The Coding Agent Toolkit: 12 Extensions That Actually Earn Their Setup Cost

Out of the box, a coding agent is a very good engineer with four specific handicaps. It has no process, so it starts typing before it understands the problem. It has no memory, so everything you established yesterday is gone. It has no reach, so its knowledge stops at the training cutoff. And it has no eyes, so it cannot see what it just built.

Nearly every worthwhile extension is an answer to exactly one of those four gaps. That’s the frame I’ll use here — not “top 10 plugins,” but which handicap each tool removes.

Everything below is something I run daily on real work: privacy-first document pipelines, OCR benchmarking, and clinical text classification. I’ve tried to be honest about setup cost, because every list like this pretends installation is free, and it isn’t.

---

First: a plugin is not one thing#

This trips up everyone, so it’s worth thirty seconds. A Claude Code plugin can ship five different kinds of things, and they behave nothing alike:

• Skills — markdown instructions the agent loads when a task matches. They fire automatically.
• Subagents — separate agents with their own context window and tool set.
• MCP servers — actual running processes exposing tools over a protocol.
• Hooks — shell commands the harness runs at lifecycle events. You don’t run these; the harness does.
• Slash commands — things you type.

This matters practically. I once wondered why a plugin I’d installed never seemed to “activate.” It ships no skills at all — only subagents. It was working fine; it just doesn’t announce itself the way a skill does. Knowing which kind of thing you installed tells you where to look when it seems dead.

---

Gap 1: Process#

Superpowers#

obra/superpowers · MIT · /plugin install superpowers@claude-plugins-official

If you install one thing from this entire post, install this one.

Superpowers is a software development methodology delivered as 14 composable skills, built by Jesse Vincent and the team at Prime Radiant. The core behaviour change: when you say “let’s build X,” the agent doesn’t start writing code. It steps back and interrogates what you’re actually trying to do, turns that into a spec, shows it to you in chunks short enough to actually read, and only then writes a plan.

The plan is explicitly written to be followed by — and this is the project’s own phrasing — “an enthusiastic junior engineer with poor taste, no judgement, no project context, and an aversion to testing.” That constraint is the whole trick. A plan that survives that reader is a plan with no hand-waving in it.

The 14 skills group into five jobs:

• Discovery — brainstorming (fires before any creative work)
• Planning — writing-plans, executing-plans
• Execution — subagent-driven-development, dispatching-parallel-agents, using-git-worktrees, test-driven-development
• Quality — systematic-debugging, requesting-code-review, receiving-code-review, verification-before-completion
• Meta — writing-skills, using-superpowers, finishing-a-development-branch

Two of those deserve singling out. systematic-debugging forces the agent to find the actual root cause before proposing a fix, which kills the “try this, maybe it works” spiral that wastes the most time. And verification-before-completion blocks the agent from claiming something works until it has run the command and read the output — evidence before assertions. If you have ever been told “fixed!” about something that was not fixed, you want this skill.

The skills trigger automatically, so there’s nothing to memorise. It also runs on eleven different harnesses, not just Claude Code — Codex, Cursor, Gemini CLI, Copilot CLI, OpenCode, Antigravity and others.

Setup cost: one command. No configuration.

Karpathy Guidelines#

forrestchang/andrej-karpathy-skills · MIT

A much smaller companion: behavioural guardrails derived from Andrej Karpathy’s observations on where LLMs go wrong when coding. State your assumptions instead of silently picking one interpretation. Make surgical changes rather than sweeping rewrites. Define what “done” means in verifiable terms. It explicitly biases toward caution over speed, which is the right trade in a regulated codebase and the wrong one for a throwaway script.

---

Gap 2: Reach#

SearXNG — the one I’d push hardest#

searxng/searxng · AGPL-3.0 · the search engine ihor-sokoliuk/mcp-searxng · MIT · the MCP bridge

SearXNG is a self-hosted metasearch engine. It fans your query out across upstream engines, aggregates the results, and returns them as JSON. My instance carries 279 engines across 32 categories — including science, scientific publications, repos, packages, it and news, which means you can point a search at academic sources or package registries specifically instead of hoping general web results surface them.

Why this beats a hosted search API for agent work:

• No API key and no per-query cost. Agents search a lot. A research task can burn fifty queries. Metered search APIs make you ration something that should be free.
• No rate limit beyond what your own box can handle.
• Your queries never leave your machine. For anyone working under privacy constraints, this is not a nice-to-have. Search queries leak intent — the questions you ask about a codebase or a clinical workflow describe the work itself.

Run it with Docker, then bridge it into your harness:

docker run -d --name searxng -p 8081:8080 searxng/searxng

claude mcp add searxng --scope user \
  --env SEARXNG_URL=http://localhost:8081 \
  -- npx -y mcp-searxng

One gotcha: your instance must have the JSON format enabled in settings.yml (formats: [html, json]), or the bridge gets HTML it can’t parse.

The bridge gives you two tools — searxng_web_search and web_url_read — plus in-memory caching, replica failover, and SSRF protection that blocks the URL reader from reaching private addresses. That last one matters more than it sounds when an agent is choosing URLs autonomously.

Agent Reach#

Panniantong/Agent-Reach · MIT · 15 platforms

General web search gets you documents. Agent Reach gets you platforms — Reddit threads with their comments, GitHub repos and code, YouTube transcripts, RSS feeds, LinkedIn, Twitter/X, and several Chinese platforms (XiaoHongShu, Bilibili, V2EX, Xueqiu) that are genuinely useful and completely invisible to Western search.

The design decision I appreciate: every platform has multiple possible backends, and one command tells you which is live right now.

agent-reach doctor --json

That splits into tier 0 (zero-config: GitHub via gh, YouTube via yt-dlp, V2EX public API, RSS, and any web page via Jina Reader) and tier 1 (login-backed: Reddit, Twitter, XiaoHongShu, Facebook, Instagram).

Be realistic about tier 1. Researching this very post, my doctor output showed Twitter, Facebook and Instagram all wanting a Chrome extension installed and Chrome kept open; Xueqiu wanted fresh cookies; and Exa wasn’t configured at all. Reddit worked because I’d logged in previously. Tier 0 is free. Tier 1 is a real afternoon. Install it for the zero-config channels, and add logins only for platforms you actually need.

Context7#

upstash/context7 · MIT · /plugin install context7@claude-plugins-official

This one fixes the most irritating failure mode in agentic coding: the model confidently writing an API that was renamed two versions ago. Training data has a cutoff. Library documentation doesn’t.

Context7 works in two steps. resolve-library-id turns a human name (“Next.js”) into a canonical ID (/vercel/next.js), returning source reputation, code-snippet counts, a benchmark score, and the list of available versions. Then query-docs pulls real documentation and examples for that library, scoped to one concept per call. You can pin an exact version — /vercel/next.js/v14.3.0-canary.87 — which is the feature that earns its keep when you’re stuck on an older release.

The habit worth building: use it even when the model sounds certain. Confident recall of a deprecated API is indistinguishable from confident recall of a current one, right up until the build fails.

Everything Claude Code#

affaan-m/ECC · MIT · 125 skills

Less a plugin than a warehouse: 125 skills plus agents, commands, hooks, rules and MCP configs, evolved over months of daily use and an Anthropic hackathon win. It works across Claude Code, Codex and Cowork.

I don’t enable all 125 — nobody should. But it’s where deep-research comes from, which produces cited, multi-source research reports with real source attribution, and it’s become the skill I reach for when I need synthesis rather than raw fetching. Worth browsing the catalogue and cherry-picking; treat it as a library, not an install-everything bundle.

The distinction between the three reach tools, since they overlap: SearXNG is raw search you own. Agent Reach is platform-specific fetching. deep-research is synthesis with citations. Different jobs.

---

Gap 3: Memory#

Three tools here, and they remember three genuinely different things. This is the part people get wrong — they install one and assume it covers the others.

beads — task memory#

gastownhall/beads · MIT · local Dolt DB, synced over git

Built-in agent todo lists are ephemeral — they evaporate with the session. beads replaces them with an issue tracker that has first-class dependency support, stores issues in a local Dolt database, and syncs through a refs/dolt/data ref on your normal git remote. Your task graph travels with the repository.

The commands that changed how I work:

bd ready              # issues that are actually unblocked right now
bd graph              # the dependency graph
bd show <id>          # full detail on one issue
bd remember / bd recall   # persistent knowledge, not tied to a session

bd ready is the one. When you’ve got thirty open issues with dependencies between them, “what can I actually start?” is a real question, and having the agent answer it from a dependency graph rather than vibes is a genuine upgrade.

It also handles multi-agent coordination — gate, merge-slot and swarm exist so parallel agents don’t collide on the same work.

Wire it into your session start so the agent is always primed:

{
  "hooks": {
    "SessionStart": [
      { "matcher": "", "hooks": [{ "type": "command", "command": "bd prime --hook-json" }] }
    ]
  }
}

claude-mem — conversation memory#

thedotmack/claude-mem · Apache-2.0

Captures what happened in past sessions and gives you a searchable semantic index of it: search, smart_search, smart_outline, smart_unfold, get_observations, timeline.

The economics are the argument, and the tool reports them itself. A recent session of mine loaded 50 observations for about 17,000 tokens — summarising work that originally cost roughly 456,000 tokens to produce. That’s a 96% reduction for re-reading your own history. When the alternative is re-deriving a decision you already made last week, the index pays for itself immediately.

CodeGraph — code-structure memory#

colbymchenry/codegraph · MIT

Indexes your codebase into a local knowledge graph using tree-sitter and SQLite, then answers structural questions directly instead of making the agent grep-and-read its way to an answer.

codegraph init                    # build the index
codegraph explore "<question>"    # relevant symbols' source + the call paths between them
codegraph node <symbol>           # one symbol's source + its callers
codegraph impact <symbol>         # what breaks if I change this
codegraph affected <files>        # which tests cover this change

explore is the workhorse — it returns verbatim source and the call paths connecting the symbols, which is usually the entire answer to “how does this work” in a single call. impact is the one that prevents accidents.

The honest caveat, and it’s a big one: CodeGraph does nothing at all until you index a repository. There’s no .codegraph/ directory in the repo this blog lives in, so the tool is completely inert here — installed, connected, and useless. It earns its place on large codebases and is pure overhead on small ones. Index deliberately, per project.

---

Gap 4: Verification#

Playwright MCP#

microsoft/playwright-mcp · Apache-2.0

Microsoft’s official browser automation server, and it closes the single widest loop in frontend work: the agent can finally see what it built instead of writing CSS into the void and asking you whether it looks right.

It gives the agent two categories of ability. Acting: navigate, click, type, fill_form, select_option, hover, drag, press_key. Observing: snapshot (the accessibility tree, not pixels), take_screenshot, console_messages, network_requests, and evaluate for arbitrary JavaScript.

snapshot deserves the attention. It returns the accessibility tree, which is both far cheaper in tokens than a screenshot and more useful for interaction, since it names elements the agent can then act on. Screenshots are for judging visual design; snapshots are for driving the page. Use resize to check responsive breakpoints, and console_messages to catch the JavaScript error you’d otherwise never hear about.

Hallmark#

Nutlope/hallmark · MIT · by Together AI

Every AI-generated landing page looks like every other AI-generated landing page. Hallmark exists to break that, and its central insight is that the problem is structural, not cosmetic. Swapping the accent colour doesn’t help when every page still marches through hero → three features → testimonial → CTA → footer. Hallmark forces different macrostructures for different briefs, then runs 57 slop-test gates plus a self-critique scored on six axes before it hands anything back.

Three verbs beyond the default build flow:

• hallmark audit <target> — scores an existing page against the anti-pattern list and returns a ranked punch list. Read-only, which makes it a safe first thing to try.
• hallmark redesign <target> [--mood <name>] — new visual structure inside the existing implementation boundaries.
• hallmark study <screenshot|URL> — extracts the design DNA of something you admire (macrostructure, type pairing, colour anchor) and can emit it as a portable design.md.

Some of its hard rules are worth stealing even if you never install it: no invented metrics (no “trusted by 50,000+ teams” unless it’s true), no fake browser chrome drawn around screenshots, no italic headings — apparently one of the most reliable AI tells — and mandatory verification at 320/375/414/768px.

I ran hallmark audit against this very post before publishing. It caught three italic headings I’d written without thinking, and told me that six near-identical metadata tables — one opening each tool section — had become their own templated rhythm. Both are fixed above. That is a fair description of what the tool is for.

Start with audit. It changes nothing and tells you a lot.

---

Bonus gap: hardware#

RunPod MCP#

runpod/runpod-mcp · official · @runpod/mcp-server

Lets the agent drive GPU infrastructure directly: list GPU types filtered by VRAM with live stock levels, spin up pods and serverless endpoints, stream worker logs, manage network volumes and templates, and check billing.

For the benchmarking work I do this is genuinely useful — “find me an available 80GB GPU, deploy this model, stream the logs” is a real sentence that now does something. The stock-availability filtering matters more than you’d expect, since the GPU you want is frequently the GPU nobody has.

Obvious warning: this is a tool that spends money. Scope its permissions deliberately.

---

The features already in your harness#

Before installing anything, some of the highest-leverage capabilities ship with Claude Code and mostly go untouched:

• Hooks. Shell commands the harness runs at lifecycle events — session start, before/after tool calls. This is the only way to get genuinely automatic behaviour, because the harness executes it rather than the model choosing to. My bd prime hook above is one example.
• Subagents. Parallel agents with their own context windows. The real win is context isolation: a subagent can read fifty files and hand back three paragraphs, leaving your main context clean.
• Background tasks and Monitor. Long builds and test runs don’t have to block the conversation.
• Built-in commands worth knowing: /simplify, /security-review, /code-review, /run, /loop, /schedule, /fewer-permission-prompts.

---

Setup cost, honestly#

---

The order I’d install them in#

1. Superpowers. Nothing else changes output quality this much for this little effort.
2. Playwright MCP — if you touch frontend at all. Letting the agent see its own work is transformative.
3. Context7. Cheap, and it eliminates a whole category of wrong-API bugs.
4. claude-mem. Install early, because its value compounds with history.
5. SearXNG. An hour of Docker for unlimited private search forever.
6. beads — once you have more work in flight than you can hold in your head.
7. CodeGraph — only on codebases large enough to get lost in.
8. Agent Reach, Hallmark, RunPod — when you have the specific need each one answers.

The pattern across all of them: the tools that change the most are the ones that constrain the agent’s process, not the ones that add flashy capabilities. Superpowers and beads make the agent slower and more deliberate, and that’s precisely why they’re first on the list.

The unglamorous ones win.