LLM Mart Basic

Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.

Use for Roblox Open Cloud APIs, API keys, OAuth 2.0, webhooks, scopes, token lifecycle, or in-experience HttpService calls.

Use before publishing or updating a Roblox experience to run evidence-backed release gates for the surfaces that changed.

Use when working with Roblox Studio through built-in MCP for scripts, scenes, generated assets, input, or playtesting.

Use when configuring Roblox tooling such as Rojo, Wally, Selene, StyLua, Lune, Aftman, luau-lsp, or CI/CD.

多平台账号主页视频提取器 — 输入平台名称和账号id/链接，自动拉取抖音/快手/B站/YouTube 四大平台主页作品，解析下载链接，支持批量下载。适用场景：竞品账号内容拆解与逐帧学习、收藏喜欢的创作者全部作品避免被删、批量搬运素材二次剪辑创作、保存自己账号作品做本地备份防丢失、课程/教程类视频离线囤货反复看、达人合作前快速拉取对方作品做背调分析。触发词：主页视频下载、批量下载视频、账号视频提取、快手主页下载、B站视频提取、YouTube频道下载、视频保存、无水印下载、竞品视频下载、博主视频备份。

深度A股情报调查与分析工具，支持A股情报调查、竞品分析、舆情监测、人物背景调查、信息交叉验证，生成结构化调查报告。当用户需要调查A股公司/行业/概念、调查竞品、追踪热点事件、了解人物背景、验证信息真实性时使用。触发词：A股情报、股票调查、财报分析、概念追踪、资金流向、情报调查、竞品分析、舆情调查、背景调查、信息验证、多源搜索。

B站AI信息源 — 每日扫描B站AI相关账号，按点赞量发现爆款视频，智能聚类话题后生成包含封面图、互动数据与订阅支持的HTML日报。同时基于热门话题执行AI情报调查，采用多引擎搜索与交叉验证，输出结构化调查报告。支持用户自定义关键词定向查询。⚠️数据每日15:00更新前一天数据，目标日期无数据时必须先告知用户并等待确认后才能调用接口，禁止自动获取。当用户需要AI-B站日报、B站爆款、AI-B站热点、B站AI内容、B站AI视频、B站情报或自定义关键词查询时使用。

B站评论分析工具。输入B站视频链接或BV号即可获取一级评论数据，支持分页浏览、评论情感分析（积极/负面/需求/竞品），生成精美 HTML 报告。当用户需要查看B站视频评论、分析评论舆情、了解用户反馈时使用。触发词：B站评论、B站视频评论、评论查询、评论分析、评论舆情、看评论、bilibili评论。

B站搜索批量下载工具。输入关键词即可搜索B站全站视频，支持按播放量/点赞/时间排序，搜索后自动批量获取全部高清下载链接。当用户需要查找B站视频、搜索B站内容、下载B站视频、采集B站素材时使用。触发词：B站搜索、bilibili搜索、B站下载、B站视频下载、b站搜视频、B站找素材、下载B站、bilibili下载。

B站视频下载 — 粘贴B站视频链接，一键解析返回无水印视频下载链接。当用户需要下载B站视频、保存B站视频、获取B站视频直链时使用。触发词：B站视频下载、bilibili视频下载、B站视频解析、下载B站视频、哔哩哔哩视频下载。

中国互联网品牌感知监测统一工具。聚合全网热榜追踪（hub）、小红书/抖音/公众号近30天深度讨论研究（cn30）、豆包/Kimi/DeepSeek AI 搜索品牌可见度分析（geo）三个互补模块，帮助品牌方/市场运营/内容创作者从「话题热度—真实口碑—AI 回答」三层视角全面感知品牌。当用户需要研究中国社交媒体热点、分析品牌舆情、对比竞品口碑、分析品牌在 AI 搜索中的表现、做 GEO 优化、追踪全网热点时使用。触发词：品牌感知、舆情监测、社媒研究、热榜聚合、AI 搜索可见度、GEO 分析、跨平台舆情、热点追踪、品牌口碑、品牌竞品对比、社媒热榜。

中国社媒平台话题研究工具。从小红书、抖音、公众号三大平台搜索近30天真实讨论，跨平台对比分析舆情趋势。当用户需要研究中国社交媒体热点话题、分析舆情趋势、对比品牌口碑时使用。触发词：小红书热点、抖音趋势、公众号舆情、跨平台分析、社媒研究、话题分析、舆情监测。

文旅B站信息源 — 搜索文旅相关B站热门视频，按点赞量筛选最火内容，生成精美 HTML 报告。当用户需要文旅B站、旅游攻略、景区热度、文旅资讯、文旅爆款内容时使用。触发词：文旅B站、文旅信息源、文旅资讯、旅游B站、景区视频、文旅爆款。

文旅抖音信息源 — 搜索文旅相关抖音热门作品，按点赞量筛选最火内容，生成精美 HTML 报告。当用户需要文旅抖音、旅游攻略、景区热度、文旅资讯、文旅爆款内容时使用。触发词：文旅抖音、文旅信息源、文旅资讯、旅游抖音、景区视频、文旅爆款。

文旅公众号信息源 — 搜索文旅相关公众号热门文章，按阅读量筛选最火内容，生成精美 HTML 报告。当用户需要文旅公众号、旅游攻略、景区热度、文旅资讯、文旅爆款内容时使用。触发词：文旅公众号、文旅信息源、文旅资讯、旅游公众号、景区文章、文旅爆款。

文旅小红书信息源 — 搜索文旅相关小红书热门笔记，按点赞量筛选最火内容，生成精美 HTML 报告。当用户需要文旅小红书、旅游攻略、景区热度、文旅资讯、文旅爆款内容时使用。触发词：文旅小红书、文旅信息源、文旅资讯、旅游小红书、景区笔记、文旅爆款。

Deepseek 联网搜索工具。一键调用 AI 联网搜索能力，快速获取实时信息。当用户需要使用 Deepseek 搜索、联网搜索、AI 搜索获取实时信息时使用。触发词：Deepseek搜索、deepseek websearch、联网搜索、AI搜索、ds搜索。

豆包 WebSearch 搜索工具。基于红狐 API 调用豆包联网搜索能力，提交查询后自动轮询等待结果返回。当用户需要使用豆包搜索、联网搜索、AI 搜索获取实时信息时使用。触发词：豆包搜索、豆包websearch、联网搜索、AI搜索、doubao搜索。

一键诊断抖音账号运营健康度。基于红狐数据服务获取账号画像与近期作品数据，从账号基础画像、内容生产力、互动健康度、内容质量、内容趋势、粉丝质量六个维度进行量化诊断，输出100分制综合评分、维度得分明细、六类风险预警和针对性优化建议。触发词：当用户提到'诊断抖音账号'、'抖音账号分析'、'抖音体检'、'抖音账号评估'、'查看XX抖音数据'、'分析这个抖音号'时使用

Every VM came back. The cluster did not. Declarative systems converge on config, and the datapath isn't config.

A surprising share of AI-in-the-terminal failures aren't the AI. They're zsh, and a version of bash from 2006.

A Claude Code plugin turns standalone project configuration into a namespaced, installable extension that teams and communities can update as one unit.

None of the safety came from the model. It came from six boring habits.

Skills package instructions and references. Subagents run work in a separate context and return results. They solve different problems and can be composed deliberately.

Six hours in, one step left, everything green, and the incident that didn't happen

CLAUDE.md carries persistent project context. Skills load reusable procedures when relevant. Separating stable facts from task-specific workflows keeps both easier to maintain.

Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it

An API request routing a model's tool call through an approval gate to a remote MCP server

31 config keys, two audits, and why the first one was wrong in both directions

The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.

Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.

Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.

"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks

stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.

The most important rule wasn't about what I could change. It was about what I was allowed to display.

Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.

Use MCP Inspector to connect to local or remote servers, inspect capabilities, call tools, read resources, test prompts, and diagnose failures before release.

Build an MCP server in TypeScript with focused tools, validated schemas, local and remote transports, Inspector tests, and production security controls.

An MCP server exposes tools, resources, or prompts through a standard protocol so an AI application can discover and use external capabilities.

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com

Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com

Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com

Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report

Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope <asset> [<asset> ...]

Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Manual 8-class grep audit (with an optional automated scanner if present). Usage: /token-scan <contract_path_or_dir> [--chain solana]

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Crabbox is a single CLI (`crabbox`). Commands are top-level, not nested under a

`crabbox actions` prepares a leased box from your repository's own GitHub

See [Runtime adapter stack](../features/runtime-adapter-stack.md) for the

`crabbox admin` groups trusted operator controls for coordinator-backed leases and the cloud resources behind them. Use it to inspect every lease the broker tracks, reconcile expired leases against live cloud state, force-release or delete a backing server, print provider IAM pol

`crabbox artifacts` turns a desktop lease into durable QA evidence: it collects

A systematic AI Agent development tutorial covering LLM agents, RAG, tool use, memory systems, multi-agent systems, LangChain, LangGraph, MCP, and agentic RL.｜从…

Convert Files / Folders / GitHub Repos Into AI / LLM-ready Files

Open-source, local-first conversational AI video editor with a professional multi-track timeline, Agent Skills, MCP integration, and Remotion rendering.

Maintainer-governed agent for evidence-backed open-source contribution proposals

A Claude Code skill by Hao (駱君昊) that learns your Facebook voice and auto-posts to FB / IG / Threads / X with a 14-day content calendar. Mega-viral validated: 8…

Local-first AI agent workspace for coding, writing, design, research, and automation — one runtime for desktop GUI and TUI.

Open-source AI Agent platform for teams. Your agents don't just chat — they read files, run code, call APIs, and deliver results.

Give your AI agent eyes for PDFs — structured text, tables, OCR, visual evidence, and page-level citations via MCP. Native Rust, local-first.

Real-world AI penetration testing engineer for authorized assessments — built-in cloud module covering AWS/Azure/GCP + Aliyun/Tencent/Huawei clouds. Built on Cl…

OpenGUI is an Android GUI agent framework for phone-use AI that can see, plan, and operate real mobile apps through the GUI.

Tinybot is a lightweight personal AI Agent that is constantly evolving

Goink 桌面 AI 小说创作助手，对话式写作 + 自动状态追踪 + 本地语义搜索。跨平台开箱即用。AI Agent Novel Generator.

Pluggable DeepSeek-colored TUI for DeepSeek Harness

Entity-level git merge driver. Resolves false conflicts git invents when independent agents edit the same file. ~95% reduction vs. line-based merge.

Percho: Minimalist desktop GUI for the Pi coding agent — the same engine as the Pi CLI, in a clean visual interface. Multi-session chat, visual tool approvals,…

Run Claude Code, Codex & Gemini in parallel on Windows & macOS — git worktree fan-out with atomic hunk adoption, approval gates, reboot-surviving sessions

A hierarchical memory framework for personalized presentation agents. Try it at memslides.com.

Real-time multimodal desktop agent evolving toward a persistent AI OS interface (0.1 α).

clawdcursor compiles whatever's on screen into one UI map — accessibility tree and OCR fused into stable, addressable elements, with a screenshot only when need…

Repeatable agentic engineering. The workflow layer that turns AI coding agents into a disciplined factory: durable specs, fresh-context workers, adversarial cro…