Generated source
This hub uses the same local package data as individual package pages: Nucleus package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.
topical
Productivity CLI packages
Productivity CLIs and desktop-adjacent tools that agents may use for notes, documents, mail, calendars, and workflow automation.
summary
Why this package group is here
Productivity CLI packages currently includes 933 package catalog entries. 12 have protected-tool coverage, 1 have approval-gate metadata, and 171 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.
Review model
Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.
High-signal tools
ghTrivially Accessible Secretsdropbox-uploaderPlain Text Dropbox OAuth TokenansiblePlain Text Ansible Galaxy TokenfastlanePlain Text fastlane Spaceship Sessionsqwen-codePlain Text Qwen Code API Keysmidnight-commanderPlain Text Midnight Commander VFS Credentialswakatime-cliPlain Text WakaTime API Keystodoist-cliPlain Text Todoist API TokengrafanactlPlain Text Grafana CredentialspulumiPlain Text Pulumi Access Tokensimap-backupPlain Text IMAP Account PasswordsgotifyPlain Text Gotify Application Token
Protected tools
ghTrivially Accessible Secretsdropbox-uploaderPlain Text Dropbox OAuth TokenansiblePlain Text Ansible Galaxy TokenfastlanePlain Text fastlane Spaceship Sessionsqwen-codePlain Text Qwen Code API Keysmidnight-commanderPlain Text Midnight Commander VFS Credentialswakatime-cliPlain Text WakaTime API Keystodoist-cliPlain Text Todoist API Token
Approval-gated tools
Related hubs
Representative package spokes
ghTrivially Accessible Secretsgnupgno executable entrypoint in the package indexyqnarrow executable package without higher-risk signalstmuxno executable entrypoint in the package indexappiumAutomation for Apps.agent-browserBrowser automation CLI for AI agentspandocnarrow executable package without higher-risk signals@sanity/exportExport Sanity documents and assetsmbedtlsbroad file, network, media, or database tool signalwatchmanno executable entrypoint in the package indexjustno executable entrypoint in the package indexdetoxE2E tests and automation for mobilevimno executable entrypoint in the package indexansiblePlain Text Ansible Galaxy TokenworkflowWorkflow SDK - Build durable, resilient, and observable workflowsgradlebuild system capable of executing project logic
packages
Indexed package pages
| Package | Manager | Signals | Why it appears here |
|---|---|---|---|
| gh | Homebrew | protected-tool coverage, approval gate, blue risk, v2.93.0 | Trivially Accessible Secrets |
| dropbox-uploader | Homebrew | protected-tool coverage, yellow risk, v1.0 | Plain Text Dropbox OAuth Token |
| ansible | Homebrew | protected-tool coverage, green risk, v14.0.0 | Plain Text Ansible Galaxy Token |
| fastlane | Homebrew | protected-tool coverage, green risk, v2.236.0 | Plain Text fastlane Spaceship Sessions |
| qwen-code | Homebrew | protected-tool coverage, green risk, v0.17.1 | Plain Text Qwen Code API Keys |
| midnight-commander | Homebrew | protected-tool coverage, green risk, v4.8.33 | Plain Text Midnight Commander VFS Credentials |
| wakatime-cli | Homebrew | protected-tool coverage, green risk, v2.15.1 | Plain Text WakaTime API Keys |
| todoist-cli | Homebrew | protected-tool coverage, green risk, v1.73.1 | Plain Text Todoist API Token |
| grafanactl | Homebrew | protected-tool coverage, green risk, v0.1.10 | Plain Text Grafana Credentials |
| pulumi | Homebrew | protected-tool coverage, orange risk, v3.245.0 | Plain Text Pulumi Access Tokens |
| imap-backup | Homebrew | protected-tool coverage, blue risk, v16.6.0 | Plain Text IMAP Account Passwords |
| gotify | Homebrew | protected-tool coverage, blue risk, v2.3.2 | Plain Text Gotify Application Token |
| gradle | Homebrew | yellow risk, v9.5.1 | build system capable of executing project logic |
| go-task | Homebrew | yellow risk, v3.51.1 | generalized runtime or code generation signal |
| doxygen | Homebrew | yellow risk, v1.17.0 | generalized runtime or code generation signal |
| parallel | Homebrew | yellow risk, v20260522 | broad file, network, media, or database tool signal |
| powershell | Homebrew | yellow risk, v7.6.2 | generalized runtime or code generation signal |
| groovysdk | Homebrew | yellow risk, v5.0.6 | generalized runtime or code generation signal |
| autojump | Homebrew | yellow risk, v22.5.3 | generalized runtime or code generation signal |
| byobu | Homebrew | yellow risk, v7.9 | generalized runtime or code generation signal |
| jiratui | Homebrew | yellow risk, v1.8.1 | generalized runtime or code generation signal |
| docker-agent | Homebrew | yellow risk, v1.74.0 | generalized runtime or code generation signal |
| translate-shell | Homebrew | yellow risk, v0.9.7.1 | generalized runtime or code generation signal |
| rofi | Homebrew | yellow risk, v2.0.0 | generalized runtime or code generation signal |
| intelli-shell | Homebrew | yellow risk, v3.4.3 | generalized runtime or code generation signal |
| murex | Homebrew | yellow risk, v7.2.1001 | generalized runtime or code generation signal |
| tasksh | Homebrew | yellow risk, v1.2.0 | generalized runtime or code generation signal |
| fb-client | Homebrew | yellow risk, v2.4.0 | broad file, network, media, or database tool signal |
| pyp | Homebrew | yellow risk, v1.3.0 | generalized runtime or code generation signal |
| doitlive | Homebrew | yellow risk, v5.2.1 | generalized runtime or code generation signal |
| boot-clj | Homebrew | yellow risk, v2.8.3 | generalized runtime or code generation signal |
| cargo-make | Homebrew | yellow risk, v0.37.24 | generalized runtime or code generation signal |
| exim | Homebrew | yellow risk, v4.99.4 | generalized runtime or code generation signal |
| recur | Homebrew | yellow risk, v3.3.0 | generalized runtime or code generation signal |
| sbuild | Homebrew | yellow risk, v0.7.7 | generalized runtime or code generation signal |
| shell2http | Homebrew | yellow risk, v1.17.0 | broad file, network, media, or database tool signal |
| nmh | Homebrew | yellow risk, v1.8 | generalized runtime or code generation signal |
| mdsh | Homebrew | yellow risk, v0.9.2 | generalized runtime or code generation signal |
| empty | Homebrew | yellow risk, v0.6.23d | generalized runtime or code generation signal |
| omake | Homebrew | yellow risk, v0.10.7 | generalized runtime or code generation signal |
| desk | Homebrew | yellow risk, v0.6.0 | generalized runtime or code generation signal |
| ngs | Homebrew | yellow risk, v0.2.17 | generalized runtime or code generation signal |
| xe | Homebrew | yellow risk, v1.0 | generalized runtime or code generation signal |
| sexpect | Homebrew | yellow risk, v2.3.15 | generalized runtime or code generation signal |
| ppss | Homebrew | yellow risk, v2.97 | generalized runtime or code generation signal |
| gnupg | Homebrew | green risk, v2.5.20 | no executable entrypoint in the package index |
| yq | Homebrew | green risk, v4.53.3 | narrow executable package without higher-risk signals |
| tmux | Homebrew | green risk, v3.6b | no executable entrypoint in the package index |
| pandoc | Homebrew | green risk, v3.9.0.2 | narrow executable package without higher-risk signals |
| watchman | Homebrew | green risk, v2026.06.08.00 | no executable entrypoint in the package index |
| just | Homebrew | green risk, v1.52.0 | no executable entrypoint in the package index |
| vim | Homebrew | green risk, v9.2.0600 | no executable entrypoint in the package index |
| hugo | Homebrew | green risk, v0.163.0 | narrow executable package without higher-risk signals |
| actionlint | Homebrew | green risk, v1.7.12 | no executable entrypoint in the package index |
| sphinx-doc | Homebrew | green risk, v9.1.0 | no executable entrypoint in the package index |
| sourcekitten | Homebrew | green risk, v0.37.3 | narrow executable package without higher-risk signals |
| md4c | Homebrew | green risk, v0.5.3 | narrow executable package without higher-risk signals |
| jbig2dec | Homebrew | green risk, v0.20 | library-like package without higher-risk signals |
| terraform-docs | Homebrew | green risk, v0.24.0 | no executable entrypoint in the package index |
| television | Homebrew | green risk, v0.15.8 | no executable entrypoint in the package index |
| cliclick | Homebrew | green risk, v5.1 | narrow executable package without higher-risk signals |
| zellij | Homebrew | green risk, v0.44.3 | no executable entrypoint in the package index |
| ocrmypdf | Homebrew | green risk, v17.5.0 | narrow executable package without higher-risk signals |
| docutils | Homebrew | green risk, v0.23 | narrow executable package without higher-risk signals |
| glow | Homebrew | green risk, v2.1.2 | narrow executable package without higher-risk signals |
| docbook-xsl | Homebrew | green risk, v1.79.2 | narrow executable package without higher-risk signals |
| overmind | Homebrew | green risk, v2.5.1 | narrow executable package without higher-risk signals |
| plantuml | Homebrew | green risk, v1.2026.6 | no executable entrypoint in the package index |
| texinfo | Homebrew | green risk, v7.3 | narrow executable package without higher-risk signals |
| tealdeer | Homebrew | green risk, v1.8.1 | narrow executable package without higher-risk signals |
| lefthook | Homebrew | green risk, v2.1.9 | no executable entrypoint in the package index |
| prettier | Homebrew | green risk, v3.8.3 | narrow executable package without higher-risk signals |