Find plugins

by Anh-Thi Dinh

Lean toolkit for disciplined engineering workflows with Codex CLI

by ncaq

Generate a commit message from staged changes, then let the user review before committing in manual mode or commit without confirmation in auto mode. Use when the user wants to commit changes or create a git commit.

by chock-core

Blocks adding a known-malicious package version (npm, PyPI, crates, Go, RubyGems, Packagist manifests and lockfiles), a re-pointed action ref, or an IOC file name, from a dated, sourced list (data/ioc.json, CI fails 120 days after as_of). Runs: commit, agent write, turn's end; only additions judged. Exact versions only: a range is not resolved. A snapshot, not a feed; friction, not a boundary. Adopt under rollout observe.

by Ricardo Albuquerque

English. The answer goes in the first sentence; cut preamble and process narration; keep every caveat that changes what the reader does. Governs chat replies, plans, decisions, commit messages, PR descriptions, cards, review comments and release notes — and the text written into code, from comments to screens. Forces its output style on while enabled, restates the style beside every prompt, and ships a SessionStart hook with self-update, a credit guard on the commands that publish text, fourteen commands — rewrite, pr, card, commit, comment, release, plan, decide, draw, status, handoff, audit, trim, woman — and an audit agent.

by voitta-ai

Create or update a Confluence Cloud page when the Atlassian Rovo connector is read-only - but check first that it still is, since the connector gets re-authorized and a...

by voitta-ai

Decide whether a new major of a security gate you consume is safe to adopt, when your product depends on a distinction the gate's own host does not -- a vendor's honest 'zero drift' can be true for their host and catastrophic for yours. Use when a dependency you gate on ships a major or a rule-set cut, when release notes quantify an improvement you cannot map onto your own semantics, or when writing the startup check that decides whether a dependency is usable. Covers replaying against your own boundary in both directions, the delegated-versus-unreadable collapse, verifying the tree a drift number was measured on, drawing the startup probe from the affected population rather than the survivors, and asking the vendor to report what the verdict depended on.

by Prompted LLC

Portable, harness-agnostic governance lifecycle for the Ubiquity substrate (this plugin is the Claude Code adapter). Captures lessons as CogPRs, preserves session continuity, routes proposals through human-gated review, and tracks recurring friction through the signal manifold.

by jinhongan

ContextGuard keeps AI coding-agent context lean, safe, and auditable with project-local setup, scans, large-read guards, output trimming/sanitizing, queryable log artifacts, budgeted context packs, tool/MCP schema pruning, statusline visibility, and usage audits.

by chock-core

trigger: context bloat, stale observations, resolved content inlined, noisy exploration. avoid: context rot and lost-in-the-middle failures.

by chock-core

trigger: context bloat, stale observations, resolved content inlined, noisy exploration. avoid: context rot and lost-in-the-middle failures.

by Oussema Khlifi

Teach your AI agent to build clean terminal UIs: dark themes, cards, forms, modals, inline images, live dashboards. One skill, two stacks (Python Textual + TypeScript OpenTUI).

by jmagar

Self-hosted log aggregation and investigation for homelabs: syslog, Docker, OTLP, and AI transcripts in SQLite/FTS, exposed over MCP, CLI, and REST.

by NodeOps

Run ad-hoc, heavy, or untrusted code OFF your machine in disposable CreateOS Sandboxes. One-shot offload, parallel fanout across N boxes, instant scratch shell, a reusable box with file sync for live dev loops, port tunnel to localhost, public HTTPS expose, a graphical Linux desktop with computer-use (screenshot/click/type) and a live noVNC link, multi-box private-network clusters, BYO-S3 disk mounts, WireGuard VPN, snapshot/fork, pause/resume to park a warm box at zero compute cost, custom Dockerfile-built images so boxes boot pre-provisioned, and running another coding agent (Claude Code, Codex, OpenCode, Pi, Cursor) on your code inside a box against OpenRouter or any OpenAI-/Anthropic-compatible provider. Big dirs auto-excluded from uploads; auto-installs the createos CLI if missing.

by NodeOps

Run ad-hoc, heavy, or untrusted code OFF your machine in disposable CreateOS Sandboxes via the `cos` driver — offload, fanout, scratch shell, reusable box with sync, tunnel, expose, clusters, S3 disks, VPN, pause/resume, custom images, and a graphical desktop you drive by screenshot/click/type.

by voitta-ai

Resume a credential audit whose sweep manifest has gone stale: expired paths, the three meanings of an unreadable span, the rule that could-not-read never becomes safe-to-delete, and the surfaces the audit itself creates.

by voitta-ai

Audit a credential-redaction layer you own: find the holes a normal test suite misses (fixtures that hide the bug, patterns that bypass the value guard, dropped overlap spans, non-idempotence, backwards allow-lists, fail-open imports), then scrub what already leaked.

by mobdotso

Contribute agent time to Dark Forest: learn swarm research, investigate public traces, and share findings through your Mob account.

by John Kozaris

Find and remove dead code, unused imports, and duplicates across any language

by Grunion AI

Turn any content into one self-contained, hand-editable HTML slide deck: brand-true type roles, drag-and-retype editor, in-file PDF, verified layout. Zero dependencies.

by YPY

Claude is the architect: it writes specs and verdicts and picks a reasoning effort per task. The relay model (follows your codex config) on an OpenAI-compatible relay does all the implementation — agentically through the Codex CLI by default, or as chat completions applied verbatim as the fallback — and a clean-context Claude advisor reviews every deliverable before it ships.

devlog is an open-source Claude Code plugin indexed from GitHub. Review its manifest and source before installing.

by Nate Swenson

Turn each new version release (git tag) into a polished, researched how-to guide with real gotchas, written in your voice and published to GitHub

by chock-core

Warns (observe rollout, never refuses) when a change to a Dockerfile, Containerfile or compose file adds: a base image with no tag, latest, an unresolvable ARG or no digest (stage-aware: FROM or COPY --from a stage is not an image); a final stage running as root; TLS or package-signature checks off; secret-named ENV/ARG/environment literals; COPY of key or .env files; remote ADD without checksum; fetch piped to a shell; RUN --security=insecure; chmod 777 or setuid; sudo, sshd, chpasswd; unpinned git clone; ONBUILD RUN; compose privileged, broad cap_add, unconfined profiles, devices, host namespaces, runtime socket or host-root mounts, database ports on every interface, untagged images. A one-line form is left to block-fetch-exec-in-files, block-unpinned-agent-components or agentic-code-security only where that gate is installed and reads the file; scan-secrets lines always. Misses: build args overriding defaults, commands in variables, aliases or $'' quoting, bake and k8s files. Friction, not a boundary.

by John Kozaris

Pure .NET 10 backend architecture for Kestrel-hosted REST and SignalR services with DI, data access, and SOLID review