Open source · agents · 20 picks

Open-source Claude workflow resources

Source-backed agents, MCP servers, skills, hooks, commands, and guides that teams can inspect before adopting in Claude workflows.

Curated by @heyclaude-editors Updated 2026-07-18

Source-backed agents, MCP servers, skills, hooks, commands, and guides that teams can inspect before adopting in Claude workflows.

Compared at a glance

The top 5 picks side by side on trust, install, platform support, and disclosed notes — full rationale for each below.

3 trust signals differ across this comparison (Package trust, Source provenance, Submitter).

Next steps differ across picks — use the actions in the table below to copy install commands and source links per resource.

Field	GitHub Community Issue Triage Agent Source-backed agent for cleaning up open-source GitHub issue queues with reproducibility checks, labels, issue types, milestones, assignees, project views, duplicate links, and maintainer-safe response drafts. Open dossier	GitHub MCP Server for Claude Official GitHub MCP server providing comprehensive GitHub API access for repository management, file operations, and search functionality Open dossier	Windsurf AI-Native Collaborative Development Skill Master collaborative AI-assisted development with Windsurf IDE's Cascade AI, multi-file context awareness, and Flow patterns for team workflows. Open dossier	/zod-audit - Zod Auditor Command for Claude Code Production codebase auditor specialized in Zod schema validation coverage, security vulnerability detection, and dead code elimination Open dossier	Configure Claude Code Hooks with /hooks Use the built-in /hooks menu to inspect Claude Code hooks and configure them in settings.json so shell commands run deterministically at lifecycle events like PreToolUse, PostToolUse, and Stop. Open dossier
Next stepsDiffers	Open dossier API JSON Open LLM Open source Newsletter Claim listing	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing	Open dossier API JSON Open LLM Open source Newsletter Claim listing	Open dossier API JSON Open LLM Open source Newsletter Claim listing	Open dossier API JSON Open LLM Open source Newsletter Claim listing
Trust
Review status	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed
Package trustDiffers	Package not verified	Package verified	Package verified2025-10-16	Package not verified	Package not verified
Source provenanceDiffers	Source-backed	No submission link	No submission link	Source-backed	Source-backed
SubmitterDiffers	MkDev11	—	—	—	—
Install risk	Review first	Low risk	Low risk	Review first	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	GitHub	GitHub	Windsurf	—	—
Category	agents	mcp	skills	commands	commands
Source	Source-backed	First-party	First-party	Source-backed	Source-backed
Author	MkDev11	GitHub	JSONbored	JSONbored	JSONbored
Added	2026-06-05	2025-09-18	2025-10-16	2025-09-26	2025-10-25
Platforms	Claude Code	Claude Code Claude Desktop	Claude Code Codex Windsurf Gemini Cursor CLI	Claude Code	Claude Code
Harness	Claude Code	Claude Code Claude Desktop	Claude Code Codex Windsurf Gemini Cursor CLI	Claude Code	Claude Code
Source repo	—	—	—	—	—
Safety notes	✓Treat label changes, assignments, milestone moves, project edits, issue closures, discussion conversions, and maintainer mentions as repository governance actions. Draft them first unless the maintainer explicitly authorizes mutation. Do not close issues only because they are old, vague, unpopular, or difficult to reproduce. Apply the repository's documented stale, support, duplicate, or not-planned policy and preserve appeal paths. Avoid making security, severity, ownership, roadmap, or legal claims from model inference alone. Escalate suspected vulnerabilities or abuse to the repository's private security and moderation process. When recommending automation, keep rate limits, notification volume, contributor trust, and maintainer review capacity in view.	✓Use a least-privilege GitHub token because repository, issue, pull request, and file operations can modify public or private projects.	✓Setup downloads and unzips a package and changes Windsurf IDE configuration; review what it writes and run it in a trusted workspace.	✓Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project. Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output.	✓Hooks execute shell commands automatically with your user permissions whenever their event fires. A misconfigured or malicious hook can run destructive commands (file deletion, network calls, credential access) without further confirmation. PreToolUse hooks can allow or deny tool calls and PostToolUse hooks run after tools succeed; review hook commands before committing them to a shared .claude/settings.json so teammates do not inherit unexpected execution. Prefer `.claude/settings.json` for reviewed, team-shared hooks and `.claude/settings.local.json` for personal, gitignored hooks; use `disableAllHooks` to turn off user/project hooks when running untrusted code.
Privacy notes	✓Issue queues can contain private logs, stack traces, screenshots, crash dumps, tokens, email addresses, customer names, hostnames, reproduction links, and unpublished roadmap details. Draft public comments with minimal necessary detail. Ask reporters to move secrets, credentials, vulnerability reports, or private customer data to an approved private channel instead of quoting it back into the issue. Saved replies, duplicate summaries, and project fields can reveal internal routing rules or maintainer availability. Keep internal notes separate from public-facing triage comments. Search queries, exported issue lists, and triage reports should be treated as contributor data and retained only as long as the repository policy allows.	✓Repository contents, issues, pull requests, comments, org metadata, and user details may be sent through model context.	✓Windsurf (Cascade) sends your code and prompts to its AI backend to power multi-file operations; review Windsurf's data-handling settings and keep API keys and secrets out of committed config.	✓Reads the source files it audits, which may include schema definitions and sample data, and sends them to the model as part of the request; it does not transmit them anywhere else.	✓Command and HTTP hooks receive event JSON on stdin including `session_id`, `transcript_path`, `cwd`, and tool input (such as file paths and Bash commands); a hook that forwards this data over the network can expose local file contents, paths, or command arguments to third parties. HTTP hooks can include headers with interpolated environment variables (restricted by `allowedEnvVars`); avoid embedding secrets in hook configuration that is committed to a repository.
Prerequisites	GitHub repository issue queue or filtered issue list, with the repository's contribution, support, security, and code-of-conduct policies available. Current label taxonomy, issue types, milestones, project fields, assignee rules, duplicate policy, stale policy, and maintainer ownership map. Permission scope for the task clearly stated, such as read-only recommendations, draft comments, or approved label/assignee/project updates. Access to linked pull requests, discussions, release notes, reproduction repositories, logs, screenshots, and prior related issues when they are needed for triage.	GitHub account (sign up at https://github.com if needed) GitHub Personal Access Token with repo scope (generate from GitHub Settings > Developer Settings > Personal Access Tokens) Docker installed and running (verify with: docker --version) Internet connection (remote GitHub API access required)	Windsurf IDE installed (download from codeium.com/windsurf) Active project/codebase Git repository (recommended for version control) Codeium account (for Cascade AI features)	— none listed	— none listed
Install	—	`claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_TOKEN -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server && claude mcp list`	`curl -L https://heyclau.de/downloads/skills/windsurf-collaborative-development.zip -o windsurf-collaborative-development.zip && unzip -o windsurf-collaborative-development.zip -d ./windsurf-collaborative-development`	`/zod-audit`	—
Config	—	`{ "mcpServers": { "github": { "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}" }, "args": [ "run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server" ], "command": "docker", "type": "stdio" } } }`	—	—	—
Citations	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationdocs.github.com Submitted by MkDev112026-06-05 Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationgithub.com Package (SHA-256 pinned)/downloads/mcp/github-mcp-server.mcpb Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationdocs.windsurf.com Package (SHA-256 pinned)/downloads/skills/windsurf-collaborative-development.zip Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationowasp.org Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationcode.claude.com Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed	Unclaimed	Unclaimed