What to check before you install a Codex plugin
Direct answer
Before you install a Codex plugin, check which marketplace serves it, whether OpenAI’s curated marketplace or the community Codex list carries it, whether HOL recorded a release event for the version you are about to get, whether an advisory names it, and which MCP servers, skills and commands it adds.
Five checks
Check 1
Know which marketplace serves it
Codex ships with OpenAI’s curated marketplace and can add others from git repositories. Confirm the listing’s repository is the one the marketplace entry points at.
Check 2
Check whether it is listed
HOL reads OpenAI’s curated marketplace and the community Codex plugin list HOL maintains on GitHub. Each listing shows whether either carries it today and since when.
Check 3
Check the release record for the version
HOL records the commit it scanned for each version and notes when a version is republished, withdrawn or its commit becomes unreachable.
Check 4
Read what it runs
Codex plugins can bundle MCP servers, skills and commands. The listing’s scan shows which of these it declares and what the scanner found in the source.
Check 5
Install through a reviewed path
HOL Guard installs a listing into Codex after its own checks and records what it installed.
hol-guard plugin install owner/plugin
What HOL recorded for Codex
Counted when this page loaded, from HOL’s directory reads and release ledger. Each listing page shows the same records for one plugin.
Directories HOL reads for Codex
Release records
In the last 30 days HOL recorded builds for 247 plugins on the channels Codex installs from, and noted 0 integrity events.
Advisories
HOL has published no advisory for Codex plugins. Advisories need two public sources.
Limitations
- A directory listing, a matching build and a clean scan are records of what HOL saw. None of them says a plugin is harmless.
- HOL compares what each channel served; it does not say which channel is right or why a build changed.
- Advisories appear only when two public sources describe the incident.
For publishers
Every record on this page is public and free. Listing owners can subscribe to a webhook for integrity events on their listing; with HOL Blue or Gold it arrives within minutes instead of in a weekly digest, so owners hear about a change before their users do. What a publisher pays never changes what HOL records or shows here.