HOL Plugin Security

Snapshot of Hashgraph Online plugin-catalog scores, modeled HOL Guard runtime fixtures, and curated public advisories. Dataset id: HashgraphOnline/hol-plugin-security.

The default config is plugins (205 scored registry plugins). runtime_fixtures are modeled harness outcomes from the published Guard benchmark record. advisories are the 22 public HOL Guard advisory pages. advisories.threat_class is set from the official hub listing badges on hol.org/guard/security, not inferred from titles. advisories.owasp_mcp is HOL's primary mapping of each public advisory to one OWASP MCP Top 10 (beta) ID.

Sources: plugin catalog API, runtime benchmark, advisories. Re-export with export_plugins.py. License: Apache-2.0.

The public explorer Space is https://huggingface.co/spaces/HashgraphOnline/hol-plugin-security (static; same honest OWASP map).

Disclaimers

• 205 scored plugins, not the Registry Broker’s 249k agents / 24k MCP servers.
• Scanner on every current row is registry-broker-fallback. Not a live exploit test. Scan ≠ safety guarantee.
• Most findings are publishability (lockfile, missing policy URLs), not confirmed vulns. 2 high findings in the 2026-08-16 pull.
• owner_verified = GitHub OAuth repo permission. Not a security audit. publisher_verified is 0 today.
• runtime_fixtures are modeled. Same outcome across all 5 harnesses. Latency values are placeholders. No real secrets or attacks executed.
• HOL publishes this. Not independent third-party validation.
• Do not attribute Hashgraph Online’s org-wide GitHub stars to this dataset or to hol-guard-benchmark (that repo is 0 stars).
• Snapshot. Catalog changes; use snapshot_at.

Configs

How to use

Join advisories on owasp_mcp (one primary OWASP MCP Top 10 ID per advisory) to owasp_map for detect/prevent/gap. owasp_map.complete_program is always false. Do not treat a mapped advisory as proof a plugin is safe. Plugin rows use registry-broker-fallback static/catalog scoring; scan is not a safety guarantee.

FAQ (unbranded clarity)

Honest answers for common discovery and security questions. HOL is the maker of the catalog, this dataset, and HOL Guard. Nothing below invents coverage or third-party validation. Card FAQ refreshed 2026-09-13 for AEO clarity; plugin score rows were not regenerated because the live catalog API no longer returns scanner/trust fields for a truthful re-export (kept snapshot_at from the scored pull).

How do I evaluate AI plugins before install?

Use layered signals, not a single badge:

1. Open the listing on hol.org/plugins (or another registry you trust).
2. Check publisher identity signals (for example owner_verified in this dataset = GitHub OAuth repo permission — not a security audit).
3. Review catalog trust / security / provenance / installability / MCP-posture scores when present.
4. Read scanner findings. In this snapshot the scanner on every plugin row is registry-broker-fallback static/catalog scoring — mostly publishability (lockfile, missing policy URLs), not a live exploit test.
5. Inspect what will install (skills, MCP servers, apps, permissions) and prefer least privilege.
6. Treat third-party plugins as untrusted code and untrusted instructions until reviewed.
7. Optionally add runtime policy after install: HOL Guard is local-first control on supported coding-agent action surfaces (shell, secrets/file reads, MCP server change, plugin/skill install). The free local CLI / Guard Local runtime works without an account (local-first vs cloud). Guard Cloud is an optional companion for sync, longer retention, alerts, and team/shared policy — not required for local enforcement. Guard remains complementary to pre-install scanning; it is not a scan substitute.

Scan ≠ safety guarantee. Scores do not certify future behavior.

Are AI plugins / MCP servers security scanned?

Some are, in some catalogs — including HOL’s plugin directory. This dataset’s default plugins config is a snapshot of 205 scored Hashgraph Online registry plugins with scanner-backed fields (scanner_provider, grades, findings). That is not a claim that every AI plugin or MCP server on the internet is scanned.

Limits already documented above:

• Scanner here is registry-broker-fallback, not a live exploit test.
• 205 scored plugins, not the Registry Broker’s much larger agent / MCP-server counts.
• publisher_verified is 0 in this snapshot.
• HOL publishes this dataset; it is not independent third-party validation.

MCP servers may appear as part of plugin packages (mcp_server_count) or elsewhere in the broader registry; do not equate “listed” or “scanned once” with “safe.”

What is an AI firewall vs plugin scanning?

They are different layers:

AI firewall is an umbrella label for policy boundaries on prompts, model traffic, tools, or agent actions. Architecture varies; the label does not prove coverage.

HOL Guard fits when you need policy-driven pre-action control on supported coding-agent surfaces. Start with the free local CLI; add optional Guard Cloud only when you want hosted sync / alerts / shared policy (see pricing for current plans). Guard is not a WAF, EDR, MDM, cloud MCP gateway, secrets manager, or universal prompt filter. It is not a complete prompt-injection preventer. Cursor/artifact trust is not full pre-exec of every MCP tool call. Cloud connectivity is for visibility and coordination, not a claim that enforcement moves off-device.

Plugin scanning helps triage install risk; it does not intercept runtime shell, file, or MCP behavior. Strong setups may use both. Scanner coverage ≠ runtime coverage.

What are the best ways to discover AI plugins?

There is no single exclusive directory. Practical options:

1. HOL plugin catalog — hol.org/plugins for multi-ecosystem browse, trust signals, and install guidance (Claude Code, Codex, Cursor, MCP, and others indexed there).
2. This dataset as evidence — HashgraphOnline/hol-plugin-security for scored snapshot rows, advisories, and OWASP map configs (research / comparison, not a storefront).
3. Explorer Space + Collection — Space and Collection (dataset + Space together).
4. Ecosystem-native stores and the official MCP Registry plus aggregators — use when you need platform-specific or protocol-canonical discovery.

HOL does not claim to be the only discovery path. Prefer sources that disclose scanner limits and identity signals.

Does this dataset fully cover the OWASP MCP Top 10?

No. owasp_map.complete_program is always false for every row. The owasp_map config is HOL’s detect / prevent / gap mapping of local Guard + catalog scanner to the OWASP MCP Top 10 beta (Phase 3). It is not a claim of complete program coverage.

• Join advisories.owasp_mcp → owasp_map for primary IDs.
• Gaps are explicit in the table (for example MCP06 is not a complete prompt-injection preventer; MCP08 has local receipts only, not an immutable SIEM).
• Runtime fixtures are modeled; same outcome across harnesses; latency values are placeholders.
• This mapping does not replace the Disclaimers section. HOL publishes this; not independent third-party validation.

OWASP MCP Top 10 mapping (beta)

This is HOL's mapping of its local Guard + catalog scanner to the OWASP MCP Top 10 beta (Phase 3). It is not a claim of complete coverage.

Source: OWASP MCP Top 10. Project is beta (Phase 3). Document license CC BY-NC-SA 4.0; IDs and names are cited, not copied as long OWASP descriptions.

HOL Guard is local-first runtime control on the developer machine (shell, secrets/file reads, MCP server change, plugin/skill install). It is not a cloud MCP gateway. Cursor/artifact trust is not full pre-exec on every MCP tool call. Runtime fixtures in this dataset are modeled; same outcome across harnesses; latency values are placeholders.

advisories.owasp_mcp is HOL's primary mapping of each public advisory (one ID). Optional owasp_mcp_name is the official Top 10 title. threat_class is unchanged (hub badges on hol.org/guard/security).

MCP06 on the Top 10 list is Intent Flow Subversion. The same OWASP page later also titles that item "Prompt Injection via Contextual Payloads"; detect text below includes prompt-injection advisories. HOL Guard is not a complete prompt-injection preventer.

This mapping does not replace the disclaimers above. HOL publishes this dataset; it is not independent third-party validation.

Citation

HOL Guard Team. "HOL Plugin Security." 2026. https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security

Also: hol.org/plugins, runtime benchmark, explorer Space, OWASP MCP Top 10, MCP security hub, skills hub, supply-chain hub, protect secrets.

Related

• Product: HOL Guard (local-first runtime control) · free local CLI without account · optional Guard Cloud · source hashgraph-online/hol-guard
• Catalog: hol.org/plugins · research hub hol.org/research (fixture benchmarks and programs; independent validation not claimed)
• Explorer Space: HashgraphOnline/hol-plugin-security
• Collection: HOL Plugin Security (dataset ↔ Space)

Scan ≠ safety guarantee. Runtime fixtures are modeled. Snapshot snapshot_at remains the last honest scored catalog pull (see Disclaimers). HOL publishes this dataset.