miki/pluginproof
Watch
1
0
Fork
You've already forked pluginproof
 0
Code Issues Pull requests Releases 4 Packages Activity Actions
Read-only cross-harness validator for Codex and Claude Code plugin packages. https://automa-tan.codeberg.page/pluginproof/
5 commits 2 branches 4 tags 141 KiB
  • JavaScript 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nekoautomata Miki 9321c1ba5e Add private PluginProof report files 
Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-18 08:11:56 +00:00
.agents/plugins Release PluginProof 0.1.0 2026-07-15 12:47:03 +00:00
.claude-plugin Add private PluginProof report files 2026-07-18 08:11:56 +00:00
.codex-plugin Add private PluginProof report files 2026-07-18 08:11:56 +00:00
bin Release PluginProof 0.1.0 2026-07-15 12:47:03 +00:00
skills/prove-agent-plugin Add private PluginProof report files 2026-07-18 08:11:56 +00:00
tests Add private PluginProof report files 2026-07-18 08:11:56 +00:00
.gitignore Release PluginProof 0.1.0 2026-07-15 12:47:03 +00:00
CHANGELOG.md Add private PluginProof report files 2026-07-18 08:11:56 +00:00
LICENSE Release PluginProof 0.1.0 2026-07-15 12:47:03 +00:00
package.json Add private PluginProof report files 2026-07-18 08:11:56 +00:00
PRIVACY.md Add private PluginProof report files 2026-07-18 08:11:56 +00:00
README.md Add private PluginProof report files 2026-07-18 08:11:56 +00:00
SECURITY.md Add private PluginProof report files 2026-07-18 08:11:56 +00:00
TERMS.md Release PluginProof 0.1.0 2026-07-15 12:47:03 +00:00

README.md

PluginProof

PluginProof is a read-only, zero-dependency validator for Codex and Claude Code plugin packages. It checks the package on disk without loading the plugin or running its hooks, MCP servers, scripts, binaries, or lifecycle commands.

npx --yes --registry=https://codeberg.org/api/packages/automa-tan/npm/ [email protected] . --harness both

It checks:

  • Codex and Claude plugin manifests and compatible names and versions
  • component paths, missing targets, path escapes, and external symlinks
  • repository and personal marketplace entries
  • Agent Skill and Claude plugin-agent frontmatter
  • Claude channel references to bundled MCP servers
  • package.json name/version drift and publish-file coverage
  • common cross-harness packaging mismatches

Use --json for structured output. Use --check to exit nonzero when errors or warnings are present. Use --output FILE / -o FILE to create a private mode-0600 report without overwriting an existing path. The complete report is written before --check returns status 1.

Commands

pluginproof [plugin-root] [--harness auto|codex|claude|both] [--json] [--output FILE] [--check]

auto checks the harness manifests present in the package. both also reports when one harness manifest is missing.

Install as an addon

The repository is also a Codex and Claude Code plugin. Its prove-agent-plugin skill runs the same local validator and never executes the target plugin.

Privacy

PluginProof runs locally and performs no network requests. Reports include finding metadata and plugin-relative paths, not manifest contents or the absolute plugin-root path. Finding messages can still reveal package structure and declared component names, so review a report before sharing it.

License

MIT