PluginProof 0.1.3

PluginProof is a read-only, zero-dependency validator for Codex and Claude Code plugin packages. It checks manifests, component paths and path escapes, external symlinks, repository and personal marketplace entries, Agent Skill and Claude plugin-agent frontmatter, Claude channel references to bundled MCP servers, package name/version drift, publish-file coverage, and common cross-harness packaging mismatches. It validates the package on disk without loading the plugin or running its hooks, MCP servers, scripts, binaries, or lifecycle commands. Reports contain finding metadata and plugin-relative paths rather than manifest contents or absolute plugin-root paths, and PluginProof performs no network requests.

Tags security software-development static-analysis javascript nodejs cli developers artificial-intelligence claude-code codex plugins
License MITL
State stable

Homepage Download

Recent Releases

0.1.324 Jul 2026 20:44 security: Version 0.1.3 adds private mode-0600 exclusive-create report files through --output, writes the complete report before --check returns status 1, and removes the absolute plugin-root path from terminal and JSON reports. It builds on validation for Claude agent frontmatter, bundled MCP channel references, component symlinks, marketplace sources, skill manifests, package drift, and publish-file coverage.