plugin-scanner

What it is and what it does

plugin-scanner is a linting and verification tool designed for maintainers and CI workflows to analyze plugins, skills, MCP servers, and marketplace packages before release. It evaluates supported artifacts for security risks including secret exposure, prompt injection, unsafe commands, and malicious package patterns—the same threat surface that the broader HOL Guard runtime protection addresses, but at the pre-release stage rather than at execution time.

The tool integrates into CI pipelines and publish workflows to gate ecosystem packages with structured rule metadata and side-effect-free analysis. It depends on eight runtime packages including cryptography, keyring, requests, and rich for output formatting. It is actively maintained, supports Python 3.10 through 3.14, and carries no known vulnerabilities.

Use it for:

• Gate plugin and skill releases in CI by running `plugin-scanner verify` before publishing to a marketplace.
• Scan third-party MCP server packages for supply-chain risks before integrating them into an AI agent environment.
• Lint custom agent plugins and extensions to detect secret exposure or unsafe patterns before committing to a repository.
• Automate pre-release security checks for npm, PyPI, or other package ecosystems using supply-chain scanning.
• Explain specific package vulnerabilities or risk signals for a given package version and ecosystem.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Lints, verifies, and gates plugins, skills, MCP servers, and packages in CI workflows to detect security risks before release.

Yes. plugin-scanner is a focused, actively maintained CI tool for pre-release security analysis of AI agent ecosystem packages. It has low install friction, permissive licensing, no known vulnerabilities, and fills a specific maintainer/CI role complementary to runtime protection. Install it if you maintain plugins, skills, or MCP servers and want automated security gating before release.

Install

plugin-scanner on PyPI

pip install plugin-scanner

uv add plugin-scanner

poetry add plugin-scanner

Installing plugin-scanner

Before you install

Low install friction with a pure-Python wheel and eight runtime dependencies. Active maintenance with a recent release (27 days old) and steady repository activity.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions.

Quickstart

pip install plugin-scanner
plugin-scanner verify .
plugin-scanner supply-chain scan

Requires Python 3.10 or later.

Verify before relying

• Whether plugin-scanner can be used standalone or requires hol-guard to be installed for full functionality.
• Exact scope of supported package ecosystems beyond plugins, skills, and MCP servers.
• Whether supply-chain scanning requires network access or can run fully offline.

Package facts

Evidence: plugin_scanner-2.0.1116-py3-none-any.whl

Keywords: ai agent security, ai agents, ai antivirus, claude, cli, codex, cursor, gemini, mcp security, opencode, plugin security, prompt injection, runtime security, secrets detection, supply chain security

Tags

More Security packages

Further reading