Static Analysis

Skill: CodeQL Security Analysis

by Trail of Bits

Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.

Skill: Semgrep Rule Creator

by Trail of Bits

Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.

MCP: Semgrep MCP

by Semgrep

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

MCP: SonarQube MCP Server

by SonarSource

Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.