---
id: plugin-scanner
version: "2.0.1116"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# plugin-scanner — Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.

License: permissive · Maintenance: active · Downloads: 165.4K/mo

## What it is and what it does

plugin-scanner is a linting and verification tool designed for maintainers and CI workflows to analyze plugins, skills, MCP servers, and marketplace packages before release. It evaluates supported artifacts for security risks including secret exposure, prompt injection, unsafe commands, and malicious package patterns—the same threat surface that the broader HOL Guard runtime protection addresses, but at the pre-release stage rather than at execution time.

The tool integrates into CI pipelines and publish workflows to gate ecosystem packages with structured rule metadata and side-effect-free analysis. It depends on eight runtime packages including cryptography, keyring, requests, and rich for output formatting. It is actively maintained, supports Python 3.10 through 3.14, and carries no known vulnerabilities.

Use it for:

- Gate plugin and skill releases in CI by running `plugin-scanner verify` before publishing to a marketplace.
- Scan third-party MCP server packages for supply-chain risks before integrating them into an AI agent environment.
- Lint custom agent plugins and extensions to detect secret exposure or unsafe patterns before committing to a repository.
- Automate pre-release security checks for npm, PyPI, or other package ecosystems using supply-chain scanning.
- Explain specific package vulnerabilities or risk signals for a given package version and ecosystem.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Lints, verifies, and gates plugins, skills, MCP servers, and packages in CI workflows to detect security risks before release.

Yes. plugin-scanner is a focused, actively maintained CI tool for pre-release security analysis of AI agent ecosystem packages. It has low install friction, permissive licensing, no known vulnerabilities, and fills a specific maintainer/CI role complementary to runtime protection. Install it if you maintain plugins, skills, or MCP servers and want automated security gating before release.

## Install

pip install plugin-scanner
uv add plugin-scanner
poetry add plugin-scanner

## Installing plugin-scanner

Before you install: Low install friction with a pure-Python wheel and eight runtime dependencies. Active maintenance with a recent release (27 days old) and steady repository activity.

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions.

Quickstart:

pip install plugin-scanner
plugin-scanner verify .
plugin-scanner supply-chain scan

Requires Python 3.10 or later.

Verify before relying:

- Whether plugin-scanner can be used standalone or requires hol-guard to be installed for full functionality.
- Exact scope of supported package ecosystems beyond plugins, skills, and MCP servers.
- Whether supply-chain scanning requires network access or can run fully offline.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 165.4K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

plugin security scanning, mcp server verification, ai agent package linting, supply chain security ci, pre-release package analysis, plugin ecosystem gating, ai skill verification, ai-agent-security, supply-chain-gating, ci-integration

[View on SkillFed](https://skillfed.io/packages/plugin-scanner) · [View on PyPI](https://pypi.org/project/plugin-scanner/)