Agent tools that actually work.

context7 MCP server

“It does what it promises, fresh version-specific docs on demand, and the one thing to know is right there in how it works. context7 is a thin client for a hosted service, not a local tool. Both of its tools send your query text and the library name to context7.com over HTTPS; the docs corpus and the reranking live on Upstash's servers, so the task you're asking about leaves your machine. That's by design, not a leak, but if you work under an NDA that covers your prompts, treat it accordingly. Small tool surface (two tools), no filesystem access, no local data touched, and no telemetry beyond the API calls it exists to make. Free without a key (rate-limited by IP); an optional key raises the limit.”

playwright-mcp MCP server

“The rare tool that's safe by default. Filesystem access is restricted to your workspace roots, and navigation to file:// URLs is blocked unless you explicitly pass --allow-unrestricted-file-access. That's the opposite of the usual "wide open until you lock it down." No telemetry, and the only dependencies are Microsoft's own playwright packages. Two honest caveats, both about what the tool is rather than a flaw. It drives a real browser, so the agent can reach any site it navigates to, and the --allowed-origins and --blocked-origins flags say plainly in their own help text that they are not a security boundary. And by default it persists a browser profile to a temp dir (cookies, logins); pass --isolated to keep the session in memory only. Treat it like handing your agent a real browser with access to your project files, because that's what it is.”

postgres-mcp MCP server

“Restricted mode is genuinely read-only, and it holds by two independent checks. Every statement is parsed with pglast and rejected if it isn't a read, then run inside a real BEGIN TRANSACTION READ ONLY, so Postgres refuses the write even if the parser were fooled. All 66 of the project's own enforcement and safe-SQL tests pass. Two things to know before you install. The default access mode is unrestricted, so execute_sql runs any SQL, including DROP; pass --access-mode restricted unless you mean to give an agent write access. And the LLM index-tuning method (method="llm") builds an OpenAI client against your own key, while the default method, "dta", is pure algorithm and never leaves your machine. No telemetry, no hidden network calls. The only outbound URLs it parses are your connection strings.”

posthog-mcp MCP server

“This is not a read-only tool, and its reach is exactly the scopes of the personal API key you hand it. Of its 44 tools, 26 read and 18 write, and 5 of those delete production objects (delete-feature-flag, insight-delete, dashboard-delete, experiment-delete, survey-delete). The safety is real and server-enforced: every tool declares its required_scopes and PostHog checks them, so a key minted with only :read scopes mechanically blocks every write and delete. So mint one that way. Create a read-scoped personal API key unless you specifically want an agent creating feature flags in your live project. Second thing to know: the default install points at https://mcp.posthog.com/mcp, a hosted Cloudflare Worker, so your key and query results transit PostHog's own infrastructure (you already trust them with this data, and you can self-host by pointing POSTHOG_BASE_URL at your own worker). Two smaller notes: the docs-search tool sends your question to api.inkeep.com, a third party, and the server reports its own tool-call usage back to PostHog via posthog-node. No filesystem access, no other egress.”

sentry-mcp MCP server

“Official, and it connects the way you'd hope. On sentry.io you don't paste a token, you approve a device-code login; self-hosted takes a token and a --host. Once connected it reads your org's real issues, errors, and traces. That's the point, and also the thing to be deliberate about. Production error data is where stack traces, user emails, and other PII live, and this pulls it into the model's context. Fine for most work, worth a thought under strict data rules. Two smaller notes. The server reports its own telemetry to Sentry via a built-in DSN (Sentry using Sentry; override it with --sentry-dsn if you'd rather it didn't), and --agent mode collapses the tool surface to a single use_sentry tool, which is the lighter way to run it inside an agent.”

serena MCP server

“Because it works through language servers, it edits code at the symbol level instead of rewriting whole files. On a big repo that's more precise and a lot cheaper in tokens, and it's the real reason to reach for it. Two cautions before you install. First, this is an editing tool, not a reader. It modifies your source and writes "memory" files into a .serena directory in your project, so it earns a place in your .gitignore and the same review you'd give any other diff. Second, it ships an optional local web dashboard that binds to 127.0.0.1 only; the one outbound call in the whole tool is that dashboard fetching a news feed from the author's site, and you can turn the dashboard off. Tool-usage and token stats are computed and shown locally. Nothing about your code or activity is reported anywhere. Give it the respect you'd give anything that can edit your repo.”

anthropic-skills skill

“The reference pack, and it earns the title. Seventeen skills (the document formats docx, pdf, pptx, xlsx, plus builders like mcp-builder and skill-creator and the design skills), with an always-on cost of about 1,629 tokens, measured with tiktoken. The heaviest single description is xlsx at 238 tokens, fair for how much that one does; everything else is lean. Nothing here is a surprise, and that's the point of a reference implementation. This is what a well-built, well-scoped skill looks like, from the people who defined the format. Install the whole thing without worrying about the cost.”

cc-skills skill

“Twenty skills, about 4,000 always-on tokens measured with tiktoken (~200 each), because until a skill fires only its one-line description is loaded. The scoping is better than most: descriptions say "use when X" and "do not use for Y," and cross-reference their siblings. The catch is the default install. Both the marketplace path and the CLI's --all load all 20, and a few triggers are deliberately greedy (frontend-design-deslop fires on "build a UI for X," deep-research on "look into X," copywriting-hooks on the word "hook"), so they fire on generic requests. Install the ones you want by name with --skill instead of taking the whole set. No scripts, no network calls of its own, no telemetry, MIT. Clean, with a cost you should choose on purpose.”

marketing-skills skill

“Forty-seven senior-level marketing skills (SEO, CRO, copywriting, ads, analytics), and the content is the real thing: framework-driven, correct, cross-referenced. Two things to size up before you install all of it. First, the whole pack is about 8,000 always-on tokens on every turn, roughly five times Anthropic's official pack, for skills most engineering work will never trigger. Second, it bundles 64 Node scripts under tools/clis/ that read vendor API keys from your environment and call those vendors' APIs (Resend, Klaviyo, Google Ads). Those are opt-in and never auto-run, each reads only its own vendor's key, and they support a dry-run, but they are a surface worth knowing. Nothing phones home, no self-promo is injected into output, MIT. Install the two or three skills you need with --skill, and the cost and the scripts both stay out of your way.”

superpowers plugin

“The discipline pack, and it's honest about its cost. Fourteen skills (brainstorming, test-driven development, systematic debugging, plan writing, git worktrees), and the whole set adds only about 577 tokens of always-on context, measured with tiktoken, because until a skill fires, its one-line description is all that's loaded. The scoping is tight. Most descriptions are "use when…" triggers, so they stay quiet until they're relevant. One stylistic heads-up rather than a fault: a few are written as hard commands ("You MUST use this before any creative work"), which will nudge the model firmly. That's the point if you want the guardrails, worth knowing if you don't. Progressive disclosure done the way the mechanism intends.”

vercel-agent-skills skill

“Vercel's own skills for React, Next, and deploys, and they are built with care: about 850 always-on tokens across nine skills, token values redacted from output, shell calls made through execFile rather than a shell string, and no telemetry. One skill needs a clear-eyed look before you use it. deploy-to-vercel tars your whole project and POSTs it to a Vercel endpoint (claude-skills-deploy.vercel.com) with no auth, producing a preview URL anyone can claim. It excludes node_modules, .git, and .env files first, and the skill asks before pushing, so it is a disclosed design, not a leak. Know that your source leaves your machine when you run it. The rest (react-best-practices, composition-patterns, view-transitions, web-design-guidelines) are read-and-advise skills with no such surface.”

writing-humanizer skill

“A single, clean skill that lives inside a large collection, and the install command is the whole verdict. Point it at the one skill (pnpx skills add hairyf/skills --skill writing-humanizer) and it costs about 145 always-on tokens: a text editor that scans writing for two dozen AI tells (inflated significance, rule-of-three, em-dash overuse, copula avoidance) and rewrites them, from Wikipedia's "Signs of AI writing." Install the whole collection with --all -g and you pay for 68 skills at about 32,000 always-on tokens, most of them auto-generated from library docs and, by the author's own note, "not fully tested." The skill dir holds only markdown, no scripts or network calls. Vet the skill, not the dump.”