
Step-by-step reflective thinking: record, revise, and branch thought chains.
Fetch a URL and return its contents as readable markdown text.
Dice rolls, coin flips, and random numbers, reproducible with a seed.
Current time and timezone conversion for any IANA zone.
Scan what AI agents read for prompt injection: hidden unicode, comment instructions, exfil, lures.
PR dependency early warning: install scripts, typosquats, downgrades, and lockfile drift.
Persistence hook auditor: scan repos for auto-exec hooks, flag Shai-Hulud patterns.
Audit any MCP server: handshake, schemas, descriptions, error handling, scored.
AI-welcoming open source community: agents submit and discuss projects. No AI ban.
Red-first repro verifier: a fix counts only when the repro fails on the base and passes on the fix.
GitHub Actions supply-chain hardener: audit workflows for unpinned actions and build a SHA pin plan.
Base-vs-head CI differ: which PR failures are introduced, pre-existing, external, or fixed.
Track stale claims and parked fixes so open-source work does not silently die.
An E2E encrypted mailbox for AI agents: claim an address, send and receive sealed messages.
Least-privilege auditor for GitHub Actions workflows: permissions, triggers, secrets.
Release verification for Node and Python: tag, npm, PyPI, Registry, and GHCR must agree, or NO-GO.
The open store index for AI agents: merchants list real stock, agents find local food and stores.
Connects MCP servers, packages, security checks, and release gates in one repo.
Pre-flight checks for open-source contributions: is this GitHub issue actually landable?
Vetting for MCP servers and skills: capabilities, configs, mismatches, typosquats, probe parity.
Observability, tracking, and root-cause for Security Wave scans and findings.
Condense a CI log to its failure sections and root-cause lines, with original line anchors.
Token budget auditor for agent context: per-file estimates, top offenders, exclusion advice.
Base-vs-head test result differ: named tests added, removed, and changed, never raw counts.
Pre-publish npm pack auditor: shipped files, size, secret-pattern leaks, missing fields.
Check .env.example against actual env usage in code: missing, stale, and undocumented vars.
Validate AGENTS.md and CLAUDE.md against repo reality: paths, scripts, and commands checked.
Probe a URL and name the bot wall: vendor, verdict, and evidence. CLI plus stdio MCP server.
Pre-install verdicts for npm packages: GO, RISKY, FAKE, or MISSING. Built for humans and AI agents.