/markdown`. Source data: https://catalog.anomity.ai/feed.json (JSON Feed of recent entries) · https://catalog.anomity.ai/api/entries (paginated JSON) · https://catalog.anomity.ai/openapi.json (API description) · https://catalog.anomity.ai/sitemap.xml. ## Catalog entries ### AI Research Reproduction - URL: https://catalog.anomity.ai/skill/ai-research-reproduction - Markdown: https://catalog.anomity.ai/skill/ai-research-reproduction.md - Kind: Skill - Vendor: lllllllama - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://github.com/lllllllama Orchestrates end-to-end reproduction of a deep-learning repository — reading the README, setting up the environment, running training or evaluation, and tracking evidence of what actually ran. Capabilities are filesystem read and write, shell execution, and outbound network: the full-control combination, and correctly so. Reproducing research means executing code from a repository you did not write, with dependencies you did not audit, which is one of the most direct paths from "an agent read something" to "arbitrary code ran on this machine". Container it. ### Blender MCP - URL: https://catalog.anomity.ai/mcp/blender-mcp - Markdown: https://catalog.anomity.ai/mcp/blender-mcp.md - Kind: MCP server - Vendor: Blender community - Trust level: community - Risk score: 100 (critical) - Capabilities: shell:execute, filesystem:read, filesystem:write, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://github.com/ahujasid/blender-mcp An MCP server that connects an agent to Blender's Python API, letting a model create and modify 3D scenes, run geometry operations, and render — driving a desktop application through scripted commands. The capability that matters is that Blender's Python API is general-purpose Python. A server exposing it is effectively exposing code execution on the host, which is why this entry declares shell execution alongside filesystem access and outbound network — a combination Anomity flags as full control. That is not a criticism of the project, it is the honest shape of scripting-API bridges generally. Run it in a sandbox or a container, not on the workstation holding your signing keys. ### Claude Code for VS Code - URL: https://catalog.anomity.ai/extension/claude-code-for-vscode - Markdown: https://catalog.anomity.ai/extension/claude-code-for-vscode.md - Kind: IDE extension - Vendor: Anthropic - Trust level: official - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound, credentials:access - Dangerous combinations: Data exfiltration risk (high); Credential theft risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://docs.claude.com/en/docs/claude-code/ide-integrations Anthropic's extension that runs Claude Code inside VS Code — the same agent as the CLI, surfaced in the editor with inline diffs, a sidebar session, and the editor's own file context feeding the agent. The capability surface is that of a full coding agent rather than a completion tool: it reads and writes files across the workspace, runs shell commands through its Bash tool, reaches the network for model calls, and holds an API credential. That combination matches Anomity's full-control pattern, which is the honest description of any agent that can edit and execute. Anthropic-published, so it takes the official trust adjustment; the operational controls that matter are its permission prompts and allow-lists, which should not be blanket-approved on repositories that hold production credentials. ### Cline - URL: https://catalog.anomity.ai/extension/cline - Markdown: https://catalog.anomity.ai/extension/cline.md - Kind: IDE extension - Vendor: Cline - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound, credentials:access - Dangerous combinations: Data exfiltration risk (high); Credential theft risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://cline.bot Cline is an autonomous coding agent that runs inside VS Code and takes the IDE far beyond autocomplete. Once approved, it can read and edit files across your repository, execute shell commands in the integrated terminal, browse the web, and call external tools through MCP servers — all while showing each step for human approval. The project is open source, published on the VS Code Marketplace, and updated frequently by a community-led team. From a capability standpoint, the extension declares full filesystem read and write access, shell execution inside the workspace, outbound network access to its model provider (Anthropic, OpenAI, OpenRouter, Bedrock, Vertex, and local models), and access to your stored API credentials. Combined, those capabilities are powerful enough to refactor a service, install dependencies, and ship a PR without leaving the editor. The risk profile reflects that surface area. Cline is community-maintained rather than vendor-published, which lowers its trust adjustment. The pairing of shell execution with outbound network access matches Anomity's data-exfiltration combination, and filesystem write paired with credential access matches the credential-theft combination. Teams that adopt Cline should pair it with allow-listed commands, scoped credentials, and a strict approval workflow rather than the agent's auto-approve mode. ### Everything Claude Code - URL: https://catalog.anomity.ai/plugin/everything-claude-code - Markdown: https://catalog.anomity.ai/plugin/everything-claude-code.md - Kind: Plugin - Vendor: affaan-m - Trust level: unknown - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://github.com/affaan-m A very large community bundle — reported at 64 specialised agents, 261 skills, and 84 commands — spanning TDD, code review, security auditing, deployment, and general automation, plus hooks that wire them into the session. Scale is the whole risk story. A bundle of this size cannot realistically be read before installation, and it brings hundreds of instruction files plus hooks that execute on events into an agent that can already write files and run commands. It declares filesystem read and write, shell execution, and outbound network. Nothing here is inherently malicious, but the review burden is real: installing it is trusting a large surface authored by many hands, and the catalog scores it accordingly. ### Kilo Code - URL: https://catalog.anomity.ai/extension/kilo-code - Markdown: https://catalog.anomity.ai/extension/kilo-code.md - Kind: IDE extension - Vendor: Kilo Code - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound, credentials:access - Dangerous combinations: Data exfiltration risk (high); Credential theft risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://kilocode.ai Kilo Code is a multi-model AI coding assistant for VS Code that combines the agentic execution loop pioneered by Cline and Roo Code with first-class MCP server integration and a marketplace of curated workflows. It supports OpenAI, Anthropic, Google, Mistral, local Ollama models, and any OpenAI-compatible endpoint, letting teams route different tasks to different models from a single extension. In day-to-day use, Kilo Code reads files anywhere in the open workspace, writes edits across multiple files in a single turn, executes shell commands through the integrated terminal, calls out to model providers and MCP servers over the network, and stores provider credentials in the VS Code secret store. Each tool invocation can be configured to require explicit approval, batched approval, or full auto-approve. Kilo Code is community-maintained, and the combination of shell execution plus outbound network and filesystem write plus credentials access matches both Anomity's data-exfiltration and credential-theft dangerous combinations. The recommended controls are workspace-only credential scopes, allow-listed shell commands, and turning on per-tool approval rather than auto-approve for any agent that has internet access. ### OpenAI Codex for VS Code - URL: https://catalog.anomity.ai/extension/openai-codex-vscode - Markdown: https://catalog.anomity.ai/extension/openai-codex-vscode.md - Kind: IDE extension - Vendor: OpenAI - Trust level: official - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound, credentials:access - Dangerous combinations: Data exfiltration risk (high); Credential theft risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://developers.openai.com/codex/ide OpenAI's Codex extension brings its coding agent into VS Code, letting a developer delegate a task, watch the agent work through it in the editor, and review the resulting diff — with the option to hand work off to a cloud-executed session. Like any agentic extension it reads and writes the workspace, executes commands, calls the model service, and holds credentials. The cloud-execution path is the part that deserves specific attention in a review: work that runs remotely means repository contents are processed outside the developer's machine, which is a different data-flow answer than a purely local agent and one that a code-residency policy will have opinions about. ### Refact.ai - URL: https://catalog.anomity.ai/extension/refact-ai - Markdown: https://catalog.anomity.ai/extension/refact-ai.md - Kind: IDE extension - Vendor: Refact.ai - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://refact.ai Refact.ai is an open-source AI coding assistant offering completion, chat, and an agent mode, with a self-hosted server option so the models can run inside your own infrastructure. In self-hosted mode it reads and writes the workspace and executes commands in agent mode without sending code to a third party. The catalogued capabilities reflect the agentic configuration — filesystem read and write plus shell execution, with network access to whichever model endpoint is configured. Self-hosting removes the data-residency question but not the agent question: an agent that can edit and execute locally is still an agent that can edit and execute. ### Roo Code - URL: https://catalog.anomity.ai/extension/roo-code - Markdown: https://catalog.anomity.ai/extension/roo-code.md - Kind: IDE extension - Vendor: Roo Code - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound, credentials:access - Dangerous combinations: Data exfiltration risk (high); Credential theft risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://roocode.com Roo Code is an open-source AI coding agent for VS Code, originally forked from Cline and now developed independently with expanded provider support, more granular permission modes, and a community focused on configurability. Like its upstream, Roo Code can drive an entire feature end-to-end: planning a change, editing files in batches, running tests in the terminal, and reaching out to MCP servers for additional tools. The extension's declared capabilities span filesystem read and write across the workspace, shell execution for builds and tests, outbound network connections to the configured LLM provider, and access to provider API keys and tokens stored in the secret store. Operators can install custom "modes" that further widen or narrow that surface — for example, an architect mode that can plan but not execute, or a code mode with the full toolbelt. Because Roo Code is community-maintained and inherits the shell + network + credentials trio, it triggers both the data-exfiltration and credential-theft dangerous combinations in Anomity's catalog. The recommended posture is to enable the most restrictive mode that meets the team's need, restrict tools at the MCP server level, and avoid running it under accounts that hold production credentials. ### Tons of Skills Marketplace - URL: https://catalog.anomity.ai/plugin/tons-of-skills - Markdown: https://catalog.anomity.ai/plugin/tons-of-skills.md - Kind: Plugin - Vendor: jeremylongshore - Trust level: unknown - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://tonsofskills.com An open-source marketplace distributing several hundred plugins and thousands of skills for Claude Code, with a CLI package manager (`ccpi`) for installing them — effectively a package ecosystem layered on top of the plugin mechanism. A package manager for agent instructions is exactly as significant as a package manager for code, and deserves the same scrutiny that npm eventually earned. Installing through it fetches and places instruction files that the agent will follow, so it declares filesystem read and write, shell execution, and outbound network. The questions to ask are the familiar supply-chain ones: who can publish, what is reviewed, and can a published skill be changed after you installed it. ### webmcpify - URL: https://catalog.anomity.ai/webmcp/webmcpify - Markdown: https://catalog.anomity.ai/webmcp/webmcpify.md - Kind: WebMCP tool - Vendor: TueJon - Trust level: community - Risk score: 100 (critical) - Capabilities: filesystem:read, filesystem:write, shell:execute, network:outbound - Dangerous combinations: Data exfiltration risk (high); Persistence + execution risk (medium); Full-control risk (critical) - Website: https://github.com/tuejon/webmcpify webmcpify is an agent skill that takes an existing web application, inventories what it does, proposes a WebMCP tool surface for it, then implements and verifies those tools. It is a code-generation workflow rather than a runtime component: you point an agent at your app and it writes the registrations. The capability profile follows from that. It reads and writes files in the repository it is applied to, runs commands to verify its work, and reaches the network for model calls — the combination Anomity flags as a full-control pattern, which is normal for any coding agent skill and is why it belongs behind review rather than autopilot. The output deserves a second look too: an agent deciding which of your app's operations should become agent-callable is a security design decision being made by a model. ### Browser Act - URL: https://catalog.anomity.ai/skill/browser-act - Markdown: https://catalog.anomity.ai/skill/browser-act.md - Kind: Skill - Vendor: browser-act - Trust level: unknown - Risk score: 95 (critical) - Capabilities: shell:execute, browser:control, network:outbound - Dangerous combinations: Data exfiltration risk (high) - Website: https://github.com/browser-act A CLI for browser automation that includes stealth features and CAPTCHA solving, aimed at driving sites that actively resist automation. It runs as a command-line tool controlling a browser and reaching the network, so it declares shell execution, browser control, and outbound network — a combination that scores high in this catalog. CAPTCHA solving is worth naming plainly: it exists to defeat a control the site operator deliberately put in place, and building it into an agent stack is a choice about what that agent is for. ### Blackbox AI - URL: https://catalog.anomity.ai/extension/blackbox-ai - Markdown: https://catalog.anomity.ai/extension/blackbox-ai.md - Kind: IDE extension - Vendor: Blackbox - Trust level: unknown - Risk score: 80 (critical) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://blackbox.ai Blackbox AI is an AI code-search and chat extension that markets itself as an all-in-one developer assistant — autocomplete, chat with the codebase, code-to-image search, and a browser companion. It is one of the higher-installed extensions in the AI category on the VS Code Marketplace, but it is also the entry in Anomity's catalog with the most opaque trust posture: the underlying model and the routing of user prompts are not publicly documented in detail, the vendor's privacy policy has shifted multiple times, and independent audits of what the extension transmits are not readily available. Declared capabilities include reading files in the open workspace to construct prompts, making outbound network requests to Blackbox's hosted backend, and reading and writing credentials stored in the IDE for the user's Blackbox account. It does not declare filesystem write or shell execution. Blackbox AI is assigned the unknown trust level in the catalog — the highest trust adjustment — because the publisher's identity is not verifiable to the level of an official marketplace vendor and because the closed backend means the actual data flow cannot be confirmed from the outside. Combined with the credentials + outbound network signal, this is the kind of extension that should be evaluated carefully before installation on machines with access to proprietary code. ### ClawHub - URL: https://catalog.anomity.ai/plugin/clawhub - Markdown: https://catalog.anomity.ai/plugin/clawhub.md - Kind: Plugin - Vendor: ClawHub - Trust level: unknown - Risk score: 80 (critical) - Capabilities: filesystem:write, network:outbound - Website: https://clawhub.dev ClawHub is a public registry for Claude Code plugins — a central index where authors publish and users discover plugins, described by its community as npm for agent skills. It is catalogued as ecosystem infrastructure rather than as a plugin you install for a task. Its declared capabilities are outbound network access for the registry API plus the filesystem writes involved in installing what it distributes. Registries concentrate risk by design: they are the single point where a compromise reaches everyone downstream, which is an argument for pinning versions and for preferring plugins whose source you can read over ones you discover by search rank. ### Continue - URL: https://catalog.anomity.ai/extension/continue - Markdown: https://catalog.anomity.ai/extension/continue.md - Kind: IDE extension - Vendor: Continue - Trust level: community - Risk score: 75 (high) - Capabilities: filesystem:read, filesystem:write, network:outbound, credentials:access - Dangerous combinations: Credential theft risk (high) - Website: https://continue.dev Continue is an open-source IDE extension that brings autocomplete, chat, and inline edits to VS Code and JetBrains using any LLM provider or local model. It's distributed on the VS Code Marketplace and JetBrains Marketplace, with the core engine published under an Apache 2.0 license, so teams can self-host the model layer and audit what the extension does on disk. Its declared capabilities include reading files in the open workspace and across configured context providers, writing edits back into source files when the user accepts a suggestion, making outbound network requests to the configured model and embedding providers, and accessing credentials stored in the IDE secret store. Continue does not request shell execution by default, which gives it a notably smaller blast radius than the fully-agentic extensions in the same category. From a risk standpoint, the extension is community-maintained and pairs filesystem write with credentials access — enough to match the credential-theft dangerous combination — but lacks the shell-execute capability that would push it into exfiltration territory. Teams adopting Continue should restrict its model providers to vetted endpoints and avoid pointing it at credentials that are not scoped to the developer's workstation. ### Sourcegraph Cody - URL: https://catalog.anomity.ai/extension/sourcegraph-cody - Markdown: https://catalog.anomity.ai/extension/sourcegraph-cody.md - Kind: IDE extension - Vendor: Sourcegraph - Trust level: community - Risk score: 75 (high) - Capabilities: filesystem:read, filesystem:write, network:outbound, credentials:access - Dangerous combinations: Credential theft risk (high) - Website: https://sourcegraph.com/cody Cody is Sourcegraph's AI coding assistant, distinguished from peers by tight integration with the Sourcegraph code-graph platform — it can pull context from any repository indexed by a Sourcegraph instance, not only the file currently open. That makes it particularly effective on large monorepos and across services owned by different teams. It is distributed for VS Code, JetBrains, and the Sourcegraph web app. Declared capabilities include reading workspace files, writing edits back to files when the developer accepts a suggestion, making outbound network requests to either Sourcegraph's hosted Cody service or a self-hosted Sourcegraph instance, and accessing the user's Sourcegraph and provider API credentials. Shell execution is not requested by the extension itself, though some agent workflows in newer versions can run commands when explicitly opted in. Cody is community trust in the catalog because Sourcegraph is not a marketplace-publisher trust authority. The combination of filesystem write plus credential access matches the credential-theft dangerous combination; the recommended posture is to use a workspace-scoped Sourcegraph account, prefer the self-hosted deployment for sensitive codebases, and review which repositories are indexed before granting Cody access. ### Anti-Detect Browser - URL: https://catalog.anomity.ai/skill/anti-detect-browser - Markdown: https://catalog.anomity.ai/skill/anti-detect-browser.md - Kind: Skill - Vendor: antibrow - Trust level: unknown - Risk score: 70 (high) - Capabilities: browser:control, network:outbound - Website: https://github.com/antibrow Launches browsers with distinct fingerprints so multiple accounts can be operated without the sites involved correlating them — built for multi-account automation. It declares browser control and outbound network. This is the entry in the catalog where the risk is mostly about you rather than to you: evading fingerprinting is typically a terms-of-service violation on the target platform, and automating multiple accounts is prohibited outright by many. The technical capability is ordinary browser control; the exposure is account bans and, depending on jurisdiction and use, worse. Catalogued so that its presence in a stack is a deliberate decision. ### Superpowers - URL: https://catalog.anomity.ai/plugin/superpowers - Markdown: https://catalog.anomity.ai/plugin/superpowers.md - Kind: Plugin - Vendor: obra - Trust level: community - Risk score: 65 (high) - Capabilities: filesystem:read, filesystem:write, shell:execute - Dangerous combinations: Persistence + execution risk (medium) - Website: https://github.com/obra/superpowers Superpowers is a community-maintained Claude Code plugin that ships a curated library of skills — short, structured workflows that the Claude Code agent follows for common engineering tasks like brainstorming, test-driven development, systematic debugging, finishing a development branch, and dispatching parallel agents. Once installed, the plugin auto-discovers its skills and exposes them through the standard Claude Code skill-invocation mechanism, so the agent can pick up the right one for the work at hand without the user having to remember command names. Functionally, Superpowers reads files in the active project to determine context for each skill, writes edits, commits, and new files when the executing skill asks the agent to, and shells out to git, package managers, test runners, and other developer tools through the Claude Code Bash tool. It does not need separate credentials of its own — it inherits whatever Claude Code is already authorized to do — and it does not make network requests beyond what the underlying agent makes. Superpowers is community trust because it is an independent open-source project rather than an official Anthropic plugin. The combination of filesystem write and shell execution lights up several risk signals in the catalog; the recommended posture is to review the bundled skill set before enabling auto-execution and to constrain the plugin's repository scope to the projects where its workflows are actively wanted. ### Superpowers 2 - URL: https://catalog.anomity.ai/plugin/superpowers-2 - Markdown: https://catalog.anomity.ai/plugin/superpowers-2.md - Kind: Plugin - Vendor: obra - Trust level: community - Risk score: 65 (high) - Capabilities: filesystem:read, filesystem:write, shell:execute - Dangerous combinations: Persistence + execution risk (medium) - Website: https://github.com/obra/superpowers The second-generation Superpowers plugin bundles skills together with hooks that enforce a structured test-driven workflow — parallel task execution, code review, and root-cause debugging — rather than leaving the agent to choose whether to follow the process. Hooks are the meaningful difference from a plain skill library. A hook fires on an event such as a file write or session start, which means part of the plugin runs without the agent deciding to invoke it. That is what makes the workflow stick, and also what makes review important: a hook is code that executes on your machine on a trigger you did not explicitly approve each time. It declares filesystem read and write plus shell execution, inheriting the host agent's authority. ### Szum-Tech Claude Plugins - URL: https://catalog.anomity.ai/plugin/szum-tech-claude-plugins - Markdown: https://catalog.anomity.ai/plugin/szum-tech-claude-plugins.md - Kind: Plugin - Vendor: JanSzewczyk - Trust level: community - Risk score: 65 (high) - Capabilities: filesystem:read, filesystem:write, shell:execute - Dangerous combinations: Persistence + execution risk (medium) - Website: https://github.com/JanSzewczyk/claude-plugins A focused marketplace collection of roughly 10 agents and 25 skills covering Next.js, testing, Firebase, product management, and AI tool workflows — curated for a specific stack rather than attempting general coverage. Small, opinionated bundles are the easier end of this category to review: 25 skills can actually be read before use, which is not true of the thousand-skill marketplaces. It declares filesystem read and write plus shell execution, inheriting the agent's authority. For teams standardising on the covered stack, a bundle of this size is the sensible middle ground between writing every skill yourself and installing everything. ### Using Git Worktrees - URL: https://catalog.anomity.ai/skill/using-git-worktrees - Markdown: https://catalog.anomity.ai/skill/using-git-worktrees.md - Kind: Skill - Vendor: obra/superpowers - Trust level: community - Risk score: 65 (high) - Capabilities: filesystem:read, filesystem:write, shell:execute - Dangerous combinations: Persistence + execution risk (medium) Using Git Worktrees is a workspace-management skill from the Superpowers plugin that creates isolated git worktrees for feature work, keeping each branch in its own directory rather than constantly stashing and switching in a single checkout. It is intended for any task that needs isolation from the current workspace state — running a long-form refactor while continuing to ship hotfixes from main, executing an implementation plan in parallel with other work, or letting the agent operate without disturbing the user's local edits. Functionally, the skill reads the current repository state to determine where to base the new worktree, writes a new worktree directory plus tracking metadata, and shells out to git through the Claude Code Bash tool to create, list, and clean up worktrees. It does not request network or credential access. The skill is community trust and uses three declared capabilities — filesystem read, filesystem write, and shell execute. Shell execution is the one that lights up the larger risk signal, but because the shell calls are scoped to git operations and the skill is part of a well-known plugin, the practical risk is contained. It does match one half of the data-exfiltration dangerous combination on its own; the combination only activates when the running agent also has outbound network access. ### aiXcoder - URL: https://catalog.anomity.ai/extension/aixcoder - Markdown: https://catalog.anomity.ai/extension/aixcoder.md - Kind: IDE extension - Vendor: aiXcoder - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write - Website: https://www.aixcoder.com aiXcoder offers code completion for VS Code and JetBrains with an emphasis on deployable-on-premises models, aimed at organisations that want assistance without source code leaving their network. In its local deployment the extension reads the workspace and writes accepted completions without outbound network access — a genuinely different risk profile from cloud assistants, and the reason it appears in procurement shortlists for regulated environments. The catalogued capability set reflects the local configuration; a hosted deployment adds outbound network and should be scored as such. Verify which mode is actually configured, because the difference is the entire security argument. ### Augment - URL: https://catalog.anomity.ai/extension/augment - Markdown: https://catalog.anomity.ai/extension/augment.md - Kind: IDE extension - Vendor: Augment Code - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://augmentcode.com Augment is an enterprise-focused AI coding assistant whose pitch centers on continuous, full-repository codebase indexing. Instead of feeding a model only the file currently open, Augment maintains a dense semantic index of the entire codebase and feeds the most relevant snippets into every completion, chat, or refactor — which becomes especially valuable on large, polyglot monorepos. The extension reads files across the open workspace and across any repositories the team has connected to Augment's index, makes outbound network requests to Augment's hosted service for completions, chat, and indexing pushes, and stores credentials for the user's Augment account in the IDE secret store. It does not request filesystem write or shell execute permissions, which makes its declared attack surface narrower than the fully agentic coding extensions. Augment is community trust in Anomity's catalog because it is an independent vendor rather than a marketplace platform. The active risk signals come from the credential + outbound network pairing, which is the standard cost of any SaaS coding assistant. Teams adopting Augment should validate the vendor's data-handling and code-residency terms — the value of full-repo indexing comes with the cost of transmitting all of that code to the vendor. ### Best Practices - URL: https://catalog.anomity.ai/skill/web-best-practices - Markdown: https://catalog.anomity.ai/skill/web-best-practices.md - Kind: Skill - Vendor: addyosmani - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write - Website: https://github.com/addyosmani Applies modern web development practices across security, performance, and code quality — the accumulated "you should probably not do that" knowledge that rarely makes it into a linter rule. It reads and writes project files. Its usefulness depends on how current the encoded guidance is: web platform advice ages quickly, and a skill recommending a pattern that was correct three years ago is worse than no skill, because it arrives with apparent authority. Check the last update date before relying on it for security guidance specifically. ### Bito - URL: https://catalog.anomity.ai/extension/bito - Markdown: https://catalog.anomity.ai/extension/bito.md - Kind: IDE extension - Vendor: Bito - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://bito.ai Bito provides AI chat, code explanation, test generation, and an AI code review agent inside VS Code and JetBrains, positioned around review and comprehension as much as generation. It reads the workspace, writes generated code and tests when accepted, and calls its hosted service, so it declares filesystem read and write plus outbound network. Test generation is the feature worth a caveat: generated tests that pass against current behaviour lock in that behaviour, bugs included, which is useful as a regression harness and misleading as evidence of correctness. ### Check - URL: https://catalog.anomity.ai/skill/check-review - Markdown: https://catalog.anomity.ai/skill/check-review.md - Kind: Skill - Vendor: tw93 - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, shell:execute - Website: https://github.com/tw93 Reviews code diffs, pull requests, and overall release readiness — pulling the change under review and reporting what looks risky before it ships. It reads the repository and runs git and build commands, so it declares filesystem read and shell execution. Review skills are among the highest-value low-risk uses of an agent, because the output is advisory: a wrong finding costs a minute of human attention, where a wrong edit costs a debugging session. Keep it advisory — resist the version that fixes what it finds. ### Code Simplifier - URL: https://catalog.anomity.ai/plugin/code-simplifier - Markdown: https://catalog.anomity.ai/plugin/code-simplifier.md - Kind: Plugin - Vendor: community - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write Code Simplifier is a community-maintained Claude Code plugin focused on post-implementation code quality. Once the agent finishes a feature or fix, the plugin's review skill walks the changed files looking for opportunities to reuse existing utilities, eliminate dead branches, collapse near-duplicate code paths, and tighten error handling — then either suggests the cleanups for review or applies them in place depending on the user's preference. Functionally, the plugin reads files across the active project to identify reusable utilities and dead code, and writes edits back when the user accepts a cleanup. It does not request shell execution, outbound network access, or credentials, and it inherits any project conventions the agent is already aware of rather than enforcing its own opinions. The plugin is community trust because it is published by an independent maintainer rather than by Anthropic. The active risk signals come from filesystem read and write — the minimum surface for any plugin that edits source — and do not match any dangerous combination in the catalog. The residual concern is the standard one for code-modification plugins: review the diff before merging, especially when the plugin runs autonomously after a feature implementation. ### CodeGeeX - URL: https://catalog.anomity.ai/extension/codegeex - Markdown: https://catalog.anomity.ai/extension/codegeex.md - Kind: IDE extension - Vendor: Zhipu AI - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://codegeex.cn CodeGeeX is a multilingual code generation and completion extension from Zhipu AI, available for VS Code and JetBrains, with strong support for Chinese-language prompts and comments alongside English. It reads workspace files for context, inserts accepted completions, and sends context to its hosted service, so it declares filesystem read and write with outbound network access. The relevant consideration for most enterprise reviewers is data residency: context is processed by infrastructure in a jurisdiction that may sit outside their approved list, which is a compliance question rather than a code-quality one and is best answered before rollout rather than during an audit. ### Marketing Skills - URL: https://catalog.anomity.ai/plugin/marketing-skills - Markdown: https://catalog.anomity.ai/plugin/marketing-skills.md - Kind: Plugin - Vendor: coreyhaines31 - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://github.com/coreyhaines31 A domain bundle installing a full set of marketing skills — around 48 of them — covering paid acquisition, SEO, lifecycle email, analytics, and positioning, so a single install equips an agent for marketing work rather than engineering. Its capability profile is unusually light for a plugin: most of these skills are process and copy rather than automation, so the bundle declares filesystem read and write for the documents it produces, with outbound network for the research-oriented skills. It is a useful catalog data point that not every plugin is a code-execution risk — a bundle's score should follow what its skills actually touch, and this one touches drafts. ### Pieces for Developers - URL: https://catalog.anomity.ai/extension/pieces-for-developers - Markdown: https://catalog.anomity.ai/extension/pieces-for-developers.md - Kind: IDE extension - Vendor: Pieces - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://pieces.app Pieces captures snippets, context, and workflow history into a local repository an assistant can draw on, with a long-term memory feature that records what you were working on across applications. It reads and writes local storage and reaches the network for model calls, so it declares filesystem read and write with outbound network. The memory feature is the reason it is worth reviewing carefully rather than installing casually: a tool that continuously records developer activity across applications builds a detailed corpus of what was on screen, which is valuable to the developer and would be equally valuable to an attacker who reached the machine. ### Qodo (Codium) - URL: https://catalog.anomity.ai/extension/qodo - Markdown: https://catalog.anomity.ai/extension/qodo.md - Kind: IDE extension - Vendor: Qodo - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://qodo.ai Qodo, formerly known as CodiumAI, is an AI extension focused on test generation and automated code review rather than the general chat-and-completion category. Inside the IDE it reads the function the developer is working on, proposes a set of behavioral tests, and surfaces likely edge-case failures; in the pull request flow it leaves contextual review comments on changed code through a companion GitHub app. Declared capabilities include reading files in the open workspace to gather context for test generation and review, making outbound network requests to Qodo's hosted service for model inference, and accessing the user's Qodo and provider credentials stored in the IDE secret store. The extension does not request filesystem write or shell execute permissions — generated tests are inserted by the IDE on acceptance, and any test execution happens through the user's own commands. Qodo is community trust because it is an independent vendor. The credential plus outbound network pairing produces a routine risk signal but does not match any dangerous combination. The notable cost is the same as any SaaS coding assistant: the source code being reviewed is transmitted to the vendor on each request, so teams in regulated environments should validate the data-handling agreement before rollout. ### Sourcery - URL: https://catalog.anomity.ai/extension/sourcery - Markdown: https://catalog.anomity.ai/extension/sourcery.md - Kind: IDE extension - Vendor: Sourcery - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://sourcery.ai Sourcery reviews and refactors code in the editor, originally focused on Python and later broadened, suggesting concrete simplifications with a preview of the rewritten form rather than a general comment. It reads project files and applies refactors on acceptance, so it declares filesystem read and write, with outbound network for its hosted analysis. Mechanical refactoring is a good fit for automation because the transformations are behaviour-preserving by construction — the risk is the accumulation of many small accepted changes in a single commit, which is hard to review as a unit. Keep refactor commits separate from behavioural ones. ### Supermaven - URL: https://catalog.anomity.ai/extension/supermaven - Markdown: https://catalog.anomity.ai/extension/supermaven.md - Kind: IDE extension - Vendor: Supermaven - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://supermaven.com Supermaven is an AI code completion extension that is built around a custom model designed for very low latency and a context window large enough to feed entire repositories. It targets VS Code, JetBrains, Neovim, and a handful of other editors, and is one of the few extensions in the autocomplete category that markets sub-100ms response times as a primary differentiator. Its declared capabilities are deliberately narrow for a category that often over-asks. The extension reads files in the open workspace to assemble context for completions, makes outbound network requests to Supermaven's hosted completion service, and reads the locally stored Supermaven credential. It does not request filesystem write access — the IDE handles insertion of accepted suggestions — and does not execute shell commands. Supermaven is community trust because it is published by an independent vendor rather than a marketplace platform. The credential plus outbound network pairing is the only one that lights up Anomity's risk signals, and it does not match any dangerous combination. The residual concern is the standard one for hosted-completion products: source code from your workspace is transmitted to the vendor on every request, so teams under confidentiality controls should validate Supermaven's data-handling terms before adopting it broadly. ### Tabby - URL: https://catalog.anomity.ai/extension/tabby - Markdown: https://catalog.anomity.ai/extension/tabby.md - Kind: IDE extension - Vendor: TabbyML - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://tabby.tabbyml.com Tabby is a self-hosted, open-source coding assistant: you run the inference server, and the editor extensions for VS Code, JetBrains, and Vim talk to it. No code reaches a vendor because there is no vendor endpoint. The extension reads workspace context and writes accepted completions, talking to a server you control. That makes it one of the lowest-risk assistants in the catalog for organisations whose main concern is code leaving the perimeter. The trade-offs are operational rather than security-related — you own the GPU, the model updates, and the uptime — and the honest note is that self-hosted models generally trail hosted frontier models in suggestion quality. ### Tabnine - URL: https://catalog.anomity.ai/extension/tabnine - Markdown: https://catalog.anomity.ai/extension/tabnine.md - Kind: IDE extension - Vendor: Tabnine - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://tabnine.com Tabnine is one of the original AI code completion extensions, predating most of its current competitors and notable for offering both cloud-hosted and fully on-premises deployment models. It supports VS Code, JetBrains IDEs, Visual Studio, Neovim, Eclipse, and several other editors, and ships with enterprise features around codebase indexing, single-tenant deployment, and air-gapped model hosting. The extension reads source files in the open workspace to assemble context for completions and chat, makes outbound network requests to Tabnine's hosted model or to a self-hosted Tabnine endpoint, and accesses stored credentials for the user's Tabnine account. It does not request filesystem write access for completions — accepted suggestions are inserted by the IDE itself — and does not execute shell commands. Tabnine is a community trust level in Anomity's catalog because it is not a marketplace-first-party vendor. The credential + outbound network pairing is shared with most coding assistants and is not by itself a dangerous combination, but teams with strict data-handling requirements should evaluate the self-hosted plan rather than the SaaS one. ### Test-Driven Development - URL: https://catalog.anomity.ai/skill/test-driven-development - Markdown: https://catalog.anomity.ai/skill/test-driven-development.md - Kind: Skill - Vendor: obra/superpowers - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write Test-Driven Development is a rigid process skill from the Superpowers plugin that enforces a strict red-green-refactor loop for any feature implementation or bug fix. Before the agent is allowed to write production code, the skill requires it to write a failing test that captures the desired behavior, watch that test fail for the right reason, write the minimum implementation that makes the test pass, and only then refactor with the test still passing as a guardrail. Functionally, the skill reads existing test and source files to find the right place for new tests and code, and writes new test files plus implementation files as the agent moves through the loop. It does not request shell execution — the test runs themselves go through the Claude Code Bash tool — and it does not request network or credential access. The skill is community trust because it ships in an independent plugin. The active risk signals come from filesystem read and write, the minimum surface for any skill that produces tests and code, and do not match any dangerous combination. The notable property of the skill is not its capability surface but its discipline: it actively prevents agents from skipping the test step when the underlying task is harder than expected. ### Twinny - URL: https://catalog.anomity.ai/extension/twinny - Markdown: https://catalog.anomity.ai/extension/twinny.md - Kind: IDE extension - Vendor: twinnydotdev - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://twinny.dev Twinny is a free, open-source VS Code extension providing completion and chat against locally-run models via Ollama or any OpenAI-compatible endpoint, with no account and no telemetry by default. It reads the workspace and writes accepted completions, reaching only the local or configured endpoint. Pointed at a local model it is about as private as an AI assistant gets, and its risk score reflects a genuinely small surface. The caveat is trust in the package rather than the model: it is a community extension whose updates arrive through the marketplace, and an extension with workspace write access is a meaningful supply-chain position — pin versions where that matters. ### Writing Skills - URL: https://catalog.anomity.ai/skill/writing-skills - Markdown: https://catalog.anomity.ai/skill/writing-skills.md - Kind: Skill - Vendor: obra/superpowers - Trust level: community - Risk score: 50 (medium) - Capabilities: filesystem:read, filesystem:write Writing Skills is the meta-skill from the Superpowers plugin: it is the skill the agent uses when the task is to create a new skill, edit an existing skill, or verify a skill works before it ships. It encodes the structure that every other Superpowers skill follows — frontmatter, description, trigger conditions, body content, and any associated reference material — and provides the verification steps that confirm a new skill is wired into the plugin correctly. Functionally, the skill reads existing skills as examples and templates and writes new or edited skill files into the plugin's skill directory. It does not request shell execution, network access, or credentials, and it does not invoke other skills — it produces them. The skill is community trust and declares only filesystem read and write capabilities, which produce a routine risk signal and do not match any dangerous combination. Its practical importance is structural: because every other Superpowers skill is created through this skill, it is the right place to validate conventions, enforce naming, and catch trigger-condition mistakes that would otherwise cause a new skill to silently never activate. ### Airtable MCP Server - URL: https://catalog.anomity.ai/mcp/airtable-mcp-server - Markdown: https://catalog.anomity.ai/mcp/airtable-mcp-server.md - Kind: MCP server - Vendor: Airtable - Trust level: official - Risk score: 45 (medium) - Capabilities: network:outbound, credentials:access, database:read, database:write - Dangerous combinations: Database exfiltration risk (high) - Website: https://airtable.com/developers/web/api/introduction Airtable's official server exposes bases, tables, and records so an agent can query structured operational data and create or update rows. Declared capabilities are outbound network access, credential access, and database reads and writes over the base contents. Airtable's role in most organisations — the place a team put the thing that was too important for a spreadsheet and too small for a database — means bases often hold operational data with no schema review and no access review behind them. Scope a token to a single base, and prefer read access unless a workflow genuinely needs to write. ### Amazon Q Developer - URL: https://catalog.anomity.ai/extension/amazon-q-developer - Markdown: https://catalog.anomity.ai/extension/amazon-q-developer.md - Kind: IDE extension - Vendor: Amazon Web Services - Trust level: official - Risk score: 45 (medium) - Capabilities: filesystem:read, filesystem:write, network:outbound, credentials:access - Dangerous combinations: Credential theft risk (high) - Website: https://aws.amazon.com/q/developer/ Amazon Q Developer is AWS's AI coding assistant, shipping as an extension for VS Code, JetBrains IDEs, and Visual Studio. It offers inline completion, chat over your workspace, an agentic mode that can implement multi-file changes, and AWS-specific abilities such as explaining a CloudFormation template or upgrading a Java runtime across a codebase. Its distinguishing capability is the cloud connection: signed in with AWS credentials, it can read account context and act against AWS APIs, which is materially broader than a code-completion extension. Combined with workspace reads and writes and outbound calls to the model service, that puts it in the higher band of this catalog. The upgrade and transformation features in particular make sweeping automated edits — review those as you would a large refactor PR, and scope the IAM role it authenticates with rather than reusing an administrator profile. ### Azure Deploy - URL: https://catalog.anomity.ai/skill/azure-deploy - Markdown: https://catalog.anomity.ai/skill/azure-deploy.md - Kind: Skill - Vendor: Microsoft - Trust level: official - Risk score: 45 (medium) - Capabilities: shell:execute, credentials:access, network:outbound - Dangerous combinations: Data exfiltration risk (high) - Website: https://github.com/microsoft Microsoft's skill for executing Azure deployments with validation and error recovery — provisioning resources, handling partial failures, and retrying with corrected parameters rather than stopping at the first error. It runs deployment commands, holds cloud credentials, and reaches the network, so it declares shell execution, credential access, and outbound network. Shell plus network is Anomity's exfiltration pattern, and the credentials in play are cloud-plane credentials — which is to say this is one of the highest-consequence skills in the catalog, and the one most deserving of a human approving each run rather than a standing grant. ### Azure Diagnostics - URL: https://catalog.anomity.ai/skill/azure-diagnostics - Markdown: https://catalog.anomity.ai/skill/azure-diagnostics.md - Kind: Skill - Vendor: Microsoft - Trust level: official - Risk score: 45 (medium) - Capabilities: shell:execute, credentials:access, network:outbound - Dangerous combinations: Data exfiltration risk (high) - Website: https://github.com/microsoft Diagnoses and remediates Azure production issues systematically — reading resource health, correlating logs, and proposing or applying fixes for common failure modes. Capabilities are shell execution, credential access, and outbound network. The remediation half is what makes it more than a reporting tool and more than a read-only risk: a skill that can change production configuration during an incident is operating at the moment when review is least likely to happen. Prefer running it in diagnose-only mode and letting a human apply the change. ### Cloudflare MCP Server - URL: https://catalog.anomity.ai/mcp/cloudflare-mcp-server - Markdown: https://catalog.anomity.ai/mcp/cloudflare-mcp-server.md - Kind: MCP server - Vendor: Cloudflare - Trust level: official - Risk score: 45 (medium) - Capabilities: network:outbound, credentials:access, database:read, database:write - Dangerous combinations: Database exfiltration risk (high) - Website: https://developers.cloudflare.com/agents/model-context-protocol/ Cloudflare ships a family of remote MCP servers covering Workers, KV, R2, D1, DNS, Workers Logs, and account APIs. An agent can read observability data, query a D1 database, inspect DNS records, or deploy a Worker, depending on which server and scopes are connected. This is infrastructure control, so the risk is proportional to the API token behind it rather than to the protocol. The declared capabilities are outbound network access, credential access, and database reads and writes for the D1 surface. A token that can edit DNS or deploy Workers can redirect or intercept production traffic — treat connecting this server as granting an agent a seat on your infrastructure, and prefer read-scoped tokens for anything an assistant uses interactively. ### ElevenLabs MCP Server - URL: https://catalog.anomity.ai/mcp/elevenlabs-mcp-server - Markdown: https://catalog.anomity.ai/mcp/elevenlabs-mcp-server.md - Kind: MCP server - Vendor: ElevenLabs - Trust level: official - Risk score: 45 (medium) - Capabilities: network:outbound, credentials:access, filesystem:write - Dangerous combinations: Credential theft risk (high) - Website: https://elevenlabs.io/docs/api-reference/mcp ElevenLabs' official server exposes text-to-speech, voice cloning, and audio processing to agents, letting an assistant generate narration or transform audio as part of a larger workflow. Declared capabilities are outbound network access, credential access for the API key, and filesystem writes for the audio files it produces. The distinctive risk is not technical but content-shaped: voice cloning under agent control means a model can be asked to synthesise a specific person's voice as a side effect of some larger task. Whatever policy your organisation has about synthetic voice should be enforced at the key, because the agent will not apply it on its own. ### MiniMax MCP Server - URL: https://catalog.anomity.ai/mcp/minimax-mcp-server - Markdown: https://catalog.anomity.ai/mcp/minimax-mcp-server.md - Kind: MCP server - Vendor: MiniMax - Trust level: official - Risk score: 45 (medium) - Capabilities: network:outbound, credentials:access, filesystem:write - Dangerous combinations: Credential theft risk (high) - Website: https://www.minimax.io MiniMax's official server exposes text-to-speech, image generation, and video generation to agents, so a model can produce media assets as part of a workflow rather than describing them. Capabilities are outbound network access, credential access, and filesystem writes for generated files. The considerations are generation-shaped rather than access-shaped: an agent that can produce synthetic video and audio autonomously is a capability worth governing by policy, and generated files landing on disk should go somewhere predictable rather than wherever the agent chose. ### MongoDB MCP Server - URL: https://catalog.anomity.ai/mcp/mongodb-mcp-server - Markdown: https://catalog.anomity.ai/mcp/mongodb-mcp-server.md - Kind: MCP server - Vendor: MongoDB - Trust level: official - Risk score: 45 (medium) - Capabilities: database:read, database:write, network:outbound, credentials:access - Dangerous combinations: Database exfiltration risk (high) - Website: https://www.mongodb.com/docs/mcp-server/ MongoDB's official server gives agents access to clusters, collections, and documents — running queries and aggregations, inspecting schemas, and managing Atlas resources. Capabilities are database read and write, outbound network access, and credential access, which includes the database-exfiltration combination. Document databases raise a specific version of the problem: with no fixed schema, an agent exploring collections discovers whatever is stored there, and application databases accumulate fields nobody documented. Use a read-only user scoped to specific collections for assistant work, and keep write access for deliberate, reviewed operations. ### Neon MCP Server - URL: https://catalog.anomity.ai/mcp/neon-mcp-server - Markdown: https://catalog.anomity.ai/mcp/neon-mcp-server.md - Kind: MCP server - Vendor: Neon - Trust level: official - Risk score: 45 (medium) - Capabilities: database:read, database:write, network:outbound, credentials:access - Dangerous combinations: Database exfiltration risk (high) - Website: https://neon.com/docs/ai/neon-mcp-server Neon's official server lets an agent manage serverless Postgres projects — creating branches, running SQL, inspecting schemas, and reading documentation. Database branching makes it unusually well suited to agent work, because an assistant can be given a throwaway branch instead of production. Capabilities are database read and write, outbound network access, and credential access. That set includes the database-exfiltration combination, so the branching feature is not just convenience, it is the control: give the agent a branch, let it break things, discard it. An assistant connected directly to a production branch has both read access to your data and a network path off the machine. ### PostgreSQL - URL: https://catalog.anomity.ai/mcp/postgres - Markdown: https://catalog.anomity.ai/mcp/postgres.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 45 (medium) - Capabilities: database:read, database:write, network:outbound, credentials:access - Dangerous combinations: Database exfiltration risk (high) ### Supabase MCP Server - URL: https://catalog.anomity.ai/mcp/supabase-mcp-server - Markdown: https://catalog.anomity.ai/mcp/supabase-mcp-server.md - Kind: MCP server - Vendor: Supabase - Trust level: official - Risk score: 45 (medium) - Capabilities: database:read, database:write, network:outbound, credentials:access - Dangerous combinations: Database exfiltration risk (high) - Website: https://supabase.com/docs/guides/getting-started/mcp Supabase's official server, giving an agent access to a project's Postgres database, auth configuration, storage, edge functions, and documentation. It is commonly used to let an assistant write and run queries against a real schema rather than guessing at table names. Database read and write, credential access, and outbound network access is a combination that includes Anomity's database-exfiltration pattern: an agent that can query your tables and also reach the network can move data out in one step, whether deliberately or because a prompt injection told it to. Point it at a development branch by default. If it must touch production, use a role restricted to the tables the assistant genuinely needs and treat every query it writes as code to be reviewed. ### A/B Testing - URL: https://catalog.anomity.ai/skill/ab-testing - Markdown: https://catalog.anomity.ai/skill/ab-testing.md - Kind: Skill - Vendor: coreyhaines31 - Trust level: community - Risk score: 40 (medium) - Website: https://github.com/coreyhaines31 Plans and designs experiments — hypothesis, metric selection, sample size, and the analysis plan — before anything is shipped, which is where most experimentation programmes go wrong. It declares no capabilities; it produces a plan rather than touching systems, so it adds no risk signal to the running agent. Its value is in the discipline it imposes: an agent that will happily invent a plausible-sounding lift number is much less dangerous when it has been made to commit to a metric and a sample size up front. ### Accessibility - URL: https://catalog.anomity.ai/skill/accessibility-audit - Markdown: https://catalog.anomity.ai/skill/accessibility-audit.md - Kind: Skill - Vendor: addyosmani - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, filesystem:read - Website: https://github.com/addyosmani Audits and improves web accessibility against WCAG 2.2, checking contrast, focus order, labelling, and semantics, then proposing concrete fixes rather than a list of violations. It drives a browser to evaluate rendered pages and reads project source to suggest changes, so it declares browser control and filesystem read. Accessibility work is one of the better fits for an agent — the rules are objective, the fixes are mechanical, and a human still has to judge whether the result is genuinely usable rather than merely conformant. ### Agent Pulse - URL: https://catalog.anomity.ai/skill/agent-pulse - Markdown: https://catalog.anomity.ai/skill/agent-pulse.md - Kind: Skill - Vendor: jane-o-o-o-o - Trust level: community - Risk score: 40 (medium) - Capabilities: filesystem:read - Website: https://github.com/jane-o-o-o-o Inspects local AI-agent activity logs across multiple platforms, reporting sessions, token usage, and estimated cost — visibility into what the agents on a machine have actually been doing. It reads local log and configuration files, so it declares filesystem read. It is catalogued partly as a useful tool and partly as a reminder: agent logs are a rich forensic source containing prompts, file paths, and sometimes the contents of what was worked on. That makes them valuable for incident review and sensitive if they leave the machine. ### AI SEO - URL: https://catalog.anomity.ai/skill/ai-seo - Markdown: https://catalog.anomity.ai/skill/ai-seo.md - Kind: Skill - Vendor: coreyhaines31 - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://github.com/coreyhaines31 Optimises content for AI search engines and LLM citation — structuring pages so a model can extract a clean answer and attribute it, rather than optimising purely for classical ranking signals. Outbound network access is its only declared capability, for fetching and checking pages. Worth a caveat this catalog is well placed to give: much published advice in this area is ahead of the evidence. Structured, concise, well-sourced content genuinely helps extraction; several widely-promoted mechanisms have no demonstrated effect on citation at all. ### Ask Matt - URL: https://catalog.anomity.ai/skill/ask-matt - Markdown: https://catalog.anomity.ai/skill/ask-matt.md - Kind: Skill - Vendor: mattpocock - Trust level: community - Risk score: 40 (medium) - Website: https://github.com/mattpocock A router skill: it reads the user's situation and points them at the skill that actually fits, instead of every skill competing to be invoked for every prompt. It declares no capabilities — it only decides what to call next — which makes it one of the zero-risk entries in the catalog. The pattern is more interesting than the skill: as skill libraries grow into the hundreds, selection becomes the bottleneck, and an explicit router is a more legible answer than hoping description-matching picks correctly. ### Audit Website - URL: https://catalog.anomity.ai/skill/audit-website - Markdown: https://catalog.anomity.ai/skill/audit-website.md - Kind: Skill - Vendor: squirrelscan - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://squirrelscan.com Runs a large rule set — reportedly 249+ checks — over a site covering SEO, performance, security headers, and accessibility, then drives iterative fixes rather than only reporting. It fetches and renders pages, so it declares browser control and outbound network access. Breadth is both the appeal and the caveat: a suite this wide will produce findings that are technically true and practically irrelevant, and an agent that fixes everything it is told about can churn a codebase for little benefit. Triage the report before authorising the fixes. ### Brainstorming - URL: https://catalog.anomity.ai/skill/brainstorming - Markdown: https://catalog.anomity.ai/skill/brainstorming.md - Kind: Skill - Vendor: obra/superpowers - Trust level: community - Risk score: 40 (medium) Brainstorming is a process skill from the Superpowers plugin that runs before any creative or generative work — building a feature, designing a component, adding behavior, or modifying an existing flow. Instead of letting the agent dive straight into code from a short user prompt, the skill forces a deliberate exploration of intent, requirements, and design alternatives. It walks the user through clarifying the actual problem, naming the constraints, sketching at least two viable approaches, and recording the decisions before any file is touched. The skill itself does not read or write files — it operates entirely in the conversation — but it shapes everything the agent does afterward by anchoring later steps to the decisions surfaced during the brainstorm. Because it has no declared filesystem, shell, or network capabilities of its own, it contributes no extra risk signals to the running agent. It is one of the safest skills in the catalog and one of the highest-leverage ones for avoiding the half-finished, scope-creeping implementations that result when an agent jumps from a vague prompt straight into code. ### Browser Testing with DevTools - URL: https://catalog.anomity.ai/skill/browser-testing-with-devtools - Markdown: https://catalog.anomity.ai/skill/browser-testing-with-devtools.md - Kind: Skill - Vendor: addyosmani - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control - Website: https://github.com/addyosmani Tests in a real browser via Chrome DevTools — inspecting the DOM, watching network activity, and reproducing behaviour the way a developer would rather than through a synthetic test harness. Declared capability is browser control. The distinction from a headless test runner matters for risk: a skill driving your actual browser can reach internal hosts and act inside authenticated sessions. Point it at a dedicated profile. As a debugging aid it is genuinely strong, because it observes what the page does instead of what the test asserts. ### Caveman - URL: https://catalog.anomity.ai/skill/caveman - Markdown: https://catalog.anomity.ai/skill/caveman.md - Kind: Skill - Vendor: juliusbrussee - Trust level: community - Risk score: 40 (medium) - Website: https://github.com/juliusbrussee An ultra-compressed communication mode that strips agent output to essentials, reportedly cutting token usage by around 75% by dropping hedging, restatement, and prose scaffolding. It declares no capabilities — it changes how the agent writes, not what it touches. The trade is legibility for cost: compressed output is cheaper and faster to skim, and also easier to misread, because the qualifiers that carried the uncertainty are the first thing removed. Reasonable for routine work, less so for anything where the caveats mattered. ### Caveman Commit - URL: https://catalog.anomity.ai/skill/caveman-commit - Markdown: https://catalog.anomity.ai/skill/caveman-commit.md - Kind: Skill - Vendor: juliusbrussee - Trust level: community - Risk score: 40 (medium) - Capabilities: filesystem:read, git:access - Website: https://github.com/juliusbrussee Generates compressed commit messages in Conventional Commits format from the staged diff, aiming for a parseable subject line without the paragraph of narration agents tend to produce. It reads the repository and works through git, so it declares filesystem read and git access. Machine-readable commit messages are genuinely useful downstream for changelogs and release automation. The caution is that a message generated from a diff describes what changed, not why — and the why is the part a future reader actually needs. ### Deep Research - URL: https://catalog.anomity.ai/skill/deep-research - Markdown: https://catalog.anomity.ai/skill/deep-research.md - Kind: Skill - Vendor: samber - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://github.com/samber Conducts parallel web searches with multi-source validation and produces a cited report, deliberately cross-checking claims across sources rather than summarising the first result. Outbound network access is its only declared capability. Multi-source validation is a real defence against both hallucination and retrieval-borne prompt injection — a claim that appears in one adversarial page and nowhere else fails corroboration. It is not a complete defence, since sources can agree by copying each other, but requiring citations at least makes the failure inspectable. ### Latch - URL: https://catalog.anomity.ai/webmcp/latch-webmcp - Markdown: https://catalog.anomity.ai/webmcp/latch-webmcp.md - Kind: WebMCP tool - Vendor: Latch - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://latch.dev Latch is a one-script WebMCP integration for existing sites. Rather than asking developers to hand-author tool definitions, it inspects the page for recognisable search handlers, cart actions, and form submissions and automatically registers matching WebMCP tools. The pitch is agent-readiness without a rewrite. Automatic registration is the risk. A hand-written tool surface is a deliberate list of what agents may do; an inferred one is whatever the scanner happened to recognise, which can include destructive form handlers nobody intended to publish. Latch declares browser control and outbound network access. If you deploy it, audit the resulting tool list the way you would audit a newly generated API — with the Inspector or Radar — before assuming the surface matches your intent. ### MCP Webcomic Site Server - URL: https://catalog.anomity.ai/webmcp/mcp-webcomic-site-server - Markdown: https://catalog.anomity.ai/webmcp/mcp-webcomic-site-server.md - Kind: WebMCP tool - Vendor: Nearest Nabors - Trust level: community - Risk score: 40 (medium) - Capabilities: filesystem:read, network:outbound - Website: https://github.com/nearestnabors A tutorial template that ships an 11ty archive website together with an MCP server and in-browser tools, showing how a content site can serve both human readers and agents from one codebase. It is catalogued as the smallest complete example of the hybrid pattern — server-side MCP plus page-level WebMCP — which is where most publishers will end up. Its declared capabilities are filesystem reads for the site content and outbound network access. As a template rather than a hosted service, the risk transfers to whoever deploys it: the generated MCP server inherits whatever filesystem scope it is configured with, and tutorials tend to be copied with their defaults intact. ### mcp-remote - URL: https://catalog.anomity.ai/mcp/mcp-remote - Markdown: https://catalog.anomity.ai/mcp/mcp-remote.md - Kind: MCP server - Vendor: Community - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound ### mcp-remote (npx) - URL: https://catalog.anomity.ai/mcp/mcp-remote-npx - Markdown: https://catalog.anomity.ai/mcp/mcp-remote-npx.md - Kind: MCP server - Vendor: Community - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound ### Model Context Tool Inspector - URL: https://catalog.anomity.ai/webmcp/model-context-tool-inspector - Markdown: https://catalog.anomity.ai/webmcp/model-context-tool-inspector.md - Kind: WebMCP tool - Vendor: Beaufort - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://chromewebstore.google.com/ A Chrome extension that discovers the WebMCP tools a page registers, renders their JSON schemas, and lets you invoke them manually with arguments you choose. Where WebMCP Radar answers "what is here", the Inspector answers "what happens when it runs". Manual invocation is exactly what makes it useful for review and exactly what makes it sharp. Calling a tool from the Inspector executes it in the live page, in the live session — a `checkout` or `deleteAccount` tool does the real thing. It declares browser control and outbound network access. Use it against staging, or against accounts you are willing to mutate, and treat every successful invocation as evidence of what a compromised agent could have done unattended. ### nekuda WebMCP Workbench - URL: https://catalog.anomity.ai/webmcp/nekuda-webmcp-workbench - Markdown: https://catalog.anomity.ai/webmcp/nekuda-webmcp-workbench.md - Kind: WebMCP tool - Vendor: Nekuda - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://nekuda.ai A Chrome side-panel workbench for working with WebMCP tools end to end: inspect the tools a page registers, invoke them with structured arguments, test sequences, and audit what was called. It targets developers building agent-native pages who need to see their own tool surface the way an agent sees it. Because it both reads and invokes, it inherits the full risk of the page it is pointed at. Its declared capabilities are browser control and outbound network access. The audit trail is the part worth adopting as practice: if you are shipping WebMCP tools, the record of which tools were invoked with which arguments is the difference between debugging an agent's behaviour and guessing at it. ### NotebookLM Skill - URL: https://catalog.anomity.ai/skill/notebooklm-skill - Markdown: https://catalog.anomity.ai/skill/notebooklm-skill.md - Kind: Skill - Vendor: PleasePrompto - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://notebooklm.google.com Lets an agent query NotebookLM for source-grounded answers over documents already uploaded there, so responses are anchored to a specific corpus rather than to model recall. It reaches the service over the network and drives the browser session that holds the notebook, so it declares browser control and outbound network. Source grounding is a real accuracy improvement and a real data-flow decision: the questions asked, and the notebook contents that answer them, move between two AI systems. Worth being deliberate about which documents live in that notebook. ### Pulse - URL: https://catalog.anomity.ai/plugin/pulse-recency-research - Markdown: https://catalog.anomity.ai/plugin/pulse-recency-research.md - Kind: Plugin - Vendor: community - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://www.aitmpl.com/plugins/ A deliberately single-purpose plugin that installs one skill: recency research, which checks whether what an agent believes about a fast-moving topic is actually current rather than a memory of how things were at training time. It declares outbound network access only. The reason it is worth catalogueing next to the thousand-skill bundles is the contrast: a one-skill plugin can be read in a minute, does one thing, and adds one capability. For a category where the dominant failure is installing far more instruction surface than anyone reviews, single-purpose plugins are the pattern that scales safely. ### Stacktree - URL: https://catalog.anomity.ai/webmcp/stacktree-webmcp - Markdown: https://catalog.anomity.ai/webmcp/stacktree-webmcp.md - Kind: WebMCP tool - Vendor: Stacktree - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://stacktree.com Stacktree is a publishing service exposed through WebMCP: an agent hands it generated HTML and receives a shareable, claimable link in return. It turns "the model made a page" into "the page is live at a URL" in a single tool call. That is a genuinely useful primitive and a genuinely sharp one. An agent with access to this tool can publish content to the open web autonomously — content it authored, from context it was given, possibly including material it should not have republished. It declares outbound network access. Anyone enabling it for an agent should think of it as granting publish rights, and should expect to need a review step between generation and publication rather than after it. ### Systematic Debugging - URL: https://catalog.anomity.ai/skill/systematic-debugging - Markdown: https://catalog.anomity.ai/skill/systematic-debugging.md - Kind: Skill - Vendor: obra/superpowers - Trust level: community - Risk score: 40 (medium) - Capabilities: filesystem:read Systematic Debugging is a process skill from the Superpowers plugin that runs before the agent is allowed to propose any fix for a reported bug, test failure, or unexpected behavior. Rather than letting the agent jump to its first hypothesis, the skill walks through a deliberate sequence: reproduce the problem under controlled conditions, narrow the failing surface to the smallest input that still fails, capture the actual versus expected output, form a hypothesis, and only then change code. The skill reads source files, test outputs, and any artifacts the user has shared to characterize the bug, but it does not write files or execute commands — it shapes the agent's reasoning rather than the code itself. It declares only a filesystem read capability, which produces a low risk signal and does not match any dangerous combination. The value of the skill is in what it prevents: shipping a fix for the wrong cause, declaring a flaky test "fixed" without understanding why, and the long detours that happen when an agent commits to a hypothesis before it has actually reproduced the failure. ### use-webmcp-tool - URL: https://catalog.anomity.ai/webmcp/use-webmcp-tool - Markdown: https://catalog.anomity.ai/webmcp/use-webmcp-tool.md - Kind: WebMCP tool - Vendor: npm - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control - Website: https://www.npmjs.com/package/use-webmcp-tool A small React hook that registers a WebMCP tool when a component mounts, keeps its schema current as props change, and unregisters it on unmount. It makes the tool surface a function of the rendered UI, which is the right default: tools disappear when the screen that backs them does. The capability surface is browser control, inherited from the API it wraps. The design consideration it surfaces is scoping. Because registration is tied to component lifecycle, a tool mounted inside an authenticated route is only present while that route is rendered — a meaningfully tighter surface than registering everything globally at page load. Prefer that pattern; a permanently-registered `deleteProject` tool is reachable from every page an agent wanders onto. ### WebMCP Bridge - URL: https://catalog.anomity.ai/webmcp/webmcp-bridge - Markdown: https://catalog.anomity.ai/webmcp/webmcp-bridge.md - Kind: WebMCP tool - Vendor: H3manth - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://github.com/h3manth/webmcp-bridge WebMCP Bridge projects tools from a remote MCP server into the browser page API, so an agent driving the page can call server-side MCP tools through the same interface it uses for page-declared ones. It stitches the two halves of the ecosystem — hosted MCP servers and in-page WebMCP tools — into a single tool list. That convenience is also a trust boundary being erased. Tools that used to require a configured MCP client, with whatever approval flow that client imposes, become callable from a web page. The bridge declares browser control and outbound network access. Anyone deploying it should be explicit about which remote servers are bridged and to which origins, because a page that can reach a filesystem or shell MCP server through a bridge has effectively been granted those capabilities. ### webmcp-types - URL: https://catalog.anomity.ai/webmcp/webmcp-types - Markdown: https://catalog.anomity.ai/webmcp/webmcp-types.md - Kind: WebMCP tool - Vendor: npm - Trust level: community - Risk score: 40 (medium) - Website: https://www.npmjs.com/package/webmcp-types TypeScript declarations for the experimental WebMCP browser interfaces. It ships types only — no runtime code — so applications can compile against the API before it stabilises without reaching for `any`. As a types-only package it declares no runtime capabilities and carries essentially no direct risk; it is catalogued because it appears in the dependency tree of most WebMCP projects and reviewers will encounter it. The one thing worth checking is version drift: the underlying API is experimental, and types that describe an older shape will happily compile code the browser then rejects at runtime. ### webmcp.cool - URL: https://catalog.anomity.ai/webmcp/webmcp-cool - Markdown: https://catalog.anomity.ai/webmcp/webmcp-cool.md - Kind: WebMCP tool - Vendor: Community - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://webmcp.cool A directory of WebMCP-enabled sites that is itself WebMCP-enabled: it publishes JSON discovery and query tools so an agent can ask which sites expose which tools, rather than a human browsing a list. It functions as the ecosystem's index. For defenders it is a useful reconnaissance resource — the fastest way to see how quickly the agent-callable web is growing and which categories of site are adopting it. It declares outbound network access. The same property makes it worth watching: a machine-readable index of pages that expose tools to agents is exactly the input an autonomous crawler would want, and inclusion in it is effectively an invitation. ### WordLift AI Audit - URL: https://catalog.anomity.ai/webmcp/wordlift-ai-audit - Markdown: https://catalog.anomity.ai/webmcp/wordlift-ai-audit.md - Kind: WebMCP tool - Vendor: WordLift - Trust level: community - Risk score: 40 (medium) - Capabilities: browser:control, network:outbound - Website: https://wordlift.io A live service that runs an agent-readiness review of a site — checking structure, machine-readable metadata, and how legible the page is to an AI agent — and exposes that review itself as WebMCP tools, so an agent can request the audit and read the findings without a human in the loop. It is one of the few production services in the WebMCP ecosystem rather than a demonstration, which is why it is catalogued. It declares outbound network access and browser control. The data-flow question to ask before pointing it at anything sensitive is the usual one for hosted analysis tools: the URLs you submit, and whatever the crawler can reach from them, leave your perimeter. ### YouTube Transcript Downloader - URL: https://catalog.anomity.ai/skill/youtube-transcript-downloader - Markdown: https://catalog.anomity.ai/skill/youtube-transcript-downloader.md - Kind: Skill - Vendor: michalparkola - Trust level: community - Risk score: 40 (medium) - Capabilities: network:outbound - Website: https://github.com/michalparkola Retrieves and processes transcripts from YouTube URLs so an agent can work with the contents of a talk or tutorial as text instead of being told to watch a video it cannot watch. Outbound network access is its only capability, making it a low-risk utility. The standard retrieval caveat applies and is easy to forget with video: a transcript is text an unknown person wrote, and an agent that summarises it is processing untrusted input. Video feels less like a document than a web page, which is precisely why it is a convenient injection surface. ### Convex Migrate - URL: https://catalog.anomity.ai/skill/convex-migrate - Markdown: https://catalog.anomity.ai/skill/convex-migrate.md - Kind: Skill - Vendor: get-convex - Trust level: official - Risk score: 35 (medium) - Capabilities: database:read, database:write, network:outbound - Dangerous combinations: Database exfiltration risk (high) - Website: https://www.convex.dev Performs schema migration and data backfill on deployed Convex applications, with a companion rehearsal skill that tests the same change against a snapshot before it is promoted. Declared capabilities are database read and write plus outbound network access. Schema migration is among the least reversible things an agent can do to a system, which is exactly why the rehearse-then-promote split matters — it is the pattern to copy in any agent workflow that touches production data. Run the rehearsal, read its output, then promote deliberately. ### Grafana MCP Server - URL: https://catalog.anomity.ai/mcp/grafana-mcp-server - Markdown: https://catalog.anomity.ai/mcp/grafana-mcp-server.md - Kind: MCP server - Vendor: Grafana Labs - Trust level: official - Risk score: 35 (medium) - Capabilities: network:outbound, credentials:access, database:read - Dangerous combinations: Database exfiltration risk (high) - Website: https://grafana.com/docs/grafana/latest/observability-as-code/mcp-server/ Grafana's official server lets an agent query dashboards, datasources, alert rules, and incidents, so an assistant investigating an outage can pull the actual metrics rather than a screenshot of them. Declared capabilities are outbound network access, credential access, and database reads through the connected datasources. That last one is the sharp edge: Grafana is a window onto whatever it is wired to, so the effective reach of this server is the union of every datasource in the organisation, which is usually broader than the person connecting it expects. Scope by folder and datasource, and prefer viewer-level credentials for assistants. ### Ahrefs MCP Server - URL: https://catalog.anomity.ai/mcp/ahrefs-mcp-server - Markdown: https://catalog.anomity.ai/mcp/ahrefs-mcp-server.md - Kind: MCP server - Vendor: Ahrefs - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://ahrefs.com/api Ahrefs' official server brings SEO and search analytics — backlinks, keyword data, rankings, and site audits — into an agent's toolset, so an assistant can research and report on search performance directly. Capabilities are outbound network access and credential access. Risk is modest: the data is largely about public web properties, and the tools are read-oriented. The practical caution is cost rather than security — API credits are consumed per call, and an agent left to explore a research question can iterate through a great many queries faster than a human would. Rate-limit the key. ### Alpha Vantage MCP Server - URL: https://catalog.anomity.ai/mcp/alpha-vantage-mcp-server - Markdown: https://catalog.anomity.ai/mcp/alpha-vantage-mcp-server.md - Kind: MCP server - Vendor: Alpha Vantage - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://www.alphavantage.co/documentation/ Alpha Vantage's official server exposes realtime and historical market data — equities, ETFs, options, forex, crypto, commodities, fundamentals, and technical indicators — as agent tools. Capabilities are outbound network access and credential access for the API key. Risk is low: the data flows inward, and the key grants no ability to trade. The failure mode is analytical rather than security-related, and worth naming because people deploy these for decisions — an agent that fetches a number and reasons about it can be confidently wrong about what the number means, and market data has a great many near-identical fields that mean different things. ### Angular Developer - URL: https://catalog.anomity.ai/skill/angular-developer - Markdown: https://catalog.anomity.ai/skill/angular-developer.md - Kind: Skill - Vendor: Angular - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write - Website: https://angular.dev Generates Angular code and architectural guidance from the framework team — component structure, signals, dependency injection, and the migration paths between Angular versions. It reads and writes project files. First-party framework skills are meaningfully more reliable than general model knowledge for fast-moving frameworks, because they encode the current recommendation rather than the average of every version ever written about. Angular in particular has changed its idioms enough that this difference shows up immediately in generated code. ### App Insights Instrumentation - URL: https://catalog.anomity.ai/skill/appinsights-instrumentation - Markdown: https://catalog.anomity.ai/skill/appinsights-instrumentation.md - Kind: Skill - Vendor: Microsoft - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write - Website: https://github.com/microsoft Guides Azure Application Insights SDK setup for web applications — adding the SDK, configuring sampling and correlation, and wiring custom telemetry. It reads and writes project files. The risk it introduces is downstream rather than immediate: instrumentation decides what leaves your application as telemetry, and an over-eager configuration can ship request bodies, headers, or user identifiers to a monitoring backend. Review what the generated configuration actually captures, not just that it compiles. ### Asana MCP Server - URL: https://catalog.anomity.ai/mcp/asana-mcp-server - Markdown: https://catalog.anomity.ai/mcp/asana-mcp-server.md - Kind: MCP server - Vendor: Asana - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developers.asana.com/docs/mcp-server Asana's official server exposes tasks, projects, and workspaces so an agent can read work context, create tasks, and update status as part of a planning or reporting workflow. It declares outbound network access and credential access. The exposure profile is ordinary for a work-management connector — project data, assignees, timelines — with the usual caveat that task descriptions written by external collaborators are untrusted text arriving in a model's context. Scope the token to the workspaces an assistant actually needs; organisation-wide access is rarely necessary for the use cases people actually deploy. ### Atlassian MCP Server - URL: https://catalog.anomity.ai/mcp/atlassian-mcp-server - Markdown: https://catalog.anomity.ai/mcp/atlassian-mcp-server.md - Kind: MCP server - Vendor: Atlassian - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://support.atlassian.com/rovo/docs/getting-started-with-the-atlassian-remote-mcp-server/ Atlassian's official server connects agents to Jira, Confluence, and Compass — searching issues, reading and writing pages, and pulling service metadata. In most enterprises this is the single richest source of institutional context an assistant can be given. That richness is the risk. Confluence in particular tends to hold architecture documents, incident write-ups, and access instructions, and a broadly-scoped integration reads all of it. Declared capabilities are outbound network access and credential access. Jira descriptions from customer portals are untrusted text. Scope by project and space, and prefer read access for assistants that are answering questions rather than filing work. ### Azure Compliance - URL: https://catalog.anomity.ai/skill/azure-compliance - Markdown: https://catalog.anomity.ai/skill/azure-compliance.md - Kind: Skill - Vendor: Microsoft - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://github.com/microsoft Audits Azure compliance posture and monitors Key Vault expiry — surfacing misconfigured resources and secrets approaching their rotation date before they fail in production. Declared capabilities are outbound network and credential access. Note the subtlety worth catching: monitoring Key Vault means the skill enumerates secret metadata — names, expiry, versions — not secret values. That distinction is the whole security argument for allowing it, and it is worth verifying in the skill's own implementation rather than assuming, because the two API calls sit next to each other. ### Azure Cost - URL: https://catalog.anomity.ai/skill/azure-cost - Markdown: https://catalog.anomity.ai/skill/azure-cost.md - Kind: Skill - Vendor: Microsoft - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://github.com/microsoft Manages Azure spend — forecasting, attributing cost to resources, and identifying waste such as idle capacity and oversized instances. It reads billing APIs with cloud credentials over the network, so it declares outbound network and credential access, but performs no writes. That read-only shape makes it one of the safer cloud skills: the worst case is that billing data, which describes your architecture and scale in some detail, enters a model context. For most organisations that is an acceptable trade for finding the idle cluster nobody remembered. ### Box MCP Server - URL: https://catalog.anomity.ai/mcp/box-mcp-server - Markdown: https://catalog.anomity.ai/mcp/box-mcp-server.md - Kind: MCP server - Vendor: Box - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developer.box.com/guides/box-mcp/ Box's official server exposes enterprise content — files, folders, metadata, and search — so an agent can find and read documents held in a managed content platform. Declared capabilities are outbound network access and credential access. Box is typically the system of record for contracts, board material, and regulated documents, which makes scope the entire security question: an integration authorised at the enterprise level can read the most sensitive corpus the company has. Use folder-scoped access and app users rather than a broad service account, and confirm that content classification and retention policies survive the trip into a model context. ### Brave Search - URL: https://catalog.anomity.ai/mcp/brave-search - Markdown: https://catalog.anomity.ai/mcp/brave-search.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Cal.com MCP Server - URL: https://catalog.anomity.ai/mcp/cal-com-mcp-server - Markdown: https://catalog.anomity.ai/mcp/cal-com-mcp-server.md - Kind: MCP server - Vendor: Cal.com - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://cal.com/docs Cal.com's official server exposes scheduling — availability, event types, and bookings — so an agent can find a slot and book it as part of a longer workflow rather than handing the user a link. Declared capabilities are outbound network access and credential access. Booking is a state-changing action with real-world consequences and a social cost when it goes wrong, which puts it in the category of tools worth keeping behind confirmation. Calendar data is also quietly revealing: attendee lists and meeting titles describe deals, hiring, and incidents to anyone who can read them. ### Canva MCP Server - URL: https://catalog.anomity.ai/mcp/canva-mcp-server - Markdown: https://catalog.anomity.ai/mcp/canva-mcp-server.md - Kind: MCP server - Vendor: Canva - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://www.canva.dev/docs/apps/mcp-server/ Canva's official MCP server lets agents work with designs, assets, exports, and comments — generating or modifying a design and exporting it without leaving the assistant. Declared capabilities are outbound network access and credential access. Brand assets and unreleased marketing material are the sensitive content here, and export is the egress path: an agent that can export a design can produce a shareable artifact of anything in the account. For teams using Canva as a brand system of record, scope the connection to a folder rather than the whole account. ### Cloudflare One - URL: https://catalog.anomity.ai/skill/cloudflare-one - Markdown: https://catalog.anomity.ai/skill/cloudflare-one.md - Kind: Skill - Vendor: Cloudflare - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developers.cloudflare.com/cloudflare-one/ Cloudflare's skill for configuring Zero Trust and SASE across its product line — access policies, tunnels, gateway rules, and the identity integration that ties them together. It declares outbound network and credential access. What makes this one notable is the subject matter: the skill configures the controls that decide who can reach what. A mistake here does not break a build, it opens a path. Agent-generated access policy deserves the same review as agent-generated firewall rules — read the diff, and prefer applying through a change process rather than directly. ### Convex Advisor - URL: https://catalog.anomity.ai/skill/convex-advisor - Markdown: https://catalog.anomity.ai/skill/convex-advisor.md - Kind: Skill - Vendor: get-convex - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://www.convex.dev Analyses a deployed Convex application's performance and returns evidence-backed optimisation findings — slow queries, missing indexes, and access patterns that will not scale. It reaches the deployment over the network with project credentials, so it declares outbound network and credential access. "Evidence-backed" is the property worth insisting on generally: a performance recommendation that cites the measurement behind it can be checked, while one that does not is a guess wearing a confident tone. ### ElevenLabs Agents - URL: https://catalog.anomity.ai/skill/elevenlabs-agents - Markdown: https://catalog.anomity.ai/skill/elevenlabs-agents.md - Kind: Skill - Vendor: ElevenLabs - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://elevenlabs.io Builds voice AI agents — assistants and interactive characters — wiring speech synthesis, turn-taking, and tool calls into a conversational system. Capabilities are outbound network and credential access. The governance question is about the product being built rather than the skill building it: a voice agent that answers as your company is a public interface, and a synthesised voice that sounds like a specific person raises consent questions that no technical control addresses. Decide the policy before the prototype ships, because voice demos have a habit of going live. ### EverArt - URL: https://catalog.anomity.ai/mcp/everart - Markdown: https://catalog.anomity.ai/mcp/everart.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Figma MCP Server - URL: https://catalog.anomity.ai/mcp/figma-mcp-server - Markdown: https://catalog.anomity.ai/mcp/figma-mcp-server.md - Kind: MCP server - Vendor: Figma - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://help.figma.com/hc/en-us/articles/32132100833559 Figma's official MCP server gives an agent access to Dev Mode information — layer structure, auto-layout, variants, and design tokens — so a coding assistant can implement a design from its actual structure instead of from a screenshot. Capabilities are outbound network access and credential access. Design files are usually less sensitive than source or billing data, but they are not neutral: unreleased branding, unannounced features, and customer names in mockups all live in Figma. Scope the token to the files a project needs. The upside is real — reading tokens and spacing from the source removes a whole class of hallucinated CSS. ### Filesystem - URL: https://catalog.anomity.ai/mcp/filesystem - Markdown: https://catalog.anomity.ai/mcp/filesystem.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write ### Frontend Design - URL: https://catalog.anomity.ai/plugin/frontend-design - Markdown: https://catalog.anomity.ai/plugin/frontend-design.md - Kind: Plugin - Vendor: anthropics - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write - Website: https://github.com/anthropics/claude-code Frontend Design is an official Anthropic plugin for Claude Code that bundles design-system patterns, component recipes, and a frontend-design skill that the Claude Code agent follows when asked to build web components, pages, or applications. The plugin's intent is to push the agent away from generic AI-generated UI aesthetics and toward distinctive, production-grade interfaces by codifying repeatable visual and structural decisions. When invoked, the skill reads files in the active project to understand the existing component conventions, writes new components and styles into the project, and follows a structured set of design decisions captured in its reference material. It does not request shell execution, network access, or credentials of its own. Frontend Design is one of the few entries in the catalog with the official trust level — published by Anthropic, the maintainer of Claude Code itself, which means the most favorable trust adjustment available in the scoring model. The remaining risk signals come from filesystem read and write, which are the minimum required for any plugin that produces source files, and do not match any dangerous combination. It is one of the lowest-risk plugins in the catalog. ### Frontend Design - URL: https://catalog.anomity.ai/skill/frontend-design - Markdown: https://catalog.anomity.ai/skill/frontend-design.md - Kind: Skill - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write - Website: https://github.com/anthropics/skills An Anthropic-published skill that steers an agent away from the generic, templated look that AI-generated interfaces default to — pushing for deliberate typographic choices, considered colour, and layouts that read as designed rather than assembled. It is invoked when building new UI or reshaping existing screens. It reads the project to understand existing conventions and writes the components it designs, so it declares filesystem read and write. There is no shell, network, or credential access of its own; whatever risk exists comes from the host agent's ability to apply the edits. As Anthropic-published copy rather than a community bundle, it carries the official trust adjustment and sits at the low end of the catalog. ### Gemini Code Assist - URL: https://catalog.anomity.ai/extension/gemini-code-assist - Markdown: https://catalog.anomity.ai/extension/gemini-code-assist.md - Kind: IDE extension - Vendor: Google - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://cloud.google.com/gemini/code-assist Gemini Code Assist is Google's official AI coding assistant, distributed as a first-party extension for VS Code, JetBrains IDEs, Cloud Shell Editor, and the Google Cloud Console. It is powered by the Gemini model family and integrates tightly with Google Cloud — both for authentication (developers sign in with their Google account) and for tooling, with built-in support for explaining Google Cloud APIs, generating Terraform, and reviewing changes against Google's style guides. The extension reads the current file plus configurable workspace context to construct prompts, makes outbound network requests to Google's Gemini service through the developer's Google Cloud project, and uses an OAuth credential negotiated with the user's Google account to authenticate. It does not write to disk autonomously or execute shell commands; suggestions are inserted by the IDE on acceptance. Because Gemini Code Assist is officially published by Google, its trust adjustment is the most favorable available. The residual risk is the same as Copilot's — credentials plus outbound network mean that the contents of the developer's editor are transmitted to Google's service on each request. Teams with data-residency requirements should evaluate the enterprise tier and the regional endpoint configuration before broad rollout. ### GitHub - URL: https://catalog.anomity.ai/mcp/github - Markdown: https://catalog.anomity.ai/mcp/github.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access, git:access ### GitHub Copilot - URL: https://catalog.anomity.ai/extension/github-copilot - Markdown: https://catalog.anomity.ai/extension/github-copilot.md - Kind: IDE extension - Vendor: GitHub - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, network:outbound, credentials:access - Website: https://github.com/features/copilot GitHub Copilot is GitHub's official AI pair-programmer, distributed as a first-party extension across VS Code, Visual Studio, JetBrains IDEs, Neovim, Xcode, and the GitHub web UI. Backed by GitHub and Microsoft, it is the most widely-deployed AI coding extension in the world and one of the few that ships with enterprise-grade subscription tiers, audit logs, content-exclusion policies, and IP indemnification for business and enterprise plans. The extension reads the file the developer is working in plus a configurable amount of additional repository context to construct prompts, makes outbound network requests to GitHub's Copilot service to retrieve completions and chat answers, and uses an OAuth credential negotiated with the user's GitHub account to authenticate those requests. It does not write to disk autonomously outside of the developer's accept gesture and does not execute shell commands unless the Copilot Agent mode is explicitly enabled by the user. Because Copilot is officially published by GitHub, its trust adjustment is the most favorable in the catalog. The remaining residual risk is the credential-plus-network pairing — every keystroke in a Copilot-enabled file is potentially transmitted to GitHub's service, so teams subject to data-residency or confidentiality controls should evaluate Copilot Business or Enterprise rather than the consumer plan. ### GitHub MCP Server - URL: https://catalog.anomity.ai/mcp/github-mcp-server - Markdown: https://catalog.anomity.ai/mcp/github-mcp-server.md - Kind: MCP server - Vendor: GitHub - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access, git:access - Website: https://github.com/github/github-mcp-server GitHub's own MCP server, written in Go and maintained by the GitHub team. It exposes repositories, issues, pull requests, code search, and Actions to an agent as structured tools, so a coding assistant can triage an issue, read the diff on a PR, or search across an organisation's code without a human pasting context. It authenticates as you. The server reaches the network and holds a GitHub token — which is the capability that matters, because the token's scopes define the blast radius, not the server's code. A token with `repo` write on an organisation lets any agent driving this server push branches, edit workflows, and comment as you. Issue and PR text is attacker-controlled on public repositories, so treat it as untrusted input reaching an agent that holds write credentials, and scope the token to the narrowest set of repositories that makes the assistant useful. ### GitLab - URL: https://catalog.anomity.ai/mcp/gitlab - Markdown: https://catalog.anomity.ai/mcp/gitlab.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access, git:access ### Google Drive - URL: https://catalog.anomity.ai/mcp/google-drive - Markdown: https://catalog.anomity.ai/mcp/google-drive.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Google Maps - URL: https://catalog.anomity.ai/mcp/google-maps - Markdown: https://catalog.anomity.ai/mcp/google-maps.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Granola MCP - URL: https://catalog.anomity.ai/mcp/granola-mcp - Markdown: https://catalog.anomity.ai/mcp/granola-mcp.md - Kind: MCP server - Vendor: Granola - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://www.granola.ai Granola's MCP server exposes meeting notes and transcripts, letting an agent search across what was said in meetings and pull the relevant passage into a task. Declared capabilities are outbound network access and credential access. Meeting transcripts are among the most sensitive corpora a company holds — they capture unguarded speech about people, deals, and incidents, often without participants thinking of it as a written record. Connecting them to an assistant is a decision to make explicitly, with attention to whose meetings are in scope and whether everyone in those meetings would expect this. ### HubSpot MCP Server - URL: https://catalog.anomity.ai/mcp/hubspot-mcp-server - Markdown: https://catalog.anomity.ai/mcp/hubspot-mcp-server.md - Kind: MCP server - Vendor: HubSpot - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developers.hubspot.com/mcp HubSpot's official server exposes CRM objects and records — contacts, companies, deals, and their properties — so an agent can answer questions about a pipeline or update records from a conversation. This is personal data by definition, which makes it the highest-compliance-consequence connector in this list even though its technical capabilities are just outbound network and credential access. Any CRM record an agent reads is customer personal data entering a model context, with whatever retention and residency implications that carries for you. Decide that question before connecting, scope to the objects and properties needed, and prefer read-only for assistants used for analysis. ### Hugging Face MCP Server - URL: https://catalog.anomity.ai/mcp/hugging-face-mcp-server - Markdown: https://catalog.anomity.ai/mcp/hugging-face-mcp-server.md - Kind: MCP server - Vendor: Hugging Face - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://huggingface.co/docs/hub/en/mcp Hugging Face's official server exposes models, datasets, Spaces, and inference to agents, so an assistant can search the hub, read model cards, and call hosted inference endpoints as tools. Capabilities are outbound network access and credential access for the hub token. The supply-chain angle is the one to think about: an agent that can discover and invoke arbitrary community models and Spaces is an agent whose behaviour depends on artifacts nobody on your team reviewed. Model cards and dataset descriptions are also free text reaching the model's context. Prefer allow-listing the models an assistant may call over granting open hub access. ### Intercom MCP Server - URL: https://catalog.anomity.ai/mcp/intercom-mcp-server - Markdown: https://catalog.anomity.ai/mcp/intercom-mcp-server.md - Kind: MCP server - Vendor: Intercom - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developers.intercom.com/docs/guides/mcp Intercom's official server exposes conversations, contacts, and help-centre content, letting an agent search support history and draft or send replies. Capabilities are outbound network access and credential access. This connector sits at the intersection of two risks the catalog treats seriously: the data is customer personal information, and support conversations are written by strangers, making them one of the most reliable prompt-injection channels into a corporate agent. An assistant that reads customer messages and can also send replies as your brand should be treated as a publishing system with an untrusted input, not as an internal tool. ### JetBrains AI Assistant - URL: https://catalog.anomity.ai/extension/jetbrains-ai-assistant - Markdown: https://catalog.anomity.ai/extension/jetbrains-ai-assistant.md - Kind: IDE extension - Vendor: JetBrains - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://www.jetbrains.com/ai/ JetBrains' first-party AI plugin, bundled across IntelliJ IDEA, PyCharm, WebStorm, and the rest of the IDE family. It provides completion, chat with project context, commit-message generation, and refactoring suggestions built on the IDE's own program model rather than on plain text — which is why its suggestions understand types and call hierarchies that a token-level tool cannot see. It reads the project, applies edits when accepted, and sends context to JetBrains' AI service, so it declares filesystem read and write plus outbound network. Being vendor-published it takes the official trust adjustment. The setting that matters for a security review is which files are excluded from context collection: IDE-integrated assistants see everything the IDE has indexed, including configuration files that were never meant to leave the machine. ### Linear MCP Server - URL: https://catalog.anomity.ai/mcp/linear-mcp-server - Markdown: https://catalog.anomity.ai/mcp/linear-mcp-server.md - Kind: MCP server - Vendor: Linear - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://linear.app/docs/mcp Linear's official remote MCP server exposes issues, projects, cycles, and comments, so an agent can file bugs, update status, and pull the context behind a ticket while working in an editor. Declared capabilities are outbound network access and credential access. The specific thing to watch is that issue and comment bodies are a natural injection channel in any team that accepts external bug reports: text a stranger wrote arrives in the agent's context, and the same agent holds a token that can modify your tracker. Read-only scopes cover most assistant use cases; grant write when an actual workflow needs it rather than by default. ### Magic MCP - URL: https://catalog.anomity.ai/mcp/magic-mcp - Markdown: https://catalog.anomity.ai/mcp/magic-mcp.md - Kind: MCP server - Vendor: 21st.dev - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://21st.dev Magic generates UI components from natural-language descriptions and delivers them into a project, so an assistant can produce a styled, working component rather than a rough sketch of one. It writes files into your repository and reaches the network, so it declares filesystem reads and writes plus outbound network access. Generated components are third-party code arriving in your codebase without a package manager, a version, or a changelog — review them the way you would review a dependency, paying particular attention to anything they fetch at runtime. ### Memory - URL: https://catalog.anomity.ai/mcp/memory - Markdown: https://catalog.anomity.ai/mcp/memory.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write ### Mercury MCP Server - URL: https://catalog.anomity.ai/mcp/mercury-mcp-server - Markdown: https://catalog.anomity.ai/mcp/mercury-mcp-server.md - Kind: MCP server - Vendor: Mercury - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://mercury.com Mercury's official MCP server exposes bank accounts, transactions, and cards to agents, so a founder or finance operator can ask questions about spend and cash position in natural language. Declared capabilities are outbound network access and credential access, and the content is banking data — among the most sensitive an agent can be handed. Read-only scoping is the single most important control, and it is worth verifying rather than assuming: the difference between an assistant that can describe a transaction and one that can initiate one is the whole risk. Financial data in a model context also has audit implications that most teams have not written a policy for yet. ### Microsoft Clarity - URL: https://catalog.anomity.ai/mcp/microsoft-clarity - Markdown: https://catalog.anomity.ai/mcp/microsoft-clarity.md - Kind: MCP server - Vendor: Microsoft - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Notion MCP Server - URL: https://catalog.anomity.ai/mcp/notion-mcp-server - Markdown: https://catalog.anomity.ai/mcp/notion-mcp-server.md - Kind: MCP server - Vendor: Notion - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://developers.notion.com/docs/mcp Notion's official server lets an agent search a workspace, read and update pages, and query databases. It is one of the most common knowledge-base connectors, because the content an assistant needs is usually already in Notion. The risk is less about destructive writes than about reach: a workspace-wide integration can read every page it is shared with, and most workspaces have accumulated more sensitive content than their owners remember — credentials pasted into runbooks, contract terms, HR notes. It declares outbound network and credential access. Share the integration with a specific set of pages rather than the workspace, and assume anything readable will end up in a model's context window. ### Playwright MCP - URL: https://catalog.anomity.ai/mcp/playwright-mcp - Markdown: https://catalog.anomity.ai/mcp/playwright-mcp.md - Kind: MCP server - Vendor: Microsoft - Trust level: official - Risk score: 20 (low) - Capabilities: browser:control, filesystem:write, network:outbound - Website: https://github.com/microsoft/playwright-mcp Microsoft's official browser-automation MCP server, built on Playwright and one of the most widely installed servers in the ecosystem. It drives a real browser for an agent: navigating, clicking, filling forms, reading the accessibility tree, and capturing screenshots or traces. Browser control is the capability to reason about, and it is broader than it sounds. A driven browser can reach internal sites, act inside sessions that are already authenticated, and read anything rendered on screen — and every page it visits is untrusted input flowing back into the agent's context. Combined with the filesystem writes it uses for traces and screenshots, a compromised loop can both act on your behalf and persist what it found. Run it against a dedicated profile rather than your daily browser, and never one holding production credentials. ### PostHog MCP Server - URL: https://catalog.anomity.ai/mcp/posthog-mcp-server - Markdown: https://catalog.anomity.ai/mcp/posthog-mcp-server.md - Kind: MCP server - Vendor: PostHog - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://posthog.com/docs/model-context-protocol PostHog's official server exposes product analytics — events, insights, feature flags, and session data — so an agent can answer questions about user behaviour or adjust a flag from a conversation. Declared capabilities are outbound network access and credential access. Two distinct exposures: analytics events frequently carry user identifiers and properties that amount to personal data, and feature-flag writes are a production control surface — an agent that can toggle a flag can change what your users see. Separate the read token used for analysis from any token that can mutate flags. ### Proxyman MCP - URL: https://catalog.anomity.ai/mcp/proxyman-mcp - Markdown: https://catalog.anomity.ai/mcp/proxyman-mcp.md - Kind: MCP server - Vendor: Proxyman - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, credentials:access, network:outbound - Website: https://proxyman.io Proxyman's MCP server gives an agent access to captured HTTP traffic — requests, responses, headers, and bodies — so an assistant can debug an API integration from what actually went over the wire. Intercepted traffic is, by construction, where credentials live: authorization headers, session cookies, and tokens are in nearly every captured request. The server declares filesystem reads for capture files, credential access, and outbound network. This is one of the clearest cases in the catalog where a low-drama developer tool becomes high-consequence when connected to a model, because the whole point of the data is that it contains the secrets. ### Puppeteer - URL: https://catalog.anomity.ai/mcp/puppeteer - Markdown: https://catalog.anomity.ai/mcp/puppeteer.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: browser:control, network:outbound, filesystem:write ### Railway MCP Server - URL: https://catalog.anomity.ai/mcp/railway-mcp-server - Markdown: https://catalog.anomity.ai/mcp/railway-mcp-server.md - Kind: MCP server - Vendor: Railway - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://docs.railway.com/guides/mcp Railway's official server exposes projects, services, deployments, variables, and logs, so an agent can deploy a service, read why a build failed, or inspect environment configuration. Declared capabilities are outbound network access and credential access. Two things deserve attention: deployment is a code-execution primitive — an agent that can deploy can run arbitrary code in your infrastructure — and environment variables are where secrets live, so a server that can read them is a server that can read your secrets. Scope tokens per project, and keep production deploys behind a human even when the assistant is trusted for staging. ### React Best Practices - URL: https://catalog.anomity.ai/skill/react-best-practices - Markdown: https://catalog.anomity.ai/skill/react-best-practices.md - Kind: Skill - Vendor: Vercel - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write - Website: https://vercel.com Vercel's skill encoding performance and correctness guidance for React and Next.js — server versus client components, data-fetching placement, memoisation that actually helps, and the rendering mistakes that produce slow pages. It reads project files to give advice grounded in your actual code and writes changes when asked, so it declares filesystem read and write. The value is that guidance comes from the framework's authors rather than from whatever pattern dominated the training data, which for a framework that has changed its recommended architecture repeatedly is a meaningful difference. ### Sentry MCP Server - URL: https://catalog.anomity.ai/mcp/sentry-mcp-server - Markdown: https://catalog.anomity.ai/mcp/sentry-mcp-server.md - Kind: MCP server - Vendor: Sentry - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://docs.sentry.io/product/sentry-mcp/ Sentry's official server brings issues, events, stack traces, and release health into an agent's reach, so an assistant can investigate a production error with the actual trace rather than a pasted excerpt. It declares outbound network and credential access. The under-appreciated exposure is the payloads: error events routinely carry request bodies, headers, and local variables, which means connecting Sentry to an assistant can put tokens and personal data into a model context even though nobody intended to share them. Sentry's own data-scrubbing settings are the control that matters here — verify them before connecting, not after. ### Shopify MCP Server - URL: https://catalog.anomity.ai/mcp/shopify-mcp-server - Markdown: https://catalog.anomity.ai/mcp/shopify-mcp-server.md - Kind: MCP server - Vendor: Shopify - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://shopify.dev/docs/apps/build/storefront-mcp Shopify's official server exposes storefront and admin data — products, orders, customers, and inventory — letting an agent answer merchandising questions or update catalogue data. Capabilities are outbound network access and credential access. Orders and customers are personal data; inventory and pricing are commercially sensitive and directly revenue-affecting, since an agent with write access to prices can change what customers pay. Admin API scopes are fine-grained here — use them, and keep price and inventory mutation out of any assistant that also reads untrusted text such as customer messages. ### Slack - URL: https://catalog.anomity.ai/mcp/slack - Markdown: https://catalog.anomity.ai/mcp/slack.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### Slack MCP Server - URL: https://catalog.anomity.ai/mcp/slack-mcp-server - Markdown: https://catalog.anomity.ai/mcp/slack-mcp-server.md - Kind: MCP server - Vendor: Slack - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://api.slack.com/docs/mcp Slack's official remote MCP server gives agents access to messages, channels, users, and canvases — reading conversation history for context and posting on your behalf. Capabilities are outbound network access and credential access. Slack is simultaneously the richest informal knowledge base in most companies and the least curated one: an integration that can search history can surface things said in confidence years ago. It is also a first-class injection surface, since anyone in a shared channel can write text an agent will later read. Scope to specific channels, prefer read-only, and treat an agent that can post as an agent that can be socially engineered into posting. ### Spotify - URL: https://catalog.anomity.ai/mcp/spotify - Markdown: https://catalog.anomity.ai/mcp/spotify.md - Kind: MCP server - Vendor: Anthropic Directory - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access ### SQLite - URL: https://catalog.anomity.ai/mcp/sqlite - Markdown: https://catalog.anomity.ai/mcp/sqlite.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 20 (low) - Capabilities: database:read, database:write, filesystem:read ### Stripe MCP Server - URL: https://catalog.anomity.ai/mcp/stripe-mcp-server - Markdown: https://catalog.anomity.ai/mcp/stripe-mcp-server.md - Kind: MCP server - Vendor: Stripe - Trust level: official - Risk score: 20 (low) - Capabilities: network:outbound, credentials:access - Website: https://docs.stripe.com/mcp Stripe's official MCP server exposes payments, customers, subscriptions, invoices, and the Stripe documentation as agent tools. It is designed both for building payment flows with an assistant and for answering operational questions about live billing data. Money movement is the sharp edge. The server declares outbound network access and credential access, and the API key you connect determines whether an agent can only read charges or can also issue refunds and create subscriptions. Restricted keys exist for exactly this reason — use one. And remember that customer records are attacker-influenceable free text: an agent summarising support-adjacent data is reading strings written by strangers. ### WebMCP Evals - URL: https://catalog.anomity.ai/webmcp/webmcp-evals - Markdown: https://catalog.anomity.ai/webmcp/webmcp-evals.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 20 (low) - Capabilities: browser:control, filesystem:write, network:outbound - Website: https://github.com/GoogleChromeLabs/webmcp-evals A CLI evaluation harness for WebMCP tool surfaces. It drives an agent against a page's registered tools and checks whether the agent selects the right tool and supplies valid arguments — the two failure modes that make an otherwise correct tool surface useless in practice. It runs locally, driving a browser and writing result files, so it declares browser control, filesystem writes, and outbound network access for the model calls. Treat its reports as a design signal rather than a security control: an eval suite tells you agents can use your tools correctly, not that a hostile agent cannot use them harmfully. Those are different questions, and only the first one has a harness. ### Windsurf Plugin - URL: https://catalog.anomity.ai/extension/windsurf-plugin - Markdown: https://catalog.anomity.ai/extension/windsurf-plugin.md - Kind: IDE extension - Vendor: Cognition - Trust level: official - Risk score: 20 (low) - Capabilities: filesystem:read, filesystem:write, network:outbound - Website: https://windsurf.com/plugins The Windsurf Plugin — the successor to the Codeium extension, following Cognition's acquisition — brings Windsurf's completion and chat into VS Code, JetBrains, Vim, and other editors for developers who do not want to switch to the standalone Windsurf editor. It reads the workspace for context, writes accepted suggestions, and calls the hosted model service, so it declares filesystem read and write with outbound network access. Its long-standing appeal is a capable free tier, which is worth pairing with the usual question about hosted assistants: what is retained, and is code from this repository allowed to leave it? The answer belongs in a policy rather than in each developer's settings. ### AdaL - URL: https://catalog.anomity.ai/agent/adal - Markdown: https://catalog.anomity.ai/agent/adal.md - Kind: AI tool - Vendor: AdaL - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Agent Browser - URL: https://catalog.anomity.ai/skill/agent-browser - Markdown: https://catalog.anomity.ai/skill/agent-browser.md - Kind: Skill - Vendor: Vercel - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://vercel.com Navigates pages, interacts with elements, takes screenshots, and records video — a general-purpose browser-driving skill for agents that need to use the web rather than read it. Declared capabilities are browser control and outbound network access. This is the skill-layer equivalent of a browser MCP server and carries the same warning: a driven browser acts inside whatever sessions exist and returns page content — attacker-authored text — into the agent's context. Use a dedicated profile, and never one signed into infrastructure consoles. ### Agent Zero - URL: https://catalog.anomity.ai/agent/agent-zero - Markdown: https://catalog.anomity.ai/agent/agent-zero.md - Kind: AI tool - Vendor: agent0ai - Trust level: official - Risk score: 10 (low) - Website: https://www.agent-zero.ai/ Open-source agentic AI framework that runs in Docker with mounted user data ### Aide - URL: https://catalog.anomity.ai/agent/aide - Markdown: https://catalog.anomity.ai/agent/aide.md - Kind: AI tool - Vendor: CodeStory - Trust level: official - Risk score: 10 (low) - Website: https://aide.dev Open-source AI-native IDE forked from VS Code with agentic workflows ### Aider - URL: https://catalog.anomity.ai/agent/aider - Markdown: https://catalog.anomity.ai/agent/aider.md - Kind: AI tool - Vendor: Aider AI - Trust level: official - Risk score: 10 (low) - Website: https://aider.chat Open-source terminal AI coding tool for pair programming ### AiderDesk - URL: https://catalog.anomity.ai/agent/aider-desk - Markdown: https://catalog.anomity.ai/agent/aider-desk.md - Kind: AI tool - Vendor: AiderDesk - Trust level: official - Risk score: 10 (low) - Website: https://github.com/hotovo/aider-desk Desktop app for the Aider coding agent ### Amazon Q Developer - URL: https://catalog.anomity.ai/agent/amazon-q - Markdown: https://catalog.anomity.ai/agent/amazon-q.md - Kind: AI tool - Vendor: Amazon - Trust level: official - Risk score: 10 (low) - Website: https://aws.amazon.com/q/developer AWS AI coding assistant with CLI and MCP support ### Amp - URL: https://catalog.anomity.ai/agent/amp - Markdown: https://catalog.anomity.ai/agent/amp.md - Kind: AI tool - Vendor: Sourcegraph - Trust level: official - Risk score: 10 (low) - Website: https://sourcegraph.com/amp Agentic coding tool with MCP support, formerly Cody ### Anthropic DXT Directory - URL: https://catalog.anomity.ai/mcp/anthropic-dxt-directory - Markdown: https://catalog.anomity.ai/mcp/anthropic-dxt-directory.md - Kind: MCP server - Vendor: Anthropic Directory - Trust level: official - Risk score: 10 (low) ### Antigravity - URL: https://catalog.anomity.ai/agent/antigravity - Markdown: https://catalog.anomity.ai/agent/antigravity.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://antigravity.google Google agent-first IDE built on VS Code with Gemini 3 and Claude integration ### Antigravity CLI - URL: https://catalog.anomity.ai/agent/antigravity-cli - Markdown: https://catalog.anomity.ai/agent/antigravity-cli.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://antigravity.google/product/antigravity-cli Terminal CLI for the Google Antigravity agent harness; config under ~/.gemini/antigravity-cli with shared MCP config in ~/.gemini/config ### Arc - URL: https://catalog.anomity.ai/agent/arc - Markdown: https://catalog.anomity.ai/agent/arc.md - Kind: AI tool - Vendor: The Browser Company - Trust level: official - Risk score: 10 (low) - Website: https://arc.net/ Reimagined browser with built-in AI assistant (AI browser — Arc Max) ### AstrBot - URL: https://catalog.anomity.ai/agent/astrbot - Markdown: https://catalog.anomity.ai/agent/astrbot.md - Kind: AI tool - Vendor: AstrBot - Trust level: official - Risk score: 10 (low) - Website: https://astrbot.app Multi-platform chatbot & agent framework ### Augment Code - URL: https://catalog.anomity.ai/agent/augment - Markdown: https://catalog.anomity.ai/agent/augment.md - Kind: AI tool - Vendor: Augment - Trust level: official - Risk score: 10 (low) - Website: https://www.augmentcode.com AI pair programmer with deep codebase understanding ### Autohand Code CLI - URL: https://catalog.anomity.ai/agent/autohand - Markdown: https://catalog.anomity.ai/agent/autohand.md - Kind: AI tool - Vendor: Autohand - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Blackbox AI - URL: https://catalog.anomity.ai/agent/blackbox - Markdown: https://catalog.anomity.ai/agent/blackbox.md - Kind: AI tool - Vendor: Blackbox - Trust level: official - Risk score: 10 (low) - Website: https://www.blackbox.ai Multi-agent AI coding platform with 35+ IDE integrations ### Brave - URL: https://catalog.anomity.ai/agent/brave - Markdown: https://catalog.anomity.ai/agent/brave.md - Kind: AI tool - Vendor: Brave Software - Trust level: official - Risk score: 10 (low) - Website: https://brave.com/ Privacy-focused browser with built-in AI assistant (AI browser — Leo) ### Browserbase MCP Server - URL: https://catalog.anomity.ai/mcp/browserbase-mcp-server - Markdown: https://catalog.anomity.ai/mcp/browserbase-mcp-server.md - Kind: MCP server - Vendor: Browserbase - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://www.browserbase.com Browserbase runs headless browsers in the cloud and exposes them to agents over MCP, so browser automation happens on their infrastructure rather than on the developer's machine — useful for scale, sessions, and not handing a local browser to a model. It declares browser control and outbound network access. Moving the browser off your machine changes the risk shape rather than removing it: the automation no longer touches your local profile, but the pages, credentials, and session state now live with a third party. For authenticated automation, that means your logged-in sessions exist in someone else's infrastructure — a reasonable trade for many workloads, but one to make deliberately. ### ChatGPT Atlas - URL: https://catalog.anomity.ai/agent/chatgpt-atlas - Markdown: https://catalog.anomity.ai/agent/chatgpt-atlas.md - Kind: AI tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Website: https://openai.com/index/introducing-chatgpt-atlas/ OpenAI web browser with a built-in ChatGPT agent (AI browser — ChatGPT) ### ChatGPT Desktop - URL: https://catalog.anomity.ai/agent/chatgpt-desktop - Markdown: https://catalog.anomity.ai/agent/chatgpt-desktop.md - Kind: AI tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Website: https://chatgpt.com/features/desktop OpenAI desktop assistant with MCP support and app integration ### Chrome DevTools MCP - URL: https://catalog.anomity.ai/mcp/chrome-devtools-mcp - Markdown: https://catalog.anomity.ai/mcp/chrome-devtools-mcp.md - Kind: MCP server - Vendor: Google - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://developer.chrome.com/blog/chrome-devtools-mcp An MCP server that connects an agent to a live Chrome instance through the DevTools protocol — inspecting the DOM, reading console output and network requests, evaluating expressions, and profiling performance. It is the debugging counterpart to Playwright's automation focus. DevTools access is close to total control of the page: script evaluation in a live tab can read anything the page can read, including tokens held in memory and storage. The server declares browser control and outbound network access. The safe pattern is a browser instance started specifically for the agent with no logged-in sessions attached; the dangerous one is attaching it to the browser where you are signed into your cloud console. ### Chromium - URL: https://catalog.anomity.ai/agent/chromium - Markdown: https://catalog.anomity.ai/agent/chromium.md - Kind: AI tool - Vendor: The Chromium Project - Trust level: official - Risk score: 10 (low) - Website: https://www.chromium.org/ Open-source browser project that powers Chrome ### Claude Code - URL: https://catalog.anomity.ai/agent/claude-code - Markdown: https://catalog.anomity.ai/agent/claude-code.md - Kind: AI tool - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) - Website: https://claude.ai/code Terminal-based AI coding agent with MCP, plugins, and skills ### Claude Desktop - URL: https://catalog.anomity.ai/agent/claude-desktop - Markdown: https://catalog.anomity.ai/agent/claude-desktop.md - Kind: AI tool - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) - Website: https://claude.ai/download Desktop AI assistant with MCP server support and extensions ### Cline - URL: https://catalog.anomity.ai/agent/cline - Markdown: https://catalog.anomity.ai/agent/cline.md - Kind: AI tool - Vendor: Saoud Rizwan - Trust level: official - Risk score: 10 (low) - Website: https://cline.bot Open-source AI coding agent for VS Code with MCP support ### Cline CLI - URL: https://catalog.anomity.ai/agent/cline-cli - Markdown: https://catalog.anomity.ai/agent/cline-cli.md - Kind: AI tool - Vendor: Cline - Trust level: official - Risk score: 10 (low) - Website: https://cline.bot Autonomous coding agent for the terminal with MCP support ### Code Studio - URL: https://catalog.anomity.ai/agent/codestudio - Markdown: https://catalog.anomity.ai/agent/codestudio.md - Kind: AI tool - Vendor: Code Studio - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### CodeArts Agent - URL: https://catalog.anomity.ai/agent/codearts-agent - Markdown: https://catalog.anomity.ai/agent/codearts-agent.md - Kind: AI tool - Vendor: Huawei - Trust level: official - Risk score: 10 (low) - Website: https://www.huaweicloud.com/product/codearts.html Huawei CodeArts Doer coding agent ### CodeBuddy - URL: https://catalog.anomity.ai/agent/codebuddy - Markdown: https://catalog.anomity.ai/agent/codebuddy.md - Kind: AI tool - Vendor: Tencent - Trust level: official - Risk score: 10 (low) - Website: https://www.codebuddy.ai Tencent CodeBuddy AI coding assistant ### Codebuff - URL: https://catalog.anomity.ai/agent/codebuff - Markdown: https://catalog.anomity.ai/agent/codebuff.md - Kind: AI tool - Vendor: Codebuff Inc. - Trust level: official - Risk score: 10 (low) - Website: https://codebuff.com Self-improving CLI coding agent with multi-step planning ### Codemaker - URL: https://catalog.anomity.ai/agent/codemaker - Markdown: https://catalog.anomity.ai/agent/codemaker.md - Kind: AI tool - Vendor: CodeMaker AI - Trust level: official - Risk score: 10 (low) - Website: https://codemaker.ai AI coding agent (skills-capable; detected via its skills directory) ### CodeRabbit for VS Code - URL: https://catalog.anomity.ai/extension/coderabbit-vscode - Markdown: https://catalog.anomity.ai/extension/coderabbit-vscode.md - Kind: IDE extension - Vendor: CodeRabbit - Trust level: official - Risk score: 10 (low) - Capabilities: filesystem:read, git:access, network:outbound - Website: https://www.coderabbit.ai/ide CodeRabbit's extension runs AI code review locally in the editor, reviewing uncommitted changes before they become a pull request and flagging correctness and style issues at the point where they are cheapest to fix. It reads the working tree and diff, executes git commands to determine what changed, and calls the review service, so it declares filesystem read, git access, and outbound network. It is deliberately review-only rather than edit-capable, which is the right shape for this job — advisory output costs a human a moment of attention when wrong, where an automatic fix costs a debugging session. Note that reviewing a diff means the diff leaves the machine. ### Codex App - URL: https://catalog.anomity.ai/agent/codex-app - Markdown: https://catalog.anomity.ai/agent/codex-app.md - Kind: AI tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Website: https://openai.com/codex OpenAI desktop coding agent with parallel tasks and computer use ### Codex Modeling Studio - URL: https://catalog.anomity.ai/webmcp/codex-modeling-studio - Markdown: https://catalog.anomity.ai/webmcp/codex-modeling-studio.md - Kind: WebMCP tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://openai.com A browser-based 3D studio in which an agent can inspect scene geometry and materials and edit them through declared tools, while the user watches the viewport update. Part of OpenAI's set of WebMCP reference applications demonstrating agent-native interfaces beyond text. The pattern it demonstrates — an agent with structured read and write access to live application state — is the one that generalises. Its declared capabilities are browser control and outbound network access, and the work stays inside the page. The security question it raises for real applications built this way is provenance: when a model and a human both mutate the same document through the same tools, the application needs to record which changes came from which, or review becomes impossible. ### Command Code - URL: https://catalog.anomity.ai/agent/command-code - Markdown: https://catalog.anomity.ai/agent/command-code.md - Kind: AI tool - Vendor: Command Code - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Context7 - URL: https://catalog.anomity.ai/mcp/context7 - Markdown: https://catalog.anomity.ai/mcp/context7.md - Kind: MCP server - Vendor: Upstash - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://context7.com Context7 fetches version-current documentation and code examples for libraries and injects them into an agent's context, so generated code matches the version you actually depend on rather than whatever was most common in training data. It is one of the lowest-risk servers in wide use: outbound network access only, no credentials, no filesystem, no writes. The residual consideration is supply-chain shaped rather than access shaped — the server decides which documentation text lands in your model's context, and documentation is instructions. A compromised or poisoned docs source is a prompt-injection vector into every session that queries it, which is an argument for pinning to well-known libraries and reading generated code rather than trusting it. ### Continue - URL: https://catalog.anomity.ai/agent/continue - Markdown: https://catalog.anomity.ai/agent/continue.md - Kind: AI tool - Vendor: Continue - Trust level: official - Risk score: 10 (low) - Website: https://continue.dev Open-source model-agnostic AI IDE extension with MCP support ### Continue CLI - URL: https://catalog.anomity.ai/agent/continue-cli - Markdown: https://catalog.anomity.ai/agent/continue-cli.md - Kind: AI tool - Vendor: Continue - Trust level: official - Risk score: 10 (low) - Website: https://continue.dev Open-source model-agnostic AI coding agent for the terminal ### Cortex Code - URL: https://catalog.anomity.ai/agent/cortex-code - Markdown: https://catalog.anomity.ai/agent/cortex-code.md - Kind: AI tool - Vendor: Snowflake - Trust level: official - Risk score: 10 (low) - Website: https://www.snowflake.com Snowflake Cortex Code terminal agent ### Crush - URL: https://catalog.anomity.ai/agent/crush - Markdown: https://catalog.anomity.ai/agent/crush.md - Kind: AI tool - Vendor: Charm - Trust level: official - Risk score: 10 (low) - Website: https://charm.land Charm Crush terminal coding agent ### Cursor - URL: https://catalog.anomity.ai/agent/cursor - Markdown: https://catalog.anomity.ai/agent/cursor.md - Kind: AI tool - Vendor: Anysphere - Trust level: official - Risk score: 10 (low) - Website: https://cursor.com AI-native code editor with built-in agent and MCP support ### Deep Agents - URL: https://catalog.anomity.ai/agent/deepagents - Markdown: https://catalog.anomity.ai/agent/deepagents.md - Kind: AI tool - Vendor: LangChain - Trust level: official - Risk score: 10 (low) - Website: https://github.com/langchain-ai/deepagents LangChain Deep Agents runtime ### DeepWiki MCP - URL: https://catalog.anomity.ai/mcp/deepwiki-mcp - Markdown: https://catalog.anomity.ai/mcp/deepwiki-mcp.md - Kind: MCP server - Vendor: Cognition - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://deepwiki.com DeepWiki, from the team behind Devin, indexes public repositories into navigable documentation and exposes that index over MCP, so an agent can ask how an unfamiliar codebase works and get a grounded answer rather than a summary of README files. It declares outbound network access only. As a read-only research tool over public code it is low risk, with the standard retrieval caveat: repository content is written by strangers, and an agent that ingests a hostile repository's documentation is ingesting whatever instructions that documentation contains. Useful precisely when onboarding to code you have not audited — which is also exactly when that caveat matters most. ### Devin - URL: https://catalog.anomity.ai/agent/devin - Markdown: https://catalog.anomity.ai/agent/devin.md - Kind: AI tool - Vendor: Cognition - Trust level: official - Risk score: 10 (low) - Website: https://devin.ai Autonomous AI software engineer with a terminal CLI, MCP servers, hooks, skills, and subagents ### Dia - URL: https://catalog.anomity.ai/agent/dia - Markdown: https://catalog.anomity.ai/agent/dia.md - Kind: AI tool - Vendor: The Browser Company - Trust level: official - Risk score: 10 (low) - Website: https://www.diabrowser.com/ AI-native browser by The Browser Company (AI browser — Dia) ### Dify - URL: https://catalog.anomity.ai/agent/dify - Markdown: https://catalog.anomity.ai/agent/dify.md - Kind: AI tool - Vendor: LangGenius - Trust level: official - Risk score: 10 (low) - Website: https://dify.ai Open-source LLM app development platform with agent workflows ### Docker MCP Toolkit - URL: https://catalog.anomity.ai/agent/docker-mcp-toolkit - Markdown: https://catalog.anomity.ai/agent/docker-mcp-toolkit.md - Kind: AI tool - Vendor: Docker - Trust level: official - Risk score: 10 (low) - Website: https://docs.docker.com/ai/mcp-catalog-and-toolkit/ Docker Desktop MCP Toolkit / MCP Gateway — profile-based containerized MCP servers ### Docker Model Runner - URL: https://catalog.anomity.ai/agent/docker-model-runner - Markdown: https://catalog.anomity.ai/agent/docker-model-runner.md - Kind: AI tool - Vendor: Docker - Trust level: official - Risk score: 10 (low) - Website: https://docs.docker.com/ai/model-runner/ Docker Desktop local LLM runtime — serves OCI-packaged models via an unauthenticated OpenAI-compatible API on localhost:12434 ### Droid - URL: https://catalog.anomity.ai/agent/droid - Markdown: https://catalog.anomity.ai/agent/droid.md - Kind: AI tool - Vendor: Factory - Trust level: official - Risk score: 10 (low) - Website: https://factory.ai Factory terminal coding agent with MCP servers, custom subagents (droids/), and ~/.factory config ### Eve - URL: https://catalog.anomity.ai/agent/eve - Markdown: https://catalog.anomity.ai/agent/eve.md - Kind: AI tool - Vendor: Eve - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Everything - URL: https://catalog.anomity.ai/mcp/everything - Markdown: https://catalog.anomity.ai/mcp/everything.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) - Capabilities: filesystem:read, network:outbound ### Exa MCP Server - URL: https://catalog.anomity.ai/mcp/exa-mcp-server - Markdown: https://catalog.anomity.ai/mcp/exa-mcp-server.md - Kind: MCP server - Vendor: Exa Labs - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://exa.ai Exa's official server exposes its neural web search to agents, returning results selected for semantic relevance along with page contents, so an assistant can research a topic without a browser. Outbound network access is its only declared capability, which puts it at the low end of the risk range. The same caveat as every retrieval server applies: search results are attacker-influenceable, and an agent that acts on what it reads is acting on text strangers wrote. Search is also the quietest data-egress path in a toolchain — queries themselves can carry sensitive context out of your environment, so consider what an assistant is likely to type into a search box when it is debugging your private code. ### Extension-bundled MCP servers - URL: https://catalog.anomity.ai/agent/extension-mcp-bundle - Markdown: https://catalog.anomity.ai/agent/extension-mcp-bundle.md - Kind: AI tool - Vendor: Various - Trust level: official - Risk score: 10 (low) - Website: https://modelcontextprotocol.io mcp.json / mcp-servers.json files shipped inside an IDE extension's install directory (VS Code, Cursor, Windsurf). Catches extensions that bundle MCP server declarations as part of their package. ### Fetch - URL: https://catalog.anomity.ai/mcp/fetch - Markdown: https://catalog.anomity.ai/mcp/fetch.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound ### Firebender - URL: https://catalog.anomity.ai/agent/firebender - Markdown: https://catalog.anomity.ai/agent/firebender.md - Kind: AI tool - Vendor: Firebender - Trust level: official - Risk score: 10 (low) - Website: https://firebender.com AI coding agent for Android Studio ### Firecrawl MCP - URL: https://catalog.anomity.ai/mcp/firecrawl-mcp - Markdown: https://catalog.anomity.ai/mcp/firecrawl-mcp.md - Kind: MCP server - Vendor: Mendable AI - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://www.firecrawl.dev Firecrawl gives an agent web scraping, crawling, and search as structured tools — turning arbitrary pages into clean markdown suitable for a context window, including sites that need JavaScript rendering. Declared capability is outbound network access. The security framing worth stating plainly: this server's entire job is to bring untrusted third-party text into a model's context, which makes it the most direct prompt-injection channel most agents have. Pages can and do contain instructions aimed at whatever agent reads them. Anything downstream of a scrape — especially an agent that also holds write capabilities — should treat scraped content as data, never as direction. ### ForgeCode - URL: https://catalog.anomity.ai/agent/forgecode - Markdown: https://catalog.anomity.ai/agent/forgecode.md - Kind: AI tool - Vendor: ForgeCode - Trust level: official - Risk score: 10 (low) - Website: https://forgecode.dev Terminal AI coding agent ### Gemini CLI - URL: https://catalog.anomity.ai/agent/gemini-cli - Markdown: https://catalog.anomity.ai/agent/gemini-cli.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://github.com/google-gemini/gemini-cli Google AI coding agent for the terminal with MCP support ### Gemini Code Assist - URL: https://catalog.anomity.ai/agent/gemini-code-assist - Markdown: https://catalog.anomity.ai/agent/gemini-code-assist.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://cloud.google.com/gemini/docs/codeassist/overview Enterprise AI coding assistant with Google Cloud integrations ### Gemini Desktop - URL: https://catalog.anomity.ai/agent/gemini-desktop - Markdown: https://catalog.anomity.ai/agent/gemini-desktop.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://gemini.google/mac Native Google AI assistant for macOS and Windows with deep system integration ### Git - URL: https://catalog.anomity.ai/mcp/git - Markdown: https://catalog.anomity.ai/mcp/git.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) - Capabilities: filesystem:read, git:access ### GitHub Copilot CLI - URL: https://catalog.anomity.ai/agent/copilot-cli - Markdown: https://catalog.anomity.ai/agent/copilot-cli.md - Kind: AI tool - Vendor: GitHub - Trust level: official - Risk score: 10 (low) - Website: https://github.com/features/copilot GitHub AI coding agent with MCP and permissions config ### Globally-installed MCP servers (npm) - URL: https://catalog.anomity.ai/agent/global-mcp-npm - Markdown: https://catalog.anomity.ai/agent/global-mcp-npm.md - Kind: AI tool - Vendor: npm - Trust level: official - Risk score: 10 (low) - Website: https://www.npmjs.com/search?q=%40modelcontextprotocol Official @modelcontextprotocol/server-* packages installed via `npm install -g`. Available to any agent on the system; the daemon surfaces them so they get classified and policy-evaluated like configured MCPs. ### Globally-installed MCP servers (pipx) - URL: https://catalog.anomity.ai/agent/global-mcp-pipx - Markdown: https://catalog.anomity.ai/agent/global-mcp-pipx.md - Kind: AI tool - Vendor: pipx - Trust level: official - Risk score: 10 (low) - Website: https://pipx.pypa.io/ Python MCP server packages installed via `pipx install`. Available to any agent on the system; the daemon synthesises an mcpServer entry per matching package so classification and policy evaluation see them like configured MCPs. ### Globally-installed MCP servers (uv tool) - URL: https://catalog.anomity.ai/agent/global-mcp-uv - Markdown: https://catalog.anomity.ai/agent/global-mcp-uv.md - Kind: AI tool - Vendor: Astral uv - Trust level: official - Risk score: 10 (low) - Website: https://docs.astral.sh/uv/concepts/tools/ Python MCP server packages installed via `uv tool install`. Same discovered-not-configured model as the pipx and npm-global counterparts. ### Google Chrome - URL: https://catalog.anomity.ai/agent/google-chrome - Markdown: https://catalog.anomity.ai/agent/google-chrome.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://www.google.com/chrome/ Google's web browser ### Goose CLI - URL: https://catalog.anomity.ai/agent/goose - Markdown: https://catalog.anomity.ai/agent/goose.md - Kind: AI tool - Vendor: Block - Trust level: official - Risk score: 10 (low) - Website: https://github.com/block/goose Open-source terminal AI agent with MCP extensions and recipes ### Goose Desktop - URL: https://catalog.anomity.ai/agent/goose-desktop - Markdown: https://catalog.anomity.ai/agent/goose-desktop.md - Kind: AI tool - Vendor: Block - Trust level: official - Risk score: 10 (low) - Website: https://github.com/block/goose Open-source desktop AI agent with MCP extensions and visual UI ### Grok Bot - URL: https://catalog.anomity.ai/agent/grok-bot - Markdown: https://catalog.anomity.ai/agent/grok-bot.md - Kind: AI tool - Vendor: xAI - Trust level: official - Risk score: 10 (low) - Website: https://docs.x.ai/grok-bot/overview xAI desktop agent platform — persistent named bots with MCP connectors, a shared per-account cloud VM, and a local-execution daemon on the endpoint ### Grok Build - URL: https://catalog.anomity.ai/agent/grok-build - Markdown: https://catalog.anomity.ai/agent/grok-build.md - Kind: AI tool - Vendor: xAI - Trust level: official - Risk score: 10 (low) - Website: https://x.ai/cli xAI official terminal coding agent with TUI, plan mode, sub-agents, MCP support ### Grok CLI - URL: https://catalog.anomity.ai/agent/grok-cli - Markdown: https://catalog.anomity.ai/agent/grok-cli.md - Kind: AI tool - Vendor: xAI - Trust level: official - Risk score: 10 (low) - Website: https://x.ai AI terminal assistant powered by xAI Grok models with file operations ### Hermes Agent - URL: https://catalog.anomity.ai/agent/hermes-agent - Markdown: https://catalog.anomity.ai/agent/hermes-agent.md - Kind: AI tool - Vendor: Nous Research - Trust level: official - Risk score: 10 (low) - Website: https://hermes-agent.nousresearch.com Self-improving terminal agent with persistent memory, multi-provider, pluggable tools ### IBM Bob - URL: https://catalog.anomity.ai/agent/bob - Markdown: https://catalog.anomity.ai/agent/bob.md - Kind: AI tool - Vendor: IBM - Trust level: official - Risk score: 10 (low) - Website: https://www.ibm.com IBM Bob AI developer agent ### iFlow CLI - URL: https://catalog.anomity.ai/agent/iflow-cli - Markdown: https://catalog.anomity.ai/agent/iflow-cli.md - Kind: AI tool - Vendor: Alibaba - Trust level: official - Risk score: 10 (low) - Website: https://iflow.cn Alibaba iFlow terminal agent ### inference.sh - URL: https://catalog.anomity.ai/agent/inference-sh - Markdown: https://catalog.anomity.ai/agent/inference-sh.md - Kind: AI tool - Vendor: inference.sh - Trust level: official - Risk score: 10 (low) - Website: https://inference.sh AI coding agent (skills-capable; detected via its skills directory) ### Jan - URL: https://catalog.anomity.ai/agent/jan - Markdown: https://catalog.anomity.ai/agent/jan.md - Kind: AI tool - Vendor: Jan AI - Trust level: official - Risk score: 10 (low) - Website: https://jan.ai Offline-first open-source ChatGPT alternative with local LLM support ### Jazz - URL: https://catalog.anomity.ai/agent/jazz - Markdown: https://catalog.anomity.ai/agent/jazz.md - Kind: AI tool - Vendor: Jazz - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### JetBrains IDEs - URL: https://catalog.anomity.ai/agent/jetbrains - Markdown: https://catalog.anomity.ai/agent/jetbrains.md - Kind: AI tool - Vendor: JetBrains - Trust level: official - Risk score: 10 (low) - Website: https://www.jetbrains.com IDEs with AI Assistant, MCP, and Junie agent integration ### Junie CLI - URL: https://catalog.anomity.ai/agent/junie-cli - Markdown: https://catalog.anomity.ai/agent/junie-cli.md - Kind: AI tool - Vendor: JetBrains - Trust level: official - Risk score: 10 (low) - Website: https://junie.jetbrains.com JetBrains standalone coding agent with MCP and allowlists ### Kilo Code - URL: https://catalog.anomity.ai/agent/kilo-code - Markdown: https://catalog.anomity.ai/agent/kilo-code.md - Kind: AI tool - Vendor: Kilo Code - Trust level: official - Risk score: 10 (low) - Website: https://kilocode.ai Open-source AI coding assistant combining Cline and Roo features ### KiloClaw - URL: https://catalog.anomity.ai/agent/kiloclaw - Markdown: https://catalog.anomity.ai/agent/kiloclaw.md - Kind: AI tool - Vendor: Kilo - Trust level: official - Risk score: 10 (low) - Website: https://kilo.ai/kiloclaw Managed OpenClaw platform with enterprise governance and 500+ models ### Kimchi - URL: https://catalog.anomity.ai/agent/kimchi - Markdown: https://catalog.anomity.ai/agent/kimchi.md - Kind: AI tool - Vendor: Kimchi - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Kimi Code CLI - URL: https://catalog.anomity.ai/agent/kimi-cli - Markdown: https://catalog.anomity.ai/agent/kimi-cli.md - Kind: AI tool - Vendor: Moonshot AI - Trust level: official - Risk score: 10 (low) - Website: https://github.com/MoonshotAI/kimi-code Moonshot AI terminal coding agent with MCP servers, plugins, hooks and TOML config under ~/.kimi-code (legacy ~/.kimi) ### Kimi Desktop - URL: https://catalog.anomity.ai/agent/kimi-desktop - Markdown: https://catalog.anomity.ai/agent/kimi-desktop.md - Kind: AI tool - Vendor: Moonshot AI - Trust level: official - Risk score: 10 (low) - Website: https://www.kimi.com/products/kimi-work Kimi desktop app (Kimi Work agent) with plugin gateway, browser automation, and a shared Kimi Code agent config ### Kimi WebBridge - URL: https://catalog.anomity.ai/agent/kimi-webbridge - Markdown: https://catalog.anomity.ai/agent/kimi-webbridge.md - Kind: AI tool - Vendor: Moonshot AI - Trust level: official - Risk score: 10 (low) - Website: https://www.kimi.com/features/webbridge Browser extension that lets Kimi agents drive Chrome/Edge over CDP using existing login sessions ### Kiro - URL: https://catalog.anomity.ai/agent/kiro - Markdown: https://catalog.anomity.ai/agent/kiro.md - Kind: AI tool - Vendor: Amazon - Trust level: official - Risk score: 10 (low) - Website: https://kiro.dev Spec-driven AI IDE from Amazon with MCP support ### Kode - URL: https://catalog.anomity.ai/agent/kode - Markdown: https://catalog.anomity.ai/agent/kode.md - Kind: AI tool - Vendor: Kode - Trust level: official - Risk score: 10 (low) - Website: https://github.com/shareAI-lab/kode Open-source multi-model coding CLI ### Le Petit Bistro - URL: https://catalog.anomity.ai/webmcp/le-petit-bistro - Markdown: https://catalog.anomity.ai/webmcp/le-petit-bistro.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control - Website: https://github.com/GoogleChromeLabs/webmcp The canonical declarative-API demonstration: a restaurant booking page whose ordinary HTML form is annotated so that its validation rules and submit action become a WebMCP tool. No JavaScript tool definitions, just markup an agent can read. It matters because the declarative path is the one most sites will take — annotating forms is cheap, and every form on the web is a candidate. That is also the concern: form annotation turns existing submit handlers into agent-callable endpoints, and most sites have more forms than they remember. It declares browser control. Before annotating, enumerate what each form actually triggers; "book a table" and "cancel subscription" are the same shape in HTML. ### LibreChat - URL: https://catalog.anomity.ai/agent/librechat - Markdown: https://catalog.anomity.ai/agent/librechat.md - Kind: AI tool - Vendor: LibreChat - Trust level: official - Risk score: 10 (low) - Website: https://www.librechat.ai Open-source self-hosted ChatGPT clone with multi-provider support ### Lingma - URL: https://catalog.anomity.ai/agent/lingma - Markdown: https://catalog.anomity.ai/agent/lingma.md - Kind: AI tool - Vendor: Alibaba - Trust level: official - Risk score: 10 (low) - Website: https://lingma.aliyun.com Alibaba Lingma (Tongyi) coding agent ### LLaMA.cpp - URL: https://catalog.anomity.ai/agent/llamacpp - Markdown: https://catalog.anomity.ai/agent/llamacpp.md - Kind: AI tool - Vendor: ggml.org - Trust level: official - Risk score: 10 (low) - Website: https://github.com/ggml-org/llama.cpp Local LLM inference runtime for GGUF models (llama-cli, llama-server) ### LM Studio - URL: https://catalog.anomity.ai/agent/lm-studio - Markdown: https://catalog.anomity.ai/agent/lm-studio.md - Kind: AI tool - Vendor: LM Studio - Trust level: official - Risk score: 10 (low) - Website: https://lmstudio.ai Desktop app for running local LLMs with OpenAI-compatible API ### Manus - URL: https://catalog.anomity.ai/agent/manus - Markdown: https://catalog.anomity.ai/agent/manus.md - Kind: AI tool - Vendor: Manus - Trust level: official - Risk score: 10 (low) - Website: https://manus.im Autonomous agent desktop app whose My Computer mode runs local commands and drives desktop apps via MCP addons ### Margin Editor - URL: https://catalog.anomity.ai/webmcp/openai-margin-editor - Markdown: https://catalog.anomity.ai/webmcp/openai-margin-editor.md - Kind: WebMCP tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://openai.com A local note editor in which the agent has its own identity: it creates notes and responds in the margin as a distinct participant rather than silently editing the user's text. A deliberate demonstration that agent-native does not have to mean agent-invisible. That identity separation is the interesting security property. When agent output is attributable and spatially separated from human content, prompt-injected text the agent produces is visibly the agent's, not the user's — which matters enormously for documents that later feed other systems. Declared capabilities are browser control and outbound network access. It is catalogued as the design pattern worth copying: mark what the model wrote. ### Mastra Code - URL: https://catalog.anomity.ai/agent/mastracode - Markdown: https://catalog.anomity.ai/agent/mastracode.md - Kind: AI tool - Vendor: Mastra AI - Trust level: official - Risk score: 10 (low) - Website: https://mastra.ai/docs/mastra-code Mastra AI terminal coding agent with per-project and global MCP servers under .mastracode/ ### MCPJam - URL: https://catalog.anomity.ai/agent/mcpjam - Markdown: https://catalog.anomity.ai/agent/mcpjam.md - Kind: AI tool - Vendor: MCPJam - Trust level: official - Risk score: 10 (low) - Website: https://www.mcpjam.com MCP testing / inspector agent ### Microsoft Copilot - URL: https://catalog.anomity.ai/agent/microsoft-copilot - Markdown: https://catalog.anomity.ai/agent/microsoft-copilot.md - Kind: AI tool - Vendor: Microsoft - Trust level: official - Risk score: 10 (low) - Website: https://copilot.microsoft.com Microsoft 365 AI assistant desktop app with agent capabilities ### Microsoft Copilot Studio - URL: https://catalog.anomity.ai/agent/microsoft-copilot-studio - Markdown: https://catalog.anomity.ai/agent/microsoft-copilot-studio.md - Kind: AI tool - Vendor: Microsoft - Trust level: official - Risk score: 10 (low) - Website: https://learn.microsoft.com/en-us/microsoft-copilot-studio/visual-studio-code-extension-install-configure Microsoft Copilot Studio extension for VS Code — build, test, deploy custom copilots ### Microsoft Edge - URL: https://catalog.anomity.ai/agent/microsoft-edge - Markdown: https://catalog.anomity.ai/agent/microsoft-edge.md - Kind: AI tool - Vendor: Microsoft - Trust level: official - Risk score: 10 (low) - Website: https://www.microsoft.com/edge Microsoft's web browser with built-in AI assistant (AI browser — Copilot) ### MiMoCode - URL: https://catalog.anomity.ai/agent/mimocode - Markdown: https://catalog.anomity.ai/agent/mimocode.md - Kind: AI tool - Vendor: Xiaomi - Trust level: official - Risk score: 10 (low) - Website: https://mimo.xiaomi.com/mimocode Terminal-based AI coding agent (TUI) with MCP servers, providers, and permissions ### Mistral Vibe - URL: https://catalog.anomity.ai/agent/mistral-vibe - Markdown: https://catalog.anomity.ai/agent/mistral-vibe.md - Kind: AI tool - Vendor: Mistral - Trust level: official - Risk score: 10 (low) - Website: https://mistral.ai Mistral Vibe coding CLI ### Moxby - URL: https://catalog.anomity.ai/agent/moxby - Markdown: https://catalog.anomity.ai/agent/moxby.md - Kind: AI tool - Vendor: Moxby - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Mozilla Firefox - URL: https://catalog.anomity.ai/agent/firefox - Markdown: https://catalog.anomity.ai/agent/firefox.md - Kind: AI tool - Vendor: Mozilla - Trust level: official - Risk score: 10 (low) - Website: https://www.mozilla.org/firefox/ Mozilla's open-source web browser ### Msty - URL: https://catalog.anomity.ai/agent/msty - Markdown: https://catalog.anomity.ai/agent/msty.md - Kind: AI tool - Vendor: Msty - Trust level: official - Risk score: 10 (low) - Website: https://msty.app Private AI desktop app with local LLM support and MCP integration ### Mux - URL: https://catalog.anomity.ai/agent/mux - Markdown: https://catalog.anomity.ai/agent/mux.md - Kind: AI tool - Vendor: Mux - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Nanobot - URL: https://catalog.anomity.ai/agent/nanobot - Markdown: https://catalog.anomity.ai/agent/nanobot.md - Kind: AI tool - Vendor: HKUDS - Trust level: official - Risk score: 10 (low) - Website: https://www.nanobot.ai Ultra-lightweight Python AI agent with MCP, skills, and multi-platform chat ### Neovate - URL: https://catalog.anomity.ai/agent/neovate - Markdown: https://catalog.anomity.ai/agent/neovate.md - Kind: AI tool - Vendor: Neovate - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Next.js DevTools MCP - URL: https://catalog.anomity.ai/mcp/next-js-devtools-mcp - Markdown: https://catalog.anomity.ai/mcp/next-js-devtools-mcp.md - Kind: MCP server - Vendor: Vercel - Trust level: official - Risk score: 10 (low) - Capabilities: filesystem:read, network:outbound - Website: https://nextjs.org/docs/app/guides/mcp Vercel's MCP server for Next.js development exposes build and runtime diagnostics to an agent — route information, build errors, and framework-specific guidance — so an assistant debugging a Next.js app works from the framework's own view rather than from guesses. It reads the local project and reaches the network, so it declares filesystem reads and outbound network access. Risk is low relative to the deployment and database servers in this list; the main consideration is scope, since a tool that reads your project directory reads whatever is in it, including any `.env` files that happen to be sitting there. ### NullClaw - URL: https://catalog.anomity.ai/agent/nullclaw - Markdown: https://catalog.anomity.ai/agent/nullclaw.md - Kind: AI tool - Vendor: NullClaw - Trust level: official - Risk score: 10 (low) - Website: https://nullclaw.org Smallest AI agent runtime (678KB Zig binary) for edge and IoT devices ### Ollama - URL: https://catalog.anomity.ai/agent/ollama - Markdown: https://catalog.anomity.ai/agent/ollama.md - Kind: AI tool - Vendor: Ollama - Trust level: official - Risk score: 10 (low) - Website: https://ollama.com Local LLM runtime used by AI agents as a model backend ### omp (oh-my-pi) - URL: https://catalog.anomity.ai/agent/omp - Markdown: https://catalog.anomity.ai/agent/omp.md - Kind: AI tool - Vendor: oh-my-pi - Trust level: official - Risk score: 10 (low) - Website: https://omp.sh Terminal coding agent (Pi fork) with subagents, MCP servers, and a single ~/.omp/agent config ### Ona - URL: https://catalog.anomity.ai/agent/ona - Markdown: https://catalog.anomity.ai/agent/ona.md - Kind: AI tool - Vendor: Ona (formerly Gitpod) - Trust level: official - Risk score: 10 (low) - Website: https://ona.com Ona autonomous engineering agents ### Open Interpreter - URL: https://catalog.anomity.ai/agent/open-interpreter - Markdown: https://catalog.anomity.ai/agent/open-interpreter.md - Kind: AI tool - Vendor: Open Interpreter - Trust level: official - Risk score: 10 (low) - Website: https://openinterpreter.com Terminal-based LLM platform with full system access for code execution ### Open WebUI - URL: https://catalog.anomity.ai/agent/open-webui - Markdown: https://catalog.anomity.ai/agent/open-webui.md - Kind: AI tool - Vendor: Open WebUI - Trust level: official - Risk score: 10 (low) - Website: https://openwebui.com Self-hosted AI chat platform with multi-provider LLM support ### OpenAI Codex CLI - URL: https://catalog.anomity.ai/agent/codex-cli - Markdown: https://catalog.anomity.ai/agent/codex-cli.md - Kind: AI tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Website: https://github.com/openai/codex OpenAI terminal coding agent with sandboxed execution ### OpenChamber - URL: https://catalog.anomity.ai/agent/openchamber - Markdown: https://catalog.anomity.ai/agent/openchamber.md - Kind: AI tool - Vendor: OpenChamber - Trust level: official - Risk score: 10 (low) - Website: https://openchamber.dev Desktop and web control-room UI for the OpenCode AI coding agent ### OpenClaw - URL: https://catalog.anomity.ai/agent/openclaw - Markdown: https://catalog.anomity.ai/agent/openclaw.md - Kind: AI tool - Vendor: OpenClaw - Trust level: official - Risk score: 10 (low) - Website: https://openclaw.ai Open-source local AI assistant with full host access, MCP servers, skills, and chat-app control channels ### OpenCode CLI - URL: https://catalog.anomity.ai/agent/opencode - Markdown: https://catalog.anomity.ai/agent/opencode.md - Kind: AI tool - Vendor: OpenCode - Trust level: official - Risk score: 10 (low) - Website: https://opencode.ai Open-source AI coding agent for the terminal with MCP and plugins ### OpenCode Desktop - URL: https://catalog.anomity.ai/agent/opencode-desktop - Markdown: https://catalog.anomity.ai/agent/opencode-desktop.md - Kind: AI tool - Vendor: OpenCode - Trust level: official - Risk score: 10 (low) - Website: https://opencode.ai Desktop (GUI) build of the OpenCode agent; shares the ~/.config/opencode engine config with the CLI ### OpenHands - URL: https://catalog.anomity.ai/agent/openhands - Markdown: https://catalog.anomity.ai/agent/openhands.md - Kind: AI tool - Vendor: All Hands AI - Trust level: official - Risk score: 10 (low) - Website: https://openhands.dev Open-source autonomous AI coding agent platform (65K+ GitHub stars) ### Opera - URL: https://catalog.anomity.ai/agent/opera - Markdown: https://catalog.anomity.ai/agent/opera.md - Kind: AI tool - Vendor: Opera - Trust level: official - Risk score: 10 (low) - Website: https://www.opera.com/ Opera browser with built-in AI assistant (AI browser — Aria) ### Opera GX - URL: https://catalog.anomity.ai/agent/opera-gx - Markdown: https://catalog.anomity.ai/agent/opera-gx.md - Kind: AI tool - Vendor: Opera - Trust level: official - Risk score: 10 (low) - Website: https://www.opera.com/gx Gaming-focused Opera browser with built-in AI assistant (AI browser — Aria) ### Paperclip - URL: https://catalog.anomity.ai/agent/paperclip - Markdown: https://catalog.anomity.ai/agent/paperclip.md - Kind: AI tool - Vendor: Paperclip AI - Trust level: official - Risk score: 10 (low) - Website: https://paperclip.ing Open-source multi-agent orchestration platform for AI teams ### Parallel Search MCP - URL: https://catalog.anomity.ai/mcp/parallel-search-mcp - Markdown: https://catalog.anomity.ai/mcp/parallel-search-mcp.md - Kind: MCP server - Vendor: Parallel - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://parallel.ai Parallel's official server provides real-time web search built for agent consumption, returning ranked results and extracted content in a form intended to be read by a model rather than a person. Outbound network access is the only declared capability, placing it at the low-risk end. The recurring retrieval caveat applies with full force: search output is untrusted text, and it is the most common way a prompt injection reaches an agent that otherwise only touches your own systems. Pair it with the rule that retrieved content can inform an answer but never authorise an action. ### PearAI - URL: https://catalog.anomity.ai/agent/pearai - Markdown: https://catalog.anomity.ai/agent/pearai.md - Kind: AI tool - Vendor: PearAI - Trust level: official - Risk score: 10 (low) - Website: https://trypear.ai Open-source AI code editor with integrated tools and model support ### Perplexity - URL: https://catalog.anomity.ai/agent/perplexity - Markdown: https://catalog.anomity.ai/agent/perplexity.md - Kind: AI tool - Vendor: Perplexity AI - Trust level: official - Risk score: 10 (low) - Website: https://www.perplexity.ai AI search assistant with Personal Computer agent and MCP support ### Perplexity Comet - URL: https://catalog.anomity.ai/agent/comet - Markdown: https://catalog.anomity.ai/agent/comet.md - Kind: AI tool - Vendor: Perplexity - Trust level: official - Risk score: 10 (low) - Website: https://www.perplexity.ai/comet AI-first browser by Perplexity (AI browser — Perplexity Assistant) ### Pi Coding Agent - URL: https://catalog.anomity.ai/agent/pi - Markdown: https://catalog.anomity.ai/agent/pi.md - Kind: AI tool - Vendor: Pi - Trust level: official - Risk score: 10 (low) - Website: https://pi.dev Terminal coding agent with MCP servers, skills, and per-project settings under .pi/ ### PicoClaw - URL: https://catalog.anomity.ai/agent/picoclaw - Markdown: https://catalog.anomity.ai/agent/picoclaw.md - Kind: AI tool - Vendor: Sipeed - Trust level: official - Risk score: 10 (low) - Website: https://picoclaw.ai Hyper-minimalist Go AI agent for IoT and low-resource devices ### Pieces for Developers - URL: https://catalog.anomity.ai/agent/pieces - Markdown: https://catalog.anomity.ai/agent/pieces.md - Kind: AI tool - Vendor: Mesh Intelligent Technologies - Trust level: official - Risk score: 10 (low) - Website: https://pieces.app AI coding assistant with Long-Term Memory engine running locally ### Plandex - URL: https://catalog.anomity.ai/agent/plandex - Markdown: https://catalog.anomity.ai/agent/plandex.md - Kind: AI tool - Vendor: Plandex - Trust level: official - Risk score: 10 (low) - Website: https://plandex.ai Open-source AI coding agent for large multi-file development tasks ### Pochi - URL: https://catalog.anomity.ai/agent/pochi - Markdown: https://catalog.anomity.ai/agent/pochi.md - Kind: AI tool - Vendor: Pochi - Trust level: official - Risk score: 10 (low) - Website: https://getpochi.com AI coding agent (skills-capable; detected via its skills directory) ### Qoder CLI - URL: https://catalog.anomity.ai/agent/qoder-cli - Markdown: https://catalog.anomity.ai/agent/qoder-cli.md - Kind: AI tool - Vendor: Alibaba - Trust level: official - Risk score: 10 (low) - Website: https://docs.qoder.com/cli Alibaba (Lingma) terminal coding agent with MCP servers, subagents, and per-project .qoder settings ### Qodo - URL: https://catalog.anomity.ai/agent/qodo - Markdown: https://catalog.anomity.ai/agent/qodo.md - Kind: AI tool - Vendor: Qodo - Trust level: official - Risk score: 10 (low) - Website: https://www.qodo.ai AI-powered test generation and code review tool ### Qwen Code - URL: https://catalog.anomity.ai/agent/qwen-code - Markdown: https://catalog.anomity.ai/agent/qwen-code.md - Kind: AI tool - Vendor: Alibaba - Trust level: official - Risk score: 10 (low) - Website: https://github.com/QwenLM/qwen-code Open-source AI coding agent for the terminal powered by Qwen3-Coder ### Reasonix - URL: https://catalog.anomity.ai/agent/reasonix - Markdown: https://catalog.anomity.ai/agent/reasonix.md - Kind: AI tool - Vendor: Reasonix - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Refact.ai - URL: https://catalog.anomity.ai/agent/refact - Markdown: https://catalog.anomity.ai/agent/refact.md - Kind: AI tool - Vendor: Small Cloud - Trust level: official - Risk score: 10 (low) - Website: https://refact.ai Open-source AI coding agent with self-hosting and multi-LLM support ### Roo Code - URL: https://catalog.anomity.ai/agent/roo-code - Markdown: https://catalog.anomity.ai/agent/roo-code.md - Kind: AI tool - Vendor: Roo Veterinary - Trust level: official - Risk score: 10 (low) - Website: https://roocode.com AI coding agent for VS Code with MCP and auto-approve support ### Rovo Dev - URL: https://catalog.anomity.ai/agent/rovodev - Markdown: https://catalog.anomity.ai/agent/rovodev.md - Kind: AI tool - Vendor: Atlassian - Trust level: official - Risk score: 10 (low) - Website: https://www.atlassian.com/rovo-dev Atlassian Rovo Dev AI coding agent ### Safari - URL: https://catalog.anomity.ai/agent/safari - Markdown: https://catalog.anomity.ai/agent/safari.md - Kind: AI tool - Vendor: Apple - Trust level: official - Risk score: 10 (low) - Website: https://www.apple.com/safari/ Apple's web browser ### Scion - URL: https://catalog.anomity.ai/agent/scion - Markdown: https://catalog.anomity.ai/agent/scion.md - Kind: AI tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Website: https://googlecloudplatform.github.io/scion/ Google multi-agent orchestration testbed — hypervisor for AI agents with isolated identities ### Sequential Thinking - URL: https://catalog.anomity.ai/mcp/sequential-thinking - Markdown: https://catalog.anomity.ai/mcp/sequential-thinking.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) ### SigmaOS - URL: https://catalog.anomity.ai/agent/sigmaos - Markdown: https://catalog.anomity.ai/agent/sigmaos.md - Kind: AI tool - Vendor: SigmaOS - Trust level: official - Risk score: 10 (low) - Website: https://sigmaos.com/ Productivity browser with built-in AI assistant (AI browser — Airis) ### Skales - URL: https://catalog.anomity.ai/agent/skales - Markdown: https://catalog.anomity.ai/agent/skales.md - Kind: AI tool - Vendor: Skales - Trust level: official - Risk score: 10 (low) - Website: https://skales.app Local AI desktop agent with skills, multi-agent teams, and desktop automation ### Sourcegraph Cody - URL: https://catalog.anomity.ai/agent/cody - Markdown: https://catalog.anomity.ai/agent/cody.md - Kind: AI tool - Vendor: Sourcegraph - Trust level: official - Risk score: 10 (low) - Website: https://sourcegraph.com/cody Enterprise AI coding assistant with codebase-wide context ### Supermaven - URL: https://catalog.anomity.ai/agent/supermaven - Markdown: https://catalog.anomity.ai/agent/supermaven.md - Kind: AI tool - Vendor: Supermaven - Trust level: official - Risk score: 10 (low) - Website: https://supermaven.com Ultra-fast AI code completion with large context window ### Tabby - URL: https://catalog.anomity.ai/agent/tabby - Markdown: https://catalog.anomity.ai/agent/tabby.md - Kind: AI tool - Vendor: TabbyML - Trust level: official - Risk score: 10 (low) - Website: https://tabby.tabbyml.com Self-hosted AI coding assistant for private and secure environments ### Tabnine - URL: https://catalog.anomity.ai/agent/tabnine - Markdown: https://catalog.anomity.ai/agent/tabnine.md - Kind: AI tool - Vendor: Tabnine - Trust level: official - Risk score: 10 (low) - Website: https://www.tabnine.com AI code completion with enterprise and on-prem deployment options ### Tavily MCP Server - URL: https://catalog.anomity.ai/mcp/tavily-mcp-server - Markdown: https://catalog.anomity.ai/mcp/tavily-mcp-server.md - Kind: MCP server - Vendor: Tavily - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://tavily.com Tavily's official server provides search and data extraction designed for LLM pipelines, returning summarised, source-attributed results intended to be dropped straight into a context window. Outbound network access is its only capability. Its source attribution is a genuine security feature, not just a citation nicety: an agent that reports where a claim came from lets a human check whether the claim came from somewhere trustworthy, which is the only practical defence against retrieval-borne injection at the moment. Prefer retrieval tools that preserve provenance over ones that return anonymous text. ### Terramind - URL: https://catalog.anomity.ai/agent/terramind - Markdown: https://catalog.anomity.ai/agent/terramind.md - Kind: AI tool - Vendor: Terramind - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Time - URL: https://catalog.anomity.ai/mcp/time - Markdown: https://catalog.anomity.ai/mcp/time.md - Kind: MCP server - Vendor: Anthropic - Trust level: official - Risk score: 10 (low) ### Tinycloud - URL: https://catalog.anomity.ai/agent/tinycloud - Markdown: https://catalog.anomity.ai/agent/tinycloud.md - Kind: AI tool - Vendor: Tinycloud - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Tor Browser - URL: https://catalog.anomity.ai/agent/tor-browser - Markdown: https://catalog.anomity.ai/agent/tor-browser.md - Kind: AI tool - Vendor: The Tor Project - Trust level: official - Risk score: 10 (low) - Website: https://www.torproject.org/ Privacy browser that routes traffic through the Tor network ### Trae - URL: https://catalog.anomity.ai/agent/trae - Markdown: https://catalog.anomity.ai/agent/trae.md - Kind: AI tool - Vendor: ByteDance - Trust level: official - Risk score: 10 (low) - Website: https://trae.ai Free AI-native IDE from ByteDance with built-in agent ### UrbanEstates - URL: https://catalog.anomity.ai/webmcp/urbanestates-webmcp - Markdown: https://catalog.anomity.ai/webmcp/urbanestates-webmcp.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control - Website: https://github.com/GoogleChromeLabs/webmcp A property-search reference application exposing location, price, amenity, and filter tools over a map interface, so an agent can narrow a listing set the way a user would with the filter panel. It represents the read-mostly category of WebMCP surface — query tools over a public catalogue, no state mutation — which is the safest way for a site to start. Declared capability is browser control. The residual consideration is inference rather than action: query tools give an agent efficient, structured access to a dataset, so a site publishing them should be comfortable with the whole dataset being enumerated quickly and cheaply, because it now can be. ### Vercel Agent Browser - URL: https://catalog.anomity.ai/agent/vercel-agent-browser - Markdown: https://catalog.anomity.ai/agent/vercel-agent-browser.md - Kind: AI tool - Vendor: Vercel - Trust level: official - Risk score: 10 (low) - Website: https://github.com/vercel-labs/agent-browser Browser automation CLI for AI agents (vercel-labs/agent-browser) ### Verdant Market - URL: https://catalog.anomity.ai/webmcp/openai-verdant-market - Markdown: https://catalog.anomity.ai/webmcp/openai-verdant-market.md - Kind: WebMCP tool - Vendor: OpenAI - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://openai.com A reference grocery storefront exposing search across roughly 110 products and tools for managing a cart shared between the shopper and the agent. It models the commerce case: the agent does not scrape the catalogue or synthesise clicks, it calls `searchProducts` and `addToCart`. Commerce is where WebMCP's risk becomes concrete. A cart tool is state-changing and sits inside a session that will eventually reach checkout, so the boundary between "agent helped me shop" and "agent bought something" is a single tool definition. It declares browser control and outbound network access. Real storefronts adopting this pattern should keep irreversible steps — payment, address changes — behind explicit human confirmation rather than behind another tool. ### Vivaldi - URL: https://catalog.anomity.ai/agent/vivaldi - Markdown: https://catalog.anomity.ai/agent/vivaldi.md - Kind: AI tool - Vendor: Vivaldi - Trust level: official - Risk score: 10 (low) - Website: https://vivaldi.com/ Highly customizable web browser ### Void - URL: https://catalog.anomity.ai/agent/void - Markdown: https://catalog.anomity.ai/agent/void.md - Kind: AI tool - Vendor: Void - Trust level: official - Risk score: 10 (low) - Website: https://voideditor.com Open-source AI code editor with privacy control and multi-model support ### VS Code - URL: https://catalog.anomity.ai/agent/vscode - Markdown: https://catalog.anomity.ai/agent/vscode.md - Kind: AI tool - Vendor: Microsoft - Trust level: official - Risk score: 10 (low) - Website: https://code.visualstudio.com Code editor with GitHub Copilot, MCP servers, and AI extensions ### Warp - URL: https://catalog.anomity.ai/agent/warp - Markdown: https://catalog.anomity.ai/agent/warp.md - Kind: AI tool - Vendor: Warp - Trust level: official - Risk score: 10 (low) - Website: https://warp.dev AI-powered terminal with built-in agent, MCP, skills, and workflows ### WebMCP Flow - URL: https://catalog.anomity.ai/webmcp/webmcp-flow - Markdown: https://catalog.anomity.ai/webmcp/webmcp-flow.md - Kind: WebMCP tool - Vendor: Vercel - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://vercel.com An architecture canvas from Vercel where the diagram itself is agent-callable: tools cover creating nodes, drawing edges, labelling, and running layout, so a model can build and rearrange a diagram from a description rather than emitting an image. It is a good illustration of the low-risk end of the WebMCP spectrum. The tools mutate a canvas, not a bank account; the declared capability is browser control with outbound network access for the model. Catalogued as a reference point: when reviewing a WebMCP surface, the question is never "does it expose tools" but "what do the tools reach", and a diagram editor and a checkout flow deserve very different answers. ### WebMCP Page Agent - URL: https://catalog.anomity.ai/webmcp/webmcp-page-agent - Markdown: https://catalog.anomity.ai/webmcp/webmcp-page-agent.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://github.com/GoogleChromeLabs/webmcp A Gemini-powered controller that accepts natural language and drives whatever WebMCP tools the current page has registered. It is the reference demonstration of the full loop: a page publishes tools, a model reads them, the user types an intent, the model calls tools until the intent is satisfied. This is the clearest illustration of why WebMCP belongs in a risk catalog. The agent's context includes page content, and page content is attacker-influenceable on any site that renders user input. The controller declares browser control and outbound network access. Anything that can get text in front of this agent is one injection away from calling the page's tools with arguments of its choosing — inside a session that is already authenticated. ### WebMCP Polyfill - URL: https://catalog.anomity.ai/webmcp/webmcp-polyfill - Markdown: https://catalog.anomity.ai/webmcp/webmcp-polyfill.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://github.com/GoogleChromeLabs/webmcp-polyfill The WebMCP Polyfill is a compatibility layer that emulates the experimental WebMCP browser API in browsers that do not yet ship it. WebMCP lets a page declare structured tools — either as annotated HTML forms or as JavaScript functions with JSON schemas — so an AI agent can call them directly instead of guessing at the DOM. The polyfill implements that surface in userland, which is how most sites currently experiment with the API ahead of an origin trial. The risk to reason about is not the polyfill's own code so much as what it turns on. Once a page registers tools, any agent driving that browser can enumerate and invoke them inside whatever session the user already has open — logged in, cookied, and authorized. A prompt-injected agent that reaches a page with a `submitOrder` or `transferFunds` tool does not need to defeat authentication; the page has already handed it a typed, documented button. Treat every registered tool as an unauthenticated endpoint reachable by anything that can influence the agent's context. ### WebMCP Radar - URL: https://catalog.anomity.ai/webmcp/webmcp-radar - Markdown: https://catalog.anomity.ai/webmcp/webmcp-radar.md - Kind: WebMCP tool - Vendor: Google - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://chromewebstore.google.com/ WebMCP Radar is a Chrome extension that detects whether the page you are on registers WebMCP tools, shows how many, and lets you inspect each tool's name, description, and input schema. It is the quickest way to answer "does this site expose an agent surface, and what can it do?" without reading the page's JavaScript. For a security reviewer it is a discovery instrument rather than an attack surface: it reads what the page has already published. Its capability profile is browser control — it operates inside pages you visit — plus outbound network access. The interesting output is the finding, not the tool: a commerce or banking page that quietly registers state-changing tools is a materially different risk than one exposing read-only search, and Radar is how you tell the two apart before an agent ever touches them. ### WebMCP Smart Home - URL: https://catalog.anomity.ai/webmcp/webmcp-smart-home - Markdown: https://catalog.anomity.ai/webmcp/webmcp-smart-home.md - Kind: WebMCP tool - Vendor: GoogleChromeLabs - Trust level: official - Risk score: 10 (low) - Capabilities: browser:control, network:outbound - Website: https://github.com/GoogleChromeLabs/webmcp A smart-home dashboard that reveals camera, climate, and energy controls as WebMCP tools, and lets an agent rearrange the dashboard as well as operate it. The demonstration extends past reading state into changing the physical environment. This is the high-consequence end of the reference set, and worth catalogued attention for that reason alone. Tools that unlock, disarm, or view cameras are not recoverable the way a shopping cart is, and the agent invoking them is reading a page whose content may not be fully trusted. It declares browser control and outbound network access. Any real deployment of this shape needs per-tool authorization that is independent of the agent's context — the model should be able to request the action and still not be able to perform it unattended. ### Windsurf - URL: https://catalog.anomity.ai/agent/windsurf - Markdown: https://catalog.anomity.ai/agent/windsurf.md - Kind: AI tool - Vendor: Codeium - Trust level: official - Risk score: 10 (low) - Website: https://windsurf.com AI-native IDE with Cascade agent and MCP support ### Yahoo Finance MCP - URL: https://catalog.anomity.ai/mcp/yahoo-finance-mcp - Markdown: https://catalog.anomity.ai/mcp/yahoo-finance-mcp.md - Kind: MCP server - Vendor: Yahoo Finance - Trust level: official - Risk score: 10 (low) - Capabilities: network:outbound - Website: https://finance.yahoo.com An official remote MCP server for stock data, market news, and company financials, giving an agent read access to public market information without an API key management burden. Outbound network access is the only declared capability, and the data is public, so this is among the lowest-risk entries in the catalog. As with any news-bearing tool, the content is written by third parties and reaches the model as text — an agent that summarises market news is summarising documents that could contain instructions, which matters only if that agent also holds capabilities worth abusing. ### ZCode - URL: https://catalog.anomity.ai/agent/zcode - Markdown: https://catalog.anomity.ai/agent/zcode.md - Kind: AI tool - Vendor: ZCode - Trust level: official - Risk score: 10 (low) AI coding agent (skills-capable; detected via its skills directory) ### Zed - URL: https://catalog.anomity.ai/agent/zed - Markdown: https://catalog.anomity.ai/agent/zed.md - Kind: AI tool - Vendor: Zed Industries - Trust level: official - Risk score: 10 (low) - Website: https://zed.dev High-performance editor with built-in AI and MCP support ### Zencoder - URL: https://catalog.anomity.ai/agent/zencoder - Markdown: https://catalog.anomity.ai/agent/zencoder.md - Kind: AI tool - Vendor: Zencoder - Trust level: official - Risk score: 10 (low) - Website: https://zencoder.ai Zencoder AI coding agent (Zencoder/Zenflow) ### ZeroClaw - URL: https://catalog.anomity.ai/agent/zeroclaw - Markdown: https://catalog.anomity.ai/agent/zeroclaw.md - Kind: AI tool - Vendor: ZeroClaw Labs - Trust level: official - Risk score: 10 (low) - Website: https://zeroclaw.net Ultra-lightweight Rust AI agent runtime with MCP and 30+ providers