Best Coding Plugins, Skills, and MCP Servers in 2026
Research-backed coding plugins, skills, and MCP servers with platform availability and direct setup routes.
Updated July 25, 2026
These extensions give coding agents more discipline or more context. Workflows enforce a process for planning, testing, and review; integrations connect the agent to your libraries, browser, database, or development platform. The choice is how much structure and access each task needs.
A connection between the agent and your GitHub: repositories, issues, pull requests, Actions, releases, and security data. With the right access, the agent can inspect code across repositories, triage issues, review and update pull requests, diagnose CI failures, and prepare releases.
The payoff is that context stops being copied into the chat by hand. That access is also strong enough to change content, issues, workflows, and releases, so grant the smallest useful permissions, enable only the toolsets you need, and lean on read-only or lockdown modes.
A lookup service that feeds coding agents current, version-specific library documentation and examples at the moment they write or explain code. Instead of relying on whatever the model already knows, the agent pulls the docs that match the version in use.
Models often answer from outdated library versions, so this helps most with fast-changing frameworks, configuration, migrations, and exact API calls. The free plan covers 1,000 calls a month. Because the library index is community-contributed, verify security-sensitive instructions against the upstream project’s own docs.
A software-development methodology packaged as reusable skills plus startup behavior that reshapes how a coding agent works. It pushes the agent to clarify requirements, design, plan, test, debug systematically, review its own work, and finish branches cleanly.
Reach for it when a disciplined process matters more than the fastest possible change. It is deliberately opinionated and adds real overhead to small tasks, and because it can create worktrees and drive git and tests, review the package before enabling it in sensitive repositories.
A real browser handed to the agent for testing, debugging, visual verification, and web interaction. It can reproduce browser bugs, exercise multi-step flows, inspect console and network activity, take screenshots, and create or repair end-to-end tests.
Reach for it when deterministic DOM and accessibility interaction beats a site-specific API for verifying UI behavior. The local routes need no product account, but a browser profile can expose signed-in sessions and allow real actions, so use an isolated profile and treat page content as untrusted.
An opinionated operating workflow for coding agents. It ties together skills, subagents, commands, rules, hooks, memory, continuous learning, security checks, and orchestration so a team works from one preassembled method rather than wiring each behavior separately.
It suits experienced teams that want the whole method, not a few parts. The surface is large and touches high-trust agent behavior, and it can configure third-party MCP servers, so review the source and any credentials before installing it wholesale.
A bridge to a live Chrome browser. The agent can drive the page, inspect the DOM and console, analyze network traffic, capture screenshots, record performance traces, debug memory, and check accessibility, all against a real running session rather than static source.
This surfaces runtime evidence the codebase alone cannot, which makes it strong for reproducing UI bugs, checking performance, diagnosing network failures, and confirming a frontend actually behaves as intended. It can see and change anything in the connected browser, including authenticated data, so keep human review on consequential actions.
A planning interview that asks one question at a time while it models your domain. It challenges vague terminology, checks claims against the actual codebase, updates a project glossary, and records only the architectural decisions that are hard to reverse.
The payoff outlasts the plan. Shared vocabulary and settled decisions stay available to later people and agent sessions, which cuts repeated explanation and inconsistent naming. Since it can edit files like CONTEXT.md and your ADRs, review those changes as you would code.
A pull-request reviewer that runs several reviewers in parallel and filters by confidence. It reads repository guidance, commit history, and the surrounding review context, hunts for likely bugs, then surfaces only the higher-confidence findings.
Use it on meaningful pull requests where deeper automated review is worth the model cost and latency. Findings post as precise comments with direct code links. Because it reads repository history and writes to GitHub, its access still needs review, and it does not replace human approval.
A database integration that pairs live project tools with current Supabase and Postgres guidance. Working on the same project, the agent can inspect schemas, run SQL, manage migrations, pull logs, generate types, deploy Edge Functions, and follow up-to-date database and RLS practices.
Supabase itself recommends pointing it at a development or test project, not production data. Scope the connection to one project, prefer read-only mode and narrow feature groups, and treat database-derived content as a possible prompt-injection vector. The hosted server is still pre-1.0.
A focused cleanup agent that goes over recently modified code for clarity, duplication, nesting, naming, and consistency while trying to preserve behavior. It handles the cleanup as its own step rather than blending it into the original implementation.
That separation keeps the simplification diff easy to inspect on its own. Two caveats worth holding onto: preserving behavior is an instruction, not a guarantee, and its opinionated JavaScript and React conventions should give way to your project’s rules and human review when they conflict.
A workflow that hands the agent the same bounded objective over and over while progress persists in files and Git between rounds. Some implementations restart a fresh agent each iteration; others continue a session or add planning, monitoring, review, and sandbox controls.
It lets the agent grind through small, verifiable tasks without a human restarting each cycle. The value comes from durable repository state, tight executable feedback, and a finite loop, not a magic completion phrase, so cap the iterations or spend, keep tasks small, and require executable completion checks.
A broad package spanning the Vercel ecosystem: Next.js, React, the AI SDK, deployments, performance, and infrastructure. It bundles product-specific skills, specialist agents, operational commands, project-aware hooks, an ecosystem map, and, on supported routes, live access to your Vercel account.
The skills help even without account access, but deployments, logs, environment changes, and connected project data need Vercel authentication. In projects that have nothing to do with Vercel, the breadth is mostly noise, and a narrower route is enough.
A test-driven discipline that builds one behavior-focused slice at a time. You agree on the public seams worth testing, write a single failing test, add just enough implementation to pass, then repeat. The agent invokes it when the work fits.
It keeps tests bound to observable behavior instead of private methods or mocked internals, and it rejects tautological expected values and speculative batches of tests written before the code teaches you anything. It fits features and fixes with a reliable test runner.
A review workflow that scans a codebase for shallow modules, awkward seams, scattered logic, and hard-to-test behavior. It produces a visual HTML report of several candidate refactors, then waits for you to pick one before it moves into design.
It makes architecture decisions inspectable before any code changes. Each candidate is tied to repository hot spots, domain vocabulary, existing decisions, test seams, and a stated recommendation strength, not a generic cleanup list. The report also loads Tailwind and Mermaid from external CDNs.
A seven-phase feature workflow that moves through discovery, codebase exploration, clarification, architecture selection, implementation, review, and a final summary. Specialist agents explore the code and compare implementation approaches, and the important decisions stay explicit along the way.
It keeps the agent from diving straight into code on a substantial feature, making assumptions and architecture choices visible before anything changes. That structure is worth it for consequential work with unclear requirements, but the pauses and multiple agents make it slow and expensive for small fixes.
A three-layer security workflow for Claude Code. It fires instant pattern warnings while you edit, runs a model-backed diff review when a turn completes, and performs an agentic review around commits and pushes, tracing related files for cross-file problems.
Treat it as an extra feedback layer for security-sensitive code, not certification or a replacement for human review and dedicated scanners. It sends diffs and related file contents to the configured model, can miss issues or flag false positives, and higher-recall dual review roughly doubles review cost.
A connection to the TypeScript Language Server that gives the agent IDE-style diagnostics, definition lookup, references, and code intelligence across TypeScript and JavaScript files. It reads the real project rather than guessing from search results.
So it can navigate symbols and catch type errors from the actual project right after edits, which is more reliable than reasoning from search alone in large JavaScript and TypeScript codebases. It depends on a separately maintained language server, so keep that dependency in working order.
A free hosted service for reading generated documentation and asking grounded questions about public GitHub repositories. Its three tools expose the wiki structure, the wiki contents, and question answering, giving the agent a repository-knowledge layer without cloning or indexing anything locally.
It is a fast way to orient to an unfamiliar public repository, find documented concepts, and ask architecture questions before deeper code inspection. The free endpoint covers public repositories only, and generated wiki content can lag the code, so verify important claims against current source.
A specialized external review service wired into the coding agent. It brings a separate review engine with static analyzers, code-graph context, and severity-grouped findings, plus a review-and-fix loop the agent can act on directly.
Because it is a second engine, it can catch problems the agent that wrote the change missed, which helps before merge or while iterating on AI-generated code. It is not local-only, though: your code and context go to an external service, so check data policies and validate every finding.
A connection to your Postman workspaces, collections, specifications, environments, mocks, monitors, and related API workflows. The agent gets the same structured API context the team maintains in Postman, rather than reconstructing the API surface from scratch.
With that context the agent can run tests, sync specifications and collections, generate client code, improve docs, build mocks, and audit APIs alongside implementation. Use the narrowest mode that covers the task; Full mode exposes broad write and execution across Postman resources, so don’t expose a wide API key casually.
An integration across the GitLab lifecycle: repositories, merge requests, CI/CD pipelines, issues, milestones, and wikis. The agent works inside GitLab’s own permission model, with authentication tied to the connected account and instance rather than a third-party wrapper.
Use it for development and delivery work that already lives in GitLab. When checked, the hosted MCP server was still beta and the glab MCP mode experimental, so grant the narrowest practical permissions and avoid broad write access to production groups when read-only project access is enough.
A system that turns a product brief into a durable graph of tasks with dependencies, status, research notes, and handoff state. That work lives in files the agent reads and updates, not inside a single conversation.
For substantial projects, that makes plans survive across sessions, so multiple agent runs can inspect and advance the same work. It needs Node 20+, local project access, and a configured model provider, and it writes durable state through many mutation tools, so review the generated plans.
An IDE-like semantic toolkit for the agent. It finds symbols and references, maps code relationships, and edits or refactors at symbol boundaries, running locally on top of language servers rather than plain text search.
So the agent can pull just the relevant symbols instead of reading whole files, and make cross-file changes with more structural precision than search-and-replace. Its value depends on the language and repository, and it needs a local runtime and language-server backend; treat speed and token-saving claims as workload-dependent.
A connection to Microsoft’s Pyright language server that gives the agent live Python type diagnostics and code intelligence from the actual project. It reads real type and symbol information instead of relying only on source search.
The payoff is strongest in large or typed Python codebases, where it catches type errors right after edits and helps the agent edit safely. It depends on a separately maintained binary and can fail silently if that executable is missing from PATH, so confirm it is installed.
A workflow that steadily pushes coding agents toward smaller, simpler implementations. Its hooks keep that pressure on throughout a session rather than depending on you to remember a prompt, targeting the tendency to add abstractions, layers, and code volume faster than the task needs.
Use it for implementation and review where trimming code and architectural surface matters. Two cautions: the hooks need Node and can fail silently while the skills still load, so confirm they activated, and its code-reduction numbers are self-published, so treat them as publisher claims.
A repository packer that compresses a whole codebase into compact, structured context, plus a repeatable process for searching and explaining the result. It is built to feed an agent broad repository context it could not otherwise hold at once.
That makes it useful for unfamiliar, remote, or very large codebases where the agent needs the whole picture. The packed output can still contain proprietary code or secrets even with Secretlint, so review the generated file before handing it to a hosted model.
A project package for Laravel work that combines a local server, project- and package-aware guidelines, focused skills, and semantic search across more than 17,000 pieces of Laravel ecosystem documentation. It grounds the agent in the actual application, not generic framework knowledge.
So the agent can inspect the app’s packages, routes, schema, logs, configuration, and database, and follow the conventions and version-specific patterns that apply to it. Because it runs inside the project and can query databases, read config and logs, and execute Tinker code, use it in development environments.
An Expo and React Native package that pairs task-specific skills with tools for live Expo documentation and EAS operations. The skills cover current project structure, Router, native UI, upgrades, data fetching, modules, deployment, and CI/CD as the agent builds.
It keeps the agent aligned with current SDK patterns and, when authorized, lets it trigger builds, inspect rollouts, and use EAS services. The framework skills are open, but EAS can require an account, permissions, and paid capacity, so review any deployment or native changes.
A database integration that pairs current Prisma ORM and Postgres guidance with live database management. The agent can generate version-appropriate Prisma code and take database actions such as provisioning, querying, migrations, backups, recovery, and connection management.
It keeps generated code aligned with the Prisma version in use and lets the agent operate Prisma Postgres in a development workflow. The hosted server can execute SQL and manage databases and credentials, so keep human review around destructive actions; the CLI adds guardrails for dangerous commands.
A deterministic security scanner wired into the agent, packaged as Semgrep Guardian with MCP tools, coding-agent hooks, and secure-coding guidance. It checks code as the agent writes it and surfaces SAST, dependency, and secret findings.
Because scanning happens inside the generation loop, the agent gets enough context to fix issues before they reach a pull request. The hooks read and scan changed source, and cloud features can expose findings and repository context to Semgrep services, so review results rather than treating them as final proof.
A tool that builds a local knowledge graph of your codebase and exposes its relationships to the agent through queries, exploration and planning skills, and context files. It maps how the code actually connects rather than treating it as loose text.
That helps the agent reason about call chains, dependencies, execution flows, clusters, and change impact that plain search misses in large repositories. The index uses local compute and can go stale, and its PolyForm Noncommercial license means commercial teams should check permitted use first.
A guided workflow for building Claude Code plugins, from design through validation, testing, and documentation. An eight-phase creation command pairs with focused guidance on plugin structure, settings, commands, agents, skills, hooks, and MCP integration, plus validation agents and scripts.
It is one coherent process for turning a plugin idea into a validated, documented result, rather than a scattered set of tips. Because the workflow generates hooks, scripts, dependencies, MCP configuration, and permissions, review each one before you enable or distribute the plugin.
A workflow that scaffolds and checks Claude Agent SDK applications in Python or TypeScript. An interactive starter creates the project, and SDK-specific verifiers review package setup, imports, types, environment handling, error handling, and documentation against current Anthropic patterns.
It is aimed at starting or validating an app built specifically on the Claude Agent SDK, not agent frameworks in general. The command creates files and installs dependencies, so review the generated project, keep API keys out of version control, and treat verifier output as guidance, not a production sign-off.
A connection to Greptile’s review data and custom coding context. Its tools fetch pull requests and review comments, search recurring feedback, check review status, apply fixes, and manage the team’s coding patterns from inside the agent.
This turns Greptile feedback into work the agent can address in the same place code is written, and lets teams carry their standards into the implementation loop. It only helps if Greptile already indexes the relevant repositories; it is not a review engine for teams that don’t use Greptile.
A connection to the search and code-intelligence layer of a Sourcegraph instance. The agent can search repositories, read files, navigate symbols, inspect commits and diffs, and, depending on the endpoint, run or read Deep Search.
This gives the agent governed context across many repositories without checking each one out locally or dumping it into the prompt, so it fits enterprise code discovery, cross-repo tracing, and refactor-impact work. It is documented for Enterprise and can expose private code and history, but existing repository permissions still apply.
An integration that brings SonarQube quality gates, issues, coverage, duplication, dependency risks, secret scanning, and code analysis into the agent loop. The agent checks its own code against the same deterministic quality and security rules the team already uses.
Depending on platform and plan, hooks can scan secrets before context reaches the model and run analysis after edits rather than waiting for CI. It fits teams that already use SonarQube. Prefer read-only mode and narrow toolsets, since the server can also update issues and create webhooks.
