What is HOL Plugins?
HOL Plugins is a public catalogue of coding-agent plugins, the packages that add skills, MCP servers, hooks and commands to Claude Code, Codex, Cursor, Antigravity CLI, OpenCode and other agents. Each listing shows a Trust Score out of 100, a security label, owner verification, GitHub activity and per-agent install commands. HOL's November 2026 report counts 1,063 packaged plugins, of which 844 had been scanned, inside a wider index of 53,114 listings that is mostly MCP servers.
The score comes from a static scan: HOL reads the plugin's files and manifests but never runs it. HOL publishes the method, including weights, caps and its own test of the scanner's blind spots, and repeats on every page that a scan is not a safety guarantee. A JSON API, a read-only MCP endpoint and the open-source hol-guard CLI expose the same data; hol-guard can install a listed plugin into Claude Code or Codex and refuses one the scan blocked.
HOL is run by Hashgraph Online DAO LLC, registered in Majuro, Marshall Islands, and founded in 2024. Browsing and listing a public GitHub repository are free; HOL earns money from listing memberships, sponsored placements, ads and its HOL Guard security product.
Is HOL Plugins worth it?
Installing a Claude Code or Codex plugin means letting a stranger's instructions and scripts run with your shell, your files and often your API keys. Most people glance at the star count and hope.
HOL Plugins does a first look for you. It reads each plugin's files, scores it out of 100 and puts the result beside the install command for every agent it supports. Its November report counts 1,063 packaged plugins and 844 of them scanned, with Codex declared by 624 and Claude Code by 618.
The score is published down to the arithmetic. Security is 40% of it, starting at 100 and losing 45 points for a critical finding, 35 for a high, 12 for a medium and 5 for a low. Provenance, such as a pinned commit or a verified manifest digest, is 20%; installability 15%; MCP server setup 10%; a named and verified publisher 10%; and housekeeping files like a README, SECURITY.md and a lockfile 5%. Any high or critical finding caps the total at 39, whatever the rest looks like. The Safe, Review, Caution and Unsafe labels come from the security part alone, so a polished plugin cannot hide a bad finding behind good paperwork.
What earns more trust than the score is what HOL admits about it. In its own test of 11 evasion tricks, the scanner caught 4 and missed 7, including a base64 command piped into a shell, zero-width characters and a plain sentence asking the agent to paste your .env file into its reply. And 531 of the 844 scanned plugins, 62.9%, carry the second-worst label, findings to review closely.
The catch: the listing count flatters the coverage. The same report lists 52,042 MCP servers, of which HOL had scanned 14. Money also sits close to the score. Membership never changes it, HOL says, but HOL Blue at $4.99 a month gets each new release re-scanned within an hour, a README badge linking to HOL adds 2%, sponsored slots start at $200 a month, and the sponsor shown on the page is HOL's own Guard product. The operator is a Marshall Islands DAO LLC whose about page names no people.
Our take: read the score like a food hygiene sticker in a restaurant window. A low one is a good reason to walk on; a high one tells you the inspector looked, not that the kitchen is clean.
Where it earns its place
A backend developer about to install a stranger's Claude Code plugin
Check it will not read my secrets or run something nasty
Open the plugin's trust page, look at the security component and its findings rather than the headline number, and treat any score at or below the 39 cap as a high-severity finding to read in the source. Free, and a few minutes per plugin.
A platform lead at a 30-developer company
Draft an approved list of agent plugins for the team
Use the Safe label, owner verification and pinned-commit provenance as a first filter, then review the shortlist by hand. Enforcing it on laptops with HOL Guard Team at $30 a seat comes to $900 a month.
An indie plugin author shipping to Claude Code and Codex
Get a better trust score without paying for it
List the public repo free through GitHub, add SECURITY.md, a lockfile and a licence, pin releases to commits and keep security checks in CI to avoid the 10% deduction. Blue at $4.99 a month only speeds up re-scans.
Before you commit
- Setup
- Browse hol.org/plugins with no account; plugin owners connect GitHub to list a public repository for free. The hol-guard CLI installs with pipx and can plan, apply and undo a listed plugin install in Claude Code and Codex.
- Integrations
- JSON API at hol.org/registry/api/v1 (search, plugin detail, install commands, security breakdown), a read-only MCP endpoint, an llms-full.txt index, integrity event feeds in JSON and RSS, and an Apache-2.0 security dataset on Hugging Face.
- Data and privacy
- Browsing needs no account; Google ads may set cookies when enabled, and are not loaded under Do Not Track. HOL Guard install reports are opt-in and send only listing, runtime and version weekly; raw reports are deleted after 13 weeks and weekly totals kept 12 months. Commercial reuse of HOL's scores needs written permission.
- Cost at scale
- Free for readers at any scale; a team that wants enforcement on machines pays for HOL Guard Team at $30 per seat a month, and an author with several listings pays Gold at $22.99 a month for priority re-scans.
- Limits
- Static scan only, with documented misses for encoded commands, run-time assembled commands, downloaded payloads and plain-prose instructions; MCP servers are mostly unscanned; scores are not normalised per runtime; the API is rate limited without published figures.
What’s good
- Free, with no account needed to browse
- Scoring method published with weights, caps and adjustments
- High or critical findings cap a plugin at 39 regardless of polish
- Publishes its scanner's misses: 7 of 11 evasion tests
- Install commands for Claude Code, Codex, Cursor and more on one page
What’s not
- Static scan only; never runs the plugin
- 14 of 52,042 listed MCP servers scanned
- Paid Blue listings get faster re-scans; a badge link adds 2%
- Catalogue counts differ between pages
- Operator is a Marshall Islands DAO LLC with no named people
Best for
Developers and platform teams who want a quick, documented risk signal before installing a coding-agent plugin, and will still read the code.
HOL Plugins: common questions
- Is HOL Plugins worth it?
- A useful first sniff test for coding-agent plugins, honest about its own blind spots, but the score is a static read of the files and the money sits uncomfortably close to it. We rate it 3.6 out of 5.
- How much does HOL Plugins cost?
- Free to browse and to list a public GitHub repository. Optional for plugin owners: HOL Blue $4.99/month per listing, Gold $22.99/month; sponsored placements from $200/month. HOL Guard is separate: Free, Solo $4.99, Pro $15, Team $30/seat/month.
- What are the downsides of HOL Plugins?
- Static scan only; never runs the plugin; 14 of 52,042 listed MCP servers scanned; paid Blue listings get faster re-scans; a badge link adds 2%; catalogue counts differ between pages; operator is a Marshall Islands DAO LLC with no named people.
- Who is HOL Plugins best for?
- Developers and platform teams who want a quick, documented risk signal before installing a coding-agent plugin, and will still read the code.
- How much does HOL Plugins cost for a team or in production?
- Free for readers at any scale; a team that wants enforcement on machines pays for HOL Guard Team at $30 per seat a month, and an author with several listings pays Gold at $22.99 a month for priority re-scans.
- Is HOL Plugins safe for company data?
- Browsing needs no account; Google ads may set cookies when enabled, and are not loaded under Do Not Track. HOL Guard install reports are opt-in and send only listing, runtime and version weekly; raw reports are deleted after 13 weeks and weekly totals kept 12 months. Commercial reuse of HOL's scores needs written permission.
Answers checked Nov 11, 2026.