HOL Plugins Explained: Vet AI Plugins Before You Install Them

You would not install a random browser extension without a glance at the reviews. Yet people paste plugin install commands into their coding agents every day with zero checks, and a plugin runs with your permissions. HOL runs a public directory of AI plugins that gives each one a trust score, shows the security signals behind it, and hands you the install command. Here is how to use it in five minutes, plus the free tool that covers what a score cannot.

One thing before we start. HOL also sells a product called Guard, and it advertises inside its own plugin directory. I will tell you where that matters as we go, and I will keep it separate from what the directory itself does.

What HOL Plugins Actually Is

HOL is the group behind hol.org. Its GitHub organization and X handle still say Hashgraph Online, and its home page describes work on open standards for AI agent infrastructure. The part that matters for you is the plugin directory.

It is a public catalog of plugins for AI coding agents and MCP clients: skills, MCP servers and apps. When I checked on October 14, 2026, the main page listed 800 plugins, and the Claude Code filter alone showed 506. The catalog also covers Codex, Cursor, Grok, Kimi Code, DeepSeek Harness, Antigravity CLI and OpenCode.

If you are new to the term, Anthropic describes a Claude Code plugin as a directory of skills, agents, hooks and MCP servers that loads as one unit. Hooks and MCP servers can run commands on your machine. That is exactly why a quick check before installing is worth your time.

How the Trust Score Works

Every listing carries a score out of 100. HOL says the default ranking follows that score, which blends identity, activity, verification and related signals. Open any plugin page and you get a factor breakdown. Here is what each factor is telling you.

Here is a real example. ThoughtProof MCP, a pre-action checker for agents, shows a trust score of 94 and a security score of 100. Look closer and its provenance sits at 70 and publisher quality at 75. Same plugin, very different stories depending on which number you read. That gap is the whole reason to open the breakdown instead of trusting the headline.

Vet and Install a Plugin in Five Minutes

1. Open the directory and pick your runtime. Go to the Claude Code page, or choose Codex, Cursor or another ecosystem from the tabs at the top.
2. Narrow the list. Use the quick filters: Owner verified, Skills, MCP, Apps or Remote MCP. Then sort by Trust instead of Featured. Featured placement can be paid for.
3. Open the plugin page and read the factor breakdown. Do not stop at the big number. Check provenance and plugin security first.
4. Click through to the source repo. Check the last commit date, read the README, and look for a SECURITY file. A plugin with a high score and a dead repo is a red flag.
5. Read what it can do. Look at the manifest on the plugin page. Does it add hooks? Does it start an MCP server? Does it need network access it has no reason to need?
6. Copy the install command from the plugin page. HOL generates commands per runtime, so use the one shown for yours rather than guessing.
7. Check the cost after install. Anthropic notes that an enabled plugin’s skill names and descriptions sit in context on every turn, which uses your usage allowance. Run /plugin in Claude Code to see what you have and disable what you do not use.

Anthropic also has a page on plugin security and trust worth reading once. For more Claude Code setup guides, browse the Claude Code archive, and if you want a free prompt library wired into your agent, see this walkthrough.

Add a Safety Net: HOL Guard

Here is the thing about a trust score. It tells you what a plugin looked like when it was scanned. It says nothing about what your agent decides to run at 2 a.m. That is the gap HOL Guard targets.

Guard runs on your computer and checks supported agent actions before they execute. On supported integrations it can allow, ask or block. For Claude Code, HOL’s coverage page lists blocked items such as reads of secret-bearing files and high-risk shell commands, and review prompts for package installs, new MCP declarations and suspicious downloads. The core is open source under Apache-2.0, and the free tier needs no account.

Setup on macOS or Linux:

1. Check you have Python 3.10 or newer. The command line install needs it. Windows support is marked experimental and HOL recommends WSL.
2. Read the installer before you run it. It is a curl to bash install, so open https://hol.org/guard/install.sh in your browser first. Yes, advice about vetting things applies here too.
3. Run the install command from the install page: set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --mode install --verify hol-guard init Prefer clicking? The same page offers a desktop app for macOS, Windows and Linux.
4. Connect Claude Code: hol-guard install claude-code
5. Verify it: hol-guard doctor hol-guard doctor claude-code You should see the daemon and intercept layer reported as running.
6. Test it. Ask your agent to run any shell command. Guard should show an approval prompt before it executes. If it does not, the setup is not working yet.

To remove it, run hol-guard daemon stop and then pipx uninstall hol-guard. Your history stays in a ~/.hol-guard folder until you delete it.

On cost: local protection is free. Guard Cloud is optional, with Solo listed at $4.99 and Pro at $15 a month for synced history, alerts and longer retention. I would start free and only upgrade if you work across several machines.

Steal This Prompt Before Any Install

When a plugin looks promising but you do not read code for fun, let your agent do the first pass. Clone the repo to a scratch folder, point Claude at it, and paste this:

Review this plugin repo before I install it. List every hook, MCP server, shell command, network call and file it reads or writes outside the project. Flag anything that looks unrelated to its stated purpose. Quote the file and line for each finding.

Ask for file and line references. That one line forces specifics and makes it easy for you to verify the answer yourself.

If You Publish Plugins

Listing is free. Connect GitHub on the submit page, pick your public repo, and HOL opens a pull request on its awesome-ai-plugins list, which it ingests into the catalog. You can also run HOL’s open scanner on your own repo before release:

pipx install plugin-scanner
plugin-scanner verify .

HOL also publishes a GitHub Action that can fail a pull request below a score you set. Its example uses a minimum of 80. Paid sponsored slots start at $200 a month, and HOL states they do not change organic rank.

Honest Limitations

• A scan is not a safety guarantee. HOL says so itself. The current public scanner is a fallback static scan, not a live exploit test. A score of 94 means “looks fine on paper.”
• HOL grades its own work. It publishes a plugin security dataset and states plainly that it is not independent validation.
• There is a commercial angle. Guard is HOL’s product, and a Guard ad appears in the directory feed. Sponsored slots exist. Treat the directory as a comparison tool, not a referee.
• Numbers drift. The live catalog showed 800 plugins, while the published dataset snapshot covers 205 scored plugins. Counts and scores change often, so check the page itself.
• Guard has limits. It is not a complete prompt injection fix, it cannot inspect encrypted traffic before your agent decrypts it, and coverage depends on the agent and event type.
• Not every score comes with a verified publisher. ThoughtProof shows owner verification through GitHub while its page lists publisher verification as “No.” Read the details.

Quick Reference

Is It Worth Five Minutes?

Yes, with the right expectations. Use the directory to shortlist and to spot weak provenance. Use your own judgment on the repo. Add Guard if your agent runs shell commands or touches files with secrets in them, which is most agents. None of this makes a plugin safe. It makes your guess a lot better, and that is the realistic goal.

Know someone who installs plugins by copy and paste? Send them this post, then tell me which plugin you checked first and what score it got.

Sources

1. HOL plugin directory
2. Best Claude plugins (HOL Registry)
3. ThoughtProof MCP listing (HOL Registry)
4. HOL Guard overview
5. Install HOL Guard
6. HOL Guard for Claude Code
7. HOL Guard pricing
8. Submit a plugin (HOL)
9. HOL Plugin Security dataset (Hugging Face)
10. Claude Code plugins overview (Anthropic)
11. Plugin security and trust (Anthropic)