🔍代码审查 / GitHub MCP 推荐

Use when the user asks about GitNexus itself — available tools, how to query the knowledge graph, MCP resources, graph schema, or workflow reference. Examples: "What GitNexus tools are available?", "How do I use GitNexus?"

Trace bugs through call chains using knowledge graph

Use when the user asks about GitNexus itself — available tools, how to query the knowledge graph, MCP resources, graph schema, or workflow reference. Examples: "What GitNexus tools are available?", "How do I use GitNexus?"

Develop React Native, Flutter, or native mobile apps with modern architecture patterns. Masters cross-platform development, native integrations, offline sync, and app store optimization. Use PROACTIVELY for mobile features, cross-platform code, or app optimization.

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

Execute database migrations across ORMs and platforms with zero-downtime strategies, data transformation, and rollback procedures. Use when migrating databases, changing schemas, performing data transformations, or implementing zero-downtime deployment strategies.

Expert database optimizer specializing in modern performance tuning, query optimization, and scalable architectures. Masters advanced indexing, N+1 resolution, multi-tier caching, partitioning strategies, and cloud database optimization. Handles complex query analysis, migration strategies, and performance monitoring. Use PROACTIVELY for database optimization, performance issues, or scalability challenges.

Expert database administrator specializing in modern cloud databases, automation, and reliability engineering. Masters AWS/Azure/GCP database services, Infrastructure as Code, high availability, disaster recovery, performance optimization, and compliance. Handles multi-cloud strategies, container databases, and cost optimization. Use PROACTIVELY for database architecture, operations, or reliability engineering.

Gated, goal-backed Step 4 of the CursorQB workflow - implement one bounded, reversible, testable slice from an audited plan. Use after the Step 3 audit when the user approves implementation, or via /cursorqb-implement. Runs only when the audit is PASS or PASS_WITH_WARNINGS with no P0/P1 findings; otherwise it stops and recommends repair. Selects a single READY sub-plan, defines the validation command first, makes a minimal change, and verifies before claiming done.

Goal-backed Step 2 of the CursorQB planning workflow. Use to decompose every main phase in Planner-docs/Main-Planing.md into detailed sub-plans under Planner-docs/Faz-<n>-Plans/ plus Sub-Planing-Index.md. Launched automatically as a Cursor goal via the define-goal skill and runs until ALL phases are covered - it does not stop after one phase. Invoke from cursorqb-planner Gate 1, or directly to (re)generate sub-plans. Only changes files under Planner-docs/.

Guided five-step (1, 1.5, 2, 3, 4), goal-backed project planning orchestrator with a repo-aware intake. Use when the user runs /cursorqb-plan or asks CursorQB to plan a project end to end - master plan, existing-project autopsy, phase decomposition, coverage audit, then optional implementation. Runs a repo-aware Step 1 intake, produces Planner-docs/Main-Planing.md, runs a Step 1.5 autopsy (cursorqb-autopsy) for existing projects, then gates into phase decomposition (cursorqb-subplanner), a coverage/quality audit (cursorqb-auditor), and a gated implementation step (cursorqb-implementer) - launched automatically as Cursor goals via define-goal. Validates each step with the bundled validator.

Goal-backed Step 1.5 of the CursorQB planning workflow - an existing-project autopsy. Use after Step 1 (or directly) to inspect an existing/partially built repository and write Planner-docs/Autopsy.md, a 13-section technical feedback report that enriches Step 2 sub-plans. Runs automatically for existing/non-empty repositories and is skipped for empty or nearly empty ones. Launched automatically as a Cursor goal via the define-goal skill; only creates/updates Planner-docs/Autopsy.md.

Goal-backed Step 3 of the CursorQB planning workflow - a quality, coverage, consistency, and readiness audit of the Step 2 sub-plans. Use to verify that Planner-docs/Faz-*-Plans/*.md and Sub-Planing-Index.md are faithful to Main-Planing.md, complete, ordered, well-structured, and ready for implementation. Launched automatically as a Cursor goal via the define-goal skill and runs until every phase and sub-plan is inspected; produces only Planner-docs/Sub-Planing-Audit.md and returns PASS / PASS_WITH_WARNINGS / BLOCKED. Safe to run standalone for re-audits.

Reference document for monopoly security-checklist.

Expert skill for converting any codebase (React/HTML/Next.js) into a pixel-perfect, SEO-optimized, and dynamic WordPress theme.

Complete guide to implementing GitOps workflows with ArgoCD and Flux for automated Kubernetes deployments.

Vitest testing guide. Use when writing or updating tests, fixing failing tests, improving coverage, debugging test issues, or setting up mocks.

Applies Vitest test design and quality standards. Provides coverage requirements and mock usage guides. Use when writing unit tests.

Use when controlling web pages with the OpenClaw browser tool, especially multi-step flows, login checks, tab management, or recovery from stale refs/timeouts.

Review a GitHub pull request against QuestDB coding standards. Use when asked to review a PR, given a PR number or URL, optionally with a review level 0..3. Performs an adversarial, blocking, mission-critical code review.

Unterlagen und Lücken: sortiert Dokumente, erkennt Lücken, ordnet Beweiswert und formuliert gezielte Rückfragen.

Einstieg und Routing: klärt Rolle, Ziel, Frist, Aktenlage und den passenden nächsten Fachpfad.

AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.

Direct browser control via CDP — automate, scrape, test, or interact with web pages by driving the user's already-running Chrome (or a Browser Use cloud browser). Use when the user wants to click, screenshot, fill forms, extract data, or navigate real web pages. Default to screenshots + coordinate clicks, not selector hunting. Requires the one-time `browser-harness` CLI install (see references/install.md).

Review or audit CKEditor 5 plugin code in the Trilium (TriliumNext Notes) monorepo, or a PR/diff touching packages/ckeditor5-* or the packages/ckeditor5 build. Use when checking a Trilium CKEditor 5 plugin for correctness and idiom: schema / conversion / command / UI / widget code, CKEditor-specific defects (asymmetric upcast/downcast, unconsumed upcast elements, missing inline-widget position mapping, command refresh/isEnabled bugs, memory leaks, t() gaps, editing/UI split violations), and Trilium integration defects (plugin not registered in plugins.ts, button missing from toolbar.ts, import/file-extension lint failures, wrong augmentation module, .po localization gaps, wrong test environment). Pairs with the ckeditor5-plugin-development and ckeditor5-testing skills and delegates their checklists.

Testing CKEditor 5 plugins in the Trilium monorepo. Use when adding or reviewing unit tests for a packages/ckeditor5-* package, debugging a failing test, or setting up a package's test runner. Covers the two Vitest environments Trilium uses (happy-dom and the WebdriverIO browser mode), the per-package vitest.config.ts, testing against a real ClassicEditor, the model/view helpers imported from 'ckeditor5' (_setModelData / _getModelData / _getViewData and their {}/[] selection syntax), vi spies/mocks, idiomatic patterns for schema/conversion/command/UI tests, the pnpm --filter runner, and Trilium-specific conventions and gotchas. Complements the ckeditor5-plugin-development and writing-unit-tests skills.

Use when querying or extending GitNexus's PDG control/data-dependence surface (the `pdg_query` MCP tool, CDG/REACHING_DEF edges), or reasoning about "what controls X" / "where does Y flow" / guard clauses. Examples: "what guards this statement?", "trace this variable within the function", "why is the pdg_query result empty?", "add a CDG query".

Test file conventions: setup functions, factories, organization, type testing, naming, and pruning low-value tests. Use when: "write tests", "add a test", "fix this test", "delete tests", "prune tests", "audit tests", or modifying *.test.ts files.

Create and review QuickStack backend unit and integration tests using the project's Vitest, Prisma, SQLite, and k3s conventions. Use when editing backend test files under `src/server/`, `src/shared/`, or `src/__tests__/integration/`, or when the user asks for backend test coverage, mocks, Prisma test DB setup, or Kubernetes integration tests.

Create and update QuickStack backend services, adapters, standalone services, and server actions using the project's established singleton, adapter, caching, and error-handling patterns. Use when editing files under src/server/services, src/server/adapter, src/server/utils, src/server.ts, or related server-side actions and backend utilities.

How the Leap Monitor shows read-only editor-GUI agent rows - open Cursor (the editor) Agent/Composer tabs AND VS Code Copilot Chat sessions. Covers the on-disk scans (scan_open_cursor_agents, scan_open_vscode_copilot_sessions), status mapping, jump via the shared Leap extension, synthetic row reconciliation, the close buttons (Cursor close-tab / VS Code remove-row), and the shared GUI_TAG_PREFIXES/GUI_ROW_TYPES plumbing. Use this when working on cursor_gui_scan.py, vscode_copilot_scan.py, editor-GUI agent rows, or editor chat navigation.

Manage Docker containers, images, volumes, and Compose stacks. Requires Docker CLI access.

Guides ccusage Rust and Node tests. Use when adding or fixing cargo tests, Node test files, CLI snapshots, Claude model pricing, LiteLLM compatibility, or fixture-backed tests.

Guides ccusage TypeScript and JavaScript work. Use before reading or editing .ts, .tsx, .js, or .jsx files, including package launchers, Node tests, schemas, mocks, and typed fixtures.

Deploy a CSS/OpenSearch code-search MCP server on Huawei Cloud ECS from scratch, so that Claude Code (claude-glm) can search a GitHub repo's code and docs as native MCP tools. Use when the task is to provision a new Huawei Cloud CSS cluster and ECS, index a code repository into CSS, and expose it as a searchable MCP tool for AI coding agents.

Use when the user asks how code works, wants to understand architecture, trace execution flows, or explore unfamiliar parts of the codebase. Examples: "How does X work?", "What calls this function?", "Show me the auth flow"

Use when the user wants to rename, extract, split, move, or restructure code safely. Examples: "Rename this function", "Extract this into a module", "Refactor this class", "Move this to a separate file"

Use when the user asks how code works, wants to understand architecture, trace execution flows, or explore unfamiliar parts of the codebase. Examples: "How does X work?", "What calls this function?", "Show me the auth flow"

Use when the user wants to rename, extract, split, move, or restructure code safely. Examples: "Rename this function", "Extract this into a module", "Refactor this class", "Move this to a separate file"

Navigate unfamiliar code using GitNexus knowledge graph

Plan safe refactors using blast radius and dependency mapping

Use when working on, reviewing, or extending GitNexus's CFG/taint/PDG subsystem (the `--pdg` layers), or when reasoning about source→sink data-flow findings. Examples: "How does taint analysis work here?", "Why didn't explain find this flow?", "Add a new sink/source", "Review the interprocedural taint code".

Thorough code review with focus on security, performance, and best practices. Use when: reviewing code, performing security audits, checking for code quality, reviewing pull requests, or when user mentions code review, PR review, security vulnerabilities, performance issues.

Use when the user wants a hands-free loop where grabbing UI elements in the browser with React Grab feeds tasks to the agent automatically, with no copy-paste or manual handoff. Triggers: "watch react grab", "monitor my grabs", "auto-process react grab", "watch my clipboard for grabs". Not for a one-off paste of a single grab; this is the continuous, always-on loop.

Use the TypeScript language server (`typescript-language-server`) for precise code intelligence in the `clickhouse-js` repository: go-to-definition, find references, hover (type signatures and JSDoc, including `@deprecated` info), workspace-wide symbol search, completions, and per-file type diagnostics. Prefer this over grep when you need to resolve a symbol's actual definition, find all usages of an exported API, or inspect inferred types across the `packages/*` workspaces. The server is preinstalled as a root devDependency — run the repository `setup` skill (`npm install`) first so `node_modules` is populated. Do NOT use this skill for downstream projects that merely depend on `@clickhouse/client`; it is specific to working inside this repo.

Add, authenticate, list, and remove MCP (Model Context Protocol) servers — connect any external tool or service that publishes an MCP endpoint to the assistant

Reviews all local changes in the repository for errors, styling compliance, unintended outcomes, and necessary documentation/test/sample updates. Generates a report and assists in fixing identified issues on-demand. Triggers on "adk-review", "review changes", "pr review", "check code style", "verify changes".