# Sigistry > A curated plugin marketplace for Claude Code. Every listed plugin passes a seven-check static security verification (hook safety, least-privilege agent tool scopes, no secrets, manifest integrity) before it ships. 28 plugins, 22 verified. Facts an agent should know: - Add the marketplace inside Claude Code: `/plugin marketplace add sigistry/marketplace` - Install any plugin after that: `/plugin install ` - Read-only MCP server over the catalog (Streamable HTTP, no auth): `claude mcp add --transport http sigistry https://sigistry.com/mcp` ("com.sigistry/plugin-catalog" in the official MCP registry) - Machine-readable catalog: https://raw.githubusercontent.com/Sigistry/marketplace/main/.claude-plugin/marketplace.json - Machine-readable verification results (per-check, per-plugin): https://raw.githubusercontent.com/Sigistry/marketplace/main/.claude-plugin/verified.json - Verification badge for any plugin: https://sigistry.com/badge/.svg - Pages on this site expose WebMCP tools (document.modelContext): search_plugins, get_plugin, list_categories, open_plugin_page ## Docs - [All plugins](https://sigistry.com/plugins): searchable catalog with category filters - [Verification methodology](https://sigistry.com/verification): what the Verified badge means, all seven checks, FAQ - [Plugin checker](https://sigistry.com/claude-plugin-checker): free in-browser tool that runs the seven checks against any public GitHub repo - [Get verified](https://sigistry.com/get-verified): how plugin authors earn the badge (tiers, steps, embed snippet) - [Use-case workflows](https://sigistry.com/use-cases): step-by-step multi-plugin workflows - [Claude Code hooks reference](https://sigistry.com/claude-code-hooks): every hook event and when to use hooks vs skills - [MCP scorecards](https://sigistry.com/mcp-scorecards): public MCP servers graded against the 2026-07-28 spec - [MCP Apps](https://sigistry.com/mcp-apps): what MCP Apps (SEP-1865) are, how they work, and the security surface the iframe sandbox does not cover - [MCP App safety checker](https://sigistry.com/mcp-app-checker): free in-browser audit of a ui:// resource and its metadata, for spec conformance and security hygiene - [News & guides](https://sigistry.com/blog) ## Plugins - [code-auditor](https://sigistry.com/plugin/code-auditor): Comprehensive code auditing and assessment plugin with security, architecture, and performance analysis capabilities (Code Quality, verified) - [doc-generator](https://sigistry.com/plugin/doc-generator): Intelligent documentation automation plugin for generating, maintaining, and syncing code documentation across your entire codebase (Docs & Onboarding, verified) - [legacy-analyzer](https://sigistry.com/plugin/legacy-analyzer): Extract and understand business logic from legacy codebases without documentation or handover. Perfect for inherited projects and undocumented systems. (Code Quality, verified) - [test-generator](https://sigistry.com/plugin/test-generator): Comprehensive test generation and analysis plugin that automates test creation, identifies coverage gaps, and improves test quality across your entire codebase (Code Quality, verified) - [data-converter](https://sigistry.com/plugin/data-converter): Powerful data transformation and processing plugin for converting, validating, and manipulating data across various formats (Data & APIs, verified) - [code-tutor](https://sigistry.com/plugin/code-tutor): AI-powered code learning and mentoring system with interactive teaching, code explanations, practice exercises, and educational code reviews (Docs & Onboarding, verified) - [seo-optimizer](https://sigistry.com/plugin/seo-optimizer): Comprehensive SEO plugin for auditing, optimizing, and reviewing website content, now with AI discoverability: llms.txt generation and validation, AI-crawler access, and answer-engine readiness for ChatGPT, Claude, and Perplexity (Web & SEO, verified) - [responsive-design-kit](https://sigistry.com/plugin/responsive-design-kit): Audit and fix a website's mobile responsiveness from source: find fixed-width layouts, horizontal-overflow risks, viewport and touch-target problems, then apply risk-scored fixes as reviewable diffs without breaking your desktop layout (Web & SEO, verified) - [plugin-benchmarker](https://sigistry.com/plugin/plugin-benchmarker): Benchmark Claude Code plugins by validating structure, reviewing skill quality, and comparing with-skill vs without-skill performance with per-file KEEP/TRIM/DELETE recommendations (AI & MCP, verified) - [release-conductor](https://sigistry.com/plugin/release-conductor): Owns everything around the diff: craft Conventional Commits and PR descriptions, recommend the right semver bump by reasoning about behavioral breaking changes, assemble changelogs from messy history, and guide merge-conflict resolution, rebase planning, and git-history archaeology (DevOps & Git, verified) - [ci-incident-medic](https://sigistry.com/plugin/ci-incident-medic): Triages failing GitHub Actions runs, hardens Dockerfiles, pre-flights Kubernetes manifests before they reach the cluster, and drafts blameless postmortems from incident evidence (DevOps & Git, verified) - [sql-safety-net](https://sigistry.com/plugin/sql-safety-net): Static, no-database-connection guardrails for schema and query work: rewrites unsafe migrations into zero-downtime expand-contract steps, hunts ORM N+1 queries in your diff, interprets pasted EXPLAIN plans, and flags schema anti-patterns (Data & APIs, verified) - [a11y-i18n-remediator](https://sigistry.com/plugin/a11y-i18n-remediator): Goes past detecting accessibility and localization issues to fixing them: cross-element ARIA and keyboard-focus remediation, color-contrast rewrites, hardcoded-string extraction, ICU MessageFormat correctness, and RTL readiness (Code Quality, verified) - [api-contract-keeper](https://sigistry.com/plugin/api-contract-keeper): Keeps your API and its spec in sync: detects and fixes OpenAPI/GraphQL spec-vs-code drift, hardens endpoints with request validation, RFC 9457 error envelopes and idempotency, guards against breaking changes, and audits job-queue reliability (Data & APIs, verified) - [llm-app-hardener](https://sigistry.com/plugin/llm-app-hardener): A repo-native toolchain for LLM apps: scaffolds eval suites, red-teams for prompt injection, hardens structured-output reliability, and audits token cost, riding promptfoo/DeepEval/Pydantic rather than replacing them (AI & MCP, verified) - [codebase-navigator](https://sigistry.com/plugin/codebase-navigator): Gets an unfamiliar repo running locally by diagnosing and fixing broken setup, decodes opaque build systems, and does task-scoped change localization and end-to-end flow tracing, so you're productive on day one (Docs & Onboarding, verified) - [mcp-server-smith](https://sigistry.com/plugin/mcp-server-smith): Scaffold, audit, and harden MCP servers for the MCP 2026-07-28 spec: stateless Streamable HTTP core, OAuth 2.1 / OIDC authorization, versioned extensions, tool design, and a security review that catches confused-deputy, token-passthrough, and prompt-injection risks. (AI & MCP, verified) - [lila-perimenopause](https://sigistry.com/plugin/lila-perimenopause): Evidence-aware perimenopause and menopause guidance covering symptoms, stages, testing, treatment options, lifestyle approaches, supplements, and appointment preparation, with clear medical-safety boundaries. (Docs & Onboarding, verified) - [search-visibility-kit](https://sigistry.com/plugin/search-visibility-kit): Connect Claude to Google Search Console, GA4 and IndexNow with live data: guided credential setup, evidence-based SEO audits, sitemap health checks, and delta URL submissions. One service account, unlimited sites. (Web & SEO, verified) - [records](https://sigistry.com/plugin/records): Validate FHIR R4 resources, diagnose Implementation Guide projects, explain conformance issues, and generate reviewed CI quality gates. (Data & APIs, verified) - [ballast](https://sigistry.com/plugin/ballast): Builds up to a goal in a field you have no expertise in: splits it into the foundations that goal actually needs, mobilizes what you already hold, learns what is missing, and leaves every solved path behind for the next goal. Nothing is called done until a check passes. (AI & MCP, not verified) - [me-review](https://sigistry.com/plugin/me-review): Twelve structured monitoring and evaluation document reviews: logframes, theories of change, indicators, evaluation TORs, M&E plans, proposals, sampling plans, surveys, baseline reports, progress reports, data quality assessments, and evaluation reports. Each returns section-by-section PASS/PARTIAL/FAIL ratings, a summary verdict, and prioritized recommendations. (Docs & Onboarding, not verified) - [hermes-blind](https://sigistry.com/plugin/hermes-blind): Recover the original goal of a long Claude Code or Codex session with a local, inspectable recovery anchor. (AI & MCP, not verified) - [kit-ship-check](https://sigistry.com/plugin/kit-ship-check): Pre-commit gate: runs test, lint and type check and prints a PASS/FAIL table. A check that could not run counts as FAIL, not as a pass. (Code Quality, not verified) - [kit-explain-diff](https://sigistry.com/plugin/kit-explain-diff): Plain-English read of your git diff before you push, with the risky lines called out as file:line and the blast radius stated. (DevOps & Git, not verified) - [kit-storekit-check](https://sigistry.com/plugin/kit-storekit-check): Six offline StoreKit and Xcode pre-flight checks for iOS subscription apps: bundled .storekit file, distantFuture expiry, product ID drift, local-only intro offers, export compliance key, prices in metadata. (Code Quality, not verified) - [slop-check](https://sigistry.com/plugin/slop-check): Catch AI-slop writing tells and rewrite prose to a genuine human voice. Flags cliché clusters, promotional register, formulaic structure, and em-dash or emoji overuse, then suggests fixes. A craft tool for cleaner writing, not a detector-evader. (Docs & Onboarding, verified) - [flowforge-skill](https://sigistry.com/plugin/flowforge-skill): Generate professional draw.io diagrams from natural language: flowcharts, architecture diagrams, comparisons, and more. (Docs & Onboarding, verified) ## Workflows - [Full Testing Pipeline](https://sigistry.com/use-cases/testing-pipeline): Generate comprehensive test suites, audit code quality, and auto-generate documentation -all in one workflow. - [Codebase Onboarding](https://sigistry.com/use-cases/codebase-onboarding): Analyze legacy code, get interactive tutorials, and produce up-to-date docs for new team members. - [Legacy Modernization](https://sigistry.com/use-cases/legacy-modernization): Map business logic, audit issues, and generate safety-net tests before refactoring legacy systems. - [API Documentation Pipeline](https://sigistry.com/use-cases/api-documentation): Generate API docs, validate schemas, and create integration tests from your existing codebase. - [Data Migration Workflow](https://sigistry.com/use-cases/data-migration): Convert data formats, validate transformations, and test data integrity for reliable migrations. - [Code Quality Review](https://sigistry.com/use-cases/code-quality-review): Full security and performance audit, test gap analysis, and documentation sync in one workflow. - [Learning a New Codebase](https://sigistry.com/use-cases/learning-codebase): Interactive concept deep-dives, guided workflow tracing, and personalized reference docs for any codebase. - [Safe Ship Pipeline](https://sigistry.com/use-cases/safe-ship-pipeline): Make migrations safe, pre-flight your deploy, craft the commit and PR, and triage CI failures - all in one release flow. - [Zero-Downtime Schema Migration](https://sigistry.com/use-cases/zero-downtime-migration): Rewrite unsafe migrations, add the right indexes, hunt N+1 queries, and generate a test safety net before deploying schema changes. - [From Red CI to Resolved Incident](https://sigistry.com/use-cases/ci-red-to-resolved): Triage a failing pipeline, harden the workflow against recurrence, and draft a blameless postmortem from your evidence. - [Keep Your API and Spec in Sync](https://sigistry.com/use-cases/api-contract-sync): Reconcile spec-vs-code drift, harden your endpoints, and classify breaking changes before you ship a release. - [Accessible, Localized UI for the EAA](https://sigistry.com/use-cases/accessible-localized-ui): Audit and fix WCAG 2.2 accessibility issues, then extract and validate your UI strings for a new locale, all in one workflow. - [Harden an LLM Feature Before You Ship](https://sigistry.com/use-cases/harden-llm-app): Pin LLM behavior with tests, harden JSON output, and cut token cost before launch. - [Onboard onto an Unfamiliar Repo](https://sigistry.com/use-cases/onboard-unfamiliar-repo): Get an unfamiliar repo running, decode its build, find where your first change goes, and trace a user action end to end. - [SEO Audit & Fix Workflow](https://sigistry.com/use-cases/claude-seo-checker): Audit any HTML, React, or Next.js project for technical SEO issues and fix them automatically, before you deploy. ## Recent guides - [MCP Tasks and Elicitations Ship in Claude Code](https://sigistry.com/blog/mcp-tasks-shipped-claude-code): Claude Code v2.1.304 is the first major MCP Tasks client: long MCP jobs become durable background tasks, and servers can ask the user questions mid-job. - [One Open Method, Four Surfaces: What Verified by Sigistry Now Covers](https://sigistry.com/blog/one-method-four-surfaces-verified): A year ago a Claude Code extension meant a plugin. Now an agent pulls in plugins, portable skills, MCP servers, and MCP Apps that render their own UI, and each fails differently. Sigistry now runs one open, evidence-cited verification method across all four surfaces. Here is what each signal means and where it is honest about its own maturity. - [Skills, MCP, and A2A: The Three Layers of the Agent Stack Each Got a Standard in 2026](https://sigistry.com/blog/skills-mcp-a2a-three-layers-agent-stack): For two years the agent stack was improvised. In 2026 each of its three layers got a real standard: skills as portable SKILL.md instructions, MCP as the agent-to-tool protocol (now with the Apps and Tasks extensions), and A2A as the agent-to-agent protocol under the Linux Foundation. Here is how the layers fit, what is genuinely new this year, and the trust question each one opens. - [Publishing Your MCP Server: Namespaces and Claimed Listings](https://sigistry.com/blog/publish-and-claim-your-mcp-server-directories): You built an MCP server. Getting it discoverable and claimed across the directories takes three steps: publish to the official registry with a DNS-verified namespace, claim your listings for a verified badge, and publish a maintainer contact at /.well-known/security.txt. Here is the walkthrough, including the nginx gotcha that returns 403 for every well-known file. - [Listing Is Not Vouching: The Case for Grading MCP Servers, Not Just Counting Them](https://sigistry.com/blog/listing-is-not-vouching-grading-mcp-servers): There are thousands of MCP servers across public registries, and most directories list whatever submits. A row in a directory means a server exists, not that anyone checked it. Here is why counting is the wrong metric, what the 2026-07-28 spec quietly broke, and how a graded, evidence-cited scorecard differs from a logo on a card. - [MCP Apps Put a UI Inside the Agent. The Sandbox Is the Floor, Not the Ceiling.](https://sigistry.com/blog/mcp-apps-sandbox-is-the-floor-not-the-ceiling): MCP Apps (SEP-1865) is the first official MCP extension: a tool can now return an interactive HTML interface the host renders in a sandboxed iframe. The sandbox is real, but it does not stop your own code from leaking secrets or rendering tool output into an XSS sink. Here is the security surface the sandbox does not cover, and a free checker for it. - [The Em Dash Was Never the Tell. Here Is What Actually Makes Writing Read Like AI.](https://sigistry.com/blog/ai-slop-the-one-rule-that-matters): The internet decided the em dash means a robot wrote it, so people started deleting every one. That is the wrong lesson. No single feature proves text is AI-written, and a linter built on single features flags good writing and flattens voice. slop-check, our new plugin, judges by cluster and register instead, and it is a craft tool, not a detector-evader. - [We Built an AI-Discoverability Audit. Then We Pointed It at Our Own Site.](https://sigistry.com/blog/ai-discoverability-audit-own-site): seo-optimizer 1.1.0 added an llms.txt and AI-discoverability audit. The honest test of a tool is running it on yourself, so we ran it against sigistry.com. Here is the before and after across the three things that decide whether ChatGPT, Claude, and Perplexity can read your site, plus the one robots.txt line that had quietly been breaking Google. - [Agents Query Our Catalog Over MCP. Now Everything Else Can, Over REST.](https://sigistry.com/blog/programmable-catalog-rest-api-openapi): The verified catalog already spoke MCP, which is perfect for agents and invisible to everything else. Now the same data is a public REST API described by an OpenAPI 3.1 spec, so custom GPTs, code generators, CI jobs, and dashboards can read verified plugins, portable skills, and MCP scorecards without an agent in the loop. One dataset, three surfaces, no auth. - [Make Your Site Mobile-Friendly Without Breaking Desktop](https://sigistry.com/blog/responsive-design-kit-mobile-audit-without-breaking-desktop): The scary part of going responsive is not finding the problems, it is fixing them without breaking the desktop layout that already works. responsive-design-kit audits your site's mobile responsiveness from source and scores every fix by its blast radius, so the safe changes apply automatically and the risky ones wait for your yes. ## Optional - [Full catalog with per-plugin detail](https://sigistry.com/llms-full.txt) - [RSS feed](https://sigistry.com/feed.xml) - [Sitemap](https://sigistry.com/sitemap.xml) - [Submit a plugin](https://github.com/sigistry/marketplace/blob/main/CONTRIBUTING.md)