LLM Mart Basic

抖音七日点赞飙升榜查询工具。周度收录全平台抖音作品，输出七日新增点赞TOP50榜单，支持按赛道分类查询、历史日期回溯（最多30天）。当用户查询抖音七日飙升榜、抖音周榜飙升、抖音七日点赞飙升、抖音周度飙升榜时使用。触发词：抖音七日飙升榜、七日点赞飙升、周度飙升排名、周榜飙升、抖音七日新增、抖音周榜飙升。

GEO（生成式引擎优化）品牌分析工具。自动向豆包、Kimi、DeepSeek 三个 AI 搜索引擎提问，分析品牌在 AI 回答中的出现率、情绪、信源引用、竞品对比，生成交互式 HTML 报告。当用户需要分析品牌在 AI 搜索引擎中的表现、GEO 优化、AI 搜索品牌监测、品牌 AI 可见度分析时使用。触发词：GEO分析、品牌AI搜索分析、AI搜索引擎优化、品牌可见度、GEO、geo analyzer。

全球AI新闻简报 — 一个关键词同时搜索抖音、小红书、公众号、B站、快手、视频号、今日头条、TikTok、Instagram、X(Twitter)、YouTube 共 11 大平台，跨平台聚合后由 AI 生成智能摘要、热点聚类、舆情分析和深度解读报告，输出终端表格 + 交互式 HTML 报告。包含详细信息源列表，适用于各种AI agent进行社媒资讯分析。当用户需要新闻搜索、舆情分析、热点追踪、跨平台情报对比、资讯聚合、新闻解读、全网搜索、事件追踪、行业情报时使用。触发词：新闻情报、全网搜索、舆情分析、热点追踪、新闻解读、资讯聚合、跨平台分析、事件追踪、

AI公众号信息源 — Daily scan of AI WeChat public accounts, finding the hottest articles by read count, auto-clustering into topics, and generating a styled HTML report with cover images, metrics, search, and subscription support. Use when the user wants AI daily reports, 公众号爆款, AI conte

公众号搜索爬虫 — 通过关键词搜索微信公众号文章，终端表格展示（标题/作者/阅读/点赞/分享/收藏/发布时间/文章链接），自动导出 CSV 并生成交互式 HTML 报告。当用户需要搜索、爬取或浏览公众号文章时使用；也适用于行业热点追踪、竞品内容分析、素材灵感搜集等场景。

微信公众号文章订阅 — 每天 6 点，盯梢竞对、同类、关注账号，一份你订阅的公众号文章推送。

公众号头条增长榜工具。基于红狐数据，按周统计公众号头条阅读增长（本周 vs 上周），排序固定为头条增长率降序，支持 23 个作者类别筛选，最多翻 5 页（每页 20 条，逐页输出），发现正在快速涨量的公众号账号。当用户提到"公众号头条增长榜"、"头条增长榜"、"公众号黑马榜"、"黑马榜"、"公众号涨榜"、"公众号飙升榜"、"阅读增长榜"、"涨粉快的公众号"、"公众号涨量排名"时使用。

AI 图片生成器 — 基于 gpt-image-2 模型，支持文生图与图生图，开箱即用。

Instagram视频下载 — 粘贴 Instagram 视频链接，一键解析返回无水印视频下载链接。当用户需要下载 Instagram 视频、保存 IG 视频、获取 Instagram 视频直链时使用。触发词：Instagram视频下载、IG视频下载、Ins视频下载、Instagram视频解析、下载Instagram视频、reel下载。

公众号投资博主蒸馏器。通过公众号文章数据，自动提取交易体系、市场判断、表达风格、内容深度、互动特征、热点图谱、 人设基因七维DNA，输出结构化风格画像 profile。 触发词：蒸馏投资博主、蒸馏大V、蒸馏公众号大V、分析投资博主风格、 提取交易体系、风格画像、投资博主蒸馏。

Kimi WebSearch 搜索工具。基于红狐 API 调用 Kimi 联网搜索能力，提交查询后自动轮询等待结果返回。当用户需要使用 Kimi 搜索、联网搜索、AI 搜索获取实时信息时使用。触发词：kimi搜索、kimi websearch、联网搜索、AI搜索、kimi搜索。

快手AI内容日报生成工具。每日自动扫描快手平台AI创作内容，按播放量筛选爆款视频并智能聚类，生成深色主题HTML日报（含封面图、互动数据、视频直链），同步输出AI情报洞察（热度TOP话题、起量信号、核心达人、推荐调查方向）。当用户需要AI快手日报、快手爆款、AI快手热点、快手AI内容、快手AI视频、快手情报时使用。触发词：AI快手日报、快手爆款、快手AI热点、快手情报、快手AI视频。

快手评论分析工具。输入作品链接即可获取一级评论数据，支持分页浏览、评论情感分析（积极/负面/需求/竞品），生成精美 HTML 报告。当用户需要查看快手作品评论、分析评论舆情、了解用户反馈时使用。触发词：快手评论、作品评论、评论查询、评论分析、评论舆情、看评论。

多平台文案改写能力；当用户需要将文案改写为公众号/视频号/抖音/快手/哔站/小红书/知乎风格，或批量输出多平台改写结果时使用

海外跨平台热文搜索 — 输入任意关键词（中文/英文），一次搜索 X / TikTok / YouTube 三平台热门内容，每平台 Top N（默认5）统一列表（平台/标题/作者/播放/点赞/评论/发布时间/链接），终端分组表格 + CSV 导出 + 交互式 HTML 报告（卡片/表格双视图）。按关键词语言智能优先同语言内容（中文词→中文优先，英文词→英文优先，其余语言兜底）。当用户需要搜索海外平台热点、跨平台内容对比、话题/竞品舆情监控、选题素材采集时使用。

B站短剧爆款内容追踪工具，每日自动扫描B站短剧创作内容，按点赞量筛选爆款作品，智能聚类题材后生成可视化HTML日报与创作趋势分析。⚠️查询前脚本先做输入校验：关键词需命中短剧题材词库（topic_keywords 中规定的题材名+全部相关词，如「打脸」命中逆袭题材相关词），命中后直接使用该关键词查询数据；不满足时提醒'关键词不满足查询条件'并推荐相关词，且不发起接口请求。数据每日15:00更新前一天数据，目标日期无数据时必须先告知用户并等待确认后才能调用接口，禁止自动获取。当用户需要查询B站短剧爆款日报、分析短剧题材趋势、查看热门达人表现或生成短剧创作趋

短剧-抖音信息源 — 每日扫描抖音短剧爆款内容,按点赞量筛选热门短剧,智能聚类题材方向后生成包含封面、互动数据与创作洞察的HTML日报。支持按题材(穿越/霸总/重生等)、达人、时间范围定向查询。⚠️查询前脚本先做输入校验：关键词需命中短剧题材词库（topic_keywords 中规定的题材名+全部相关词，如「打脸」命中逆袭题材相关词），命中后直接使用该关键词查询数据；不满足时提醒'关键词不满足查询条件'并推荐相关词，且**不发起接口请求**；查询无匹配数据或全量数据不足时先询问用户是否按推荐题材重新查询，确认后才可查询（不自动扩展、不自动降级全量）。日期

短剧-公众号信息源 — 每日扫描公众号短剧爆款文章,按阅读量筛选热门内容,智能聚类题材方向后生成包含封面图、互动数据与创作洞察的HTML日报。支持按题材(穿越/霸总/重生等)、公众号、时间范围定向查询。⚠️查询前脚本先做输入校验：关键词需命中短剧题材词库（topic_keywords 中规定的题材名+全部相关词，如「打脸」命中逆袭题材相关词），命中后直接使用该关键词查询数据；不满足时提醒'关键词不满足查询条件'并推荐相关词，且**不发起接口请求**；日期超出有效查询范围时提醒并自动回退最近有数据日期，无需用户确认。**无数据确认制**：查询无匹配数据或数

短剧-小红书信息源 — 每日扫描小红书短剧爆款内容,按互动量筛选热门笔记,智能聚类题材方向后生成包含封面、互动数据与创作洞察的HTML日报。支持按题材(穿越/霸总/重生等)、达人、时间范围定向查询。⚠️数据每日15:00更新前一天数据,目标日期无数据时必须先告知用户并等待确认后才能调用接口,禁止自动获取。⚠️查询前先校验分类/关键词是否符合短剧题材词库,不满足时不请求接口直接提示并推荐相关词。当用户需要短剧小红书日报、小红书短剧爆款、短剧热点、短剧创作趋势或自定义题材查询时使用。

一键生成高质量红狐Skill专属技能文件包（SKILL.md + 配套资源）。只需描述功能需求、提供接口地址和接口文档，即可自动生成符合红狐规范的专业技能文件，开箱即用。支持按需定制与迭代优化。触发词：当用户提到'创建红狐skill'、'生成红狐技能'、'新建红狐skill'、'写一个红狐skill'、'做个红狐skill'、'红狐技能生成'时使用

Discovery worked. Ping worked. Every TCP connection timed out, and later the tunnel only worked when someone had a terminal open.

Every VM came back. The cluster did not. Declarative systems converge on config, and the datapath isn't config.

A surprising share of AI-in-the-terminal failures aren't the AI. They're zsh, and a version of bash from 2006.

A Claude Code plugin turns standalone project configuration into a namespaced, installable extension that teams and communities can update as one unit.

None of the safety came from the model. It came from six boring habits.

Skills package instructions and references. Subagents run work in a separate context and return results. They solve different problems and can be composed deliberately.

Six hours in, one step left, everything green, and the incident that didn't happen

CLAUDE.md carries persistent project context. Skills load reusable procedures when relevant. Separating stable facts from task-specific workflows keeps both easier to maintain.

Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it

An API request routing a model's tool call through an approval gate to a remote MCP server

31 config keys, two audits, and why the first one was wrong in both directions

The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.

Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.

Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.

"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks

stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.

The most important rule wasn't about what I could change. It was about what I was allowed to display.

Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.

Use MCP Inspector to connect to local or remote servers, inspect capabilities, call tools, read resources, test prompts, and diagnose failures before release.

Build an MCP server in TypeScript with focused tools, validated schemas, local and remote transports, Inspector tests, and production security controls.

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com

Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com

Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com

Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report

Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope <asset> [<asset> ...]

Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Manual 8-class grep audit (with an optional automated scanner if present). Usage: /token-scan <contract_path_or_dir> [--chain solana]

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Crabbox is a single CLI (`crabbox`). Commands are top-level, not nested under a

`crabbox actions` prepares a leased box from your repository's own GitHub

See [Runtime adapter stack](../features/runtime-adapter-stack.md) for the

`crabbox admin` groups trusted operator controls for coordinator-backed leases and the cloud resources behind them. Use it to inspect every lease the broker tracks, reconcile expired leases against live cloud state, force-release or delete a backing server, print provider IAM pol

`crabbox artifacts` turns a desktop lease into durable QA evidence: it collects

Atom Agent, Open-Source Governed AI Agent Platform for Self-Hosted Automation

The agent engineering intelligence harness, optimized tools, memory system, subagents and mixture of models packages ⚚

Sesori iOS/Android app and the Sesori Bridge CLI — drive Claude, Codex, OpenCode, Cursor, Pi, OMP, Hermes coding sessions from your phone

🧠 RepoBrain (formerly Antigravity) — Give your repo a brain. ChatGPT for your codebase: works in Claude Code, Cursor, Codex, Windsurf & more.

Use ChatGPT (Codex), Claude, and Grok (X Premium) subscriptions as DeepSeek Harness LLM providers — OAuth login in the web UI, no API keys

Latitude is the open-source AI monitoring platform.

Open-source AI browser agent for Chrome and Firefox (monorepo) 🧠

Official Model Studio CLI（阿里云百炼 CLI）built for AI Agent frameworks, exposing models, search, multimodal, and workflow capabilities as structured tool calls.

Curated DeepSeek Harness (DSH) plugins, extensions, tools, skills, clients, runtimes, integrations, and verified references — English and Chinese.

Turn papers, code, and docs into presentation-ready, natively editable PPTX in Codex / Claude Code. Native charts and equations, speaker notes, click-build anim…

Grix : Work with agents like talking to people.

Local First Ai Agent. Optimized for Local Ai models. Long context window. Proper tools callings. Runs privately on your device.

Model Context Protocol server that integrates AgentQL's data extraction capabilities.

AI that ships your tickets.

Metadata-driven CLI for AI Agent Bots — 48 operations across 7 domains, structured JSON envelope I/O, zero interactive prompts.

An open-source, extensible, self-hosted agent workspace with multi-runtime support for Codex, Claude Code, and more, plus reusable local apps for custom interfa…

Open-source Windows desktop client and GUI for DeepSeek Harness — zero-setup installer with Codex, plugins, skills, SSH, mobile remote access, and 11 skins.

The open-source AI workbench for scientific research

DeepSeek-native AI coding agent for your terminal. Engineered around prefix-cache stability — leave it running.

A Fully free agentic browser driver for AI , few tools, full control, real stealth, top-tier token efficiency.