Claude Code Plugin Checker
Run the Sigistry eight-check verification against any public GitHub repository - the same methodology every listed plugin passes before it earns the badge. Static analysis only; your code never leaves your browser.
The eight checks
The registry's verification methodology: manifest integrity, hook safety, agent tool scopes, command hygiene, skill structure, skill safety, no secrets, and documentation. Every verified plugin in the catalog passes all eight, re-checked by CI on every change.
FAQ
What does the plugin checker do?
It runs the Sigistry eight-check verification methodology against any public GitHub repository, right in your browser: manifest integrity, hook safety, agent tool scopes, command hygiene, skill structure, skill safety, no secrets, and documentation. Static analysis only - nothing is executed.
Is this the same check the registry runs?
It is the same methodology (v1.0) and the same rules, ported from the open-source verifier (scripts/verify-plugins.mjs in the marketplace repository). The authoritative run still happens in registry CI when you submit - this page is the preflight, so you can fix failures before opening a PR.
Does my code get uploaded anywhere?
No. Your browser fetches the repository files directly from GitHub and runs the checks locally. Nothing passes through Sigistry servers.
My plugin passes - how do I get the badge?
Submit it to the registry: vendor it into the marketplace repo for the Verified tier, or keep it in your repo and get verified at a pinned commit. Both paths are covered in the contributing guide, and the badge goes live when your PR merges.
What if my plugin fails a check?
Each failure lists the exact file and reason. Fix them and re-run - most failures (missing frontmatter descriptions, thin READMEs, unscoped agent tools) take minutes to resolve. The methodology page explains what each check demands and why.
Part of the Sigistry trust layer
The same open, evidence-cited method, applied across the agent supply chain.
Plugins
Eight static security checks, re-run by CI on every change.
You are hereSkills
Screened for prompt-injection, greedy triggers, and unsafe scripts.
Learn more →A–F scorecardMCP servers
Graded against the 2026-07-28 spec, with evidence and a right to respond.
Learn more →Safety checkerMCP AppsNew
ui:// resources checked for spec conformance and sandbox hygiene.
Learn more →