Best Antigravity Plugins in 2026

The best Antigravity plugins in 2026 are Harness Kit, Android Engineering Skills, XposedOrNot, SEO GSC Wizard, Cortex, Ponytail, Brooks Lint, mcp-server-kubernetes, Rootly and grip. All ten are in the HOL Plugins catalog with no high or critical scan finding, and all ten installed in Google's Antigravity CLI 1.5.6 when we ran agy plugin install on them. They are sorted by how much of each plugin was still working after the install, from plugins that arrived whole to ones where a key prompt or a hook got lost on the way.

That order matters because most Antigravity plugins were not built for Antigravity. Of the 212 HOL listings tagged for Antigravity CLI, the tool that replaced Gemini CLI, only 83 ship a plugin.json where Antigravity looks for one. The rest are Gemini CLI extensions or Claude Code plugins that agy converts when it installs them. The Best Antigravity plugins page on hol.org ranks every listing by Trust Score. This post covers what that ranking can't show: what Antigravity actually loads from each one.

TL;DR: best Antigravity plugins

Scores, labels, findings and star counts were read from the HOL catalog API on Nov 11, 2026. The number in brackets is HOL's security score. "What Antigravity loaded" is what agy plugin install and agy plugin list --json reported in a clean profile with Antigravity CLI 1.5.6, first from each repo at the commit HOL scanned and again from GitHub the same afternoon. Both runs gave the same counts.

How we picked these

We cloned all 212 Antigravity CLI listings at the commit HOL scanned. Two repos could not be fetched. On the other 210 we ran agy plugin validate, which checks a plugin the way Antigravity's loader reads it, then installed each one into an empty profile and ran the validator again on what got installed.

• 83 of the 210 have a plugin.json in a place Antigravity reads. The validator recognized 82 more as Claude Code plugins and 30 as Gemini CLI extensions that the installer converts. It recognized nothing in the other 15.
• 194 installed. Of the 16 that failed, 13 stopped with "could not detect plugin structure."
• 24 installed with hooks, the small programs that run on agent events. In 12 of them the validator rejected the converted hooks.json, so those hooks never run.
• 16 Gemini CLI extensions ask for an API key or another setting in their gemini-extension.json. None of the 16 kept that prompt after the move. All 16 installed switched on, with nowhere to enter the value.
• 64 ship a GEMINI.md and 67 an AGENTS.md that the plugin loader ignores, because inside a plugin Antigravity reads rules only from rules/.
• 29 have a skill longer than 24,000 bytes. Antigravity loads only the first 24,000.

To make the list, a plugin had to install with agy, have no high or critical HOL finding, and do a job no other pick does. We skipped plugins already picked in our Codex, Claude Code, Cursor, Kimi and Grok roundups, and HOL's own Guard plugin. Where a pick loses something in the move, the entry says what and how to get it back. A HOL label is evidence about packaging and supply chain, not a code review. The Trust Score page explains how labels are set.

What are Antigravity plugins?

Antigravity is Google's agentic coding product. It comes as a desktop app, a terminal tool called Antigravity CLI (the command is agy), an IDE, and extensions for VS Code, JetBrains and other editors. Antigravity CLI replaced Gemini CLI, and Google's migration guide says Gemini CLI extensions are now called plugins.

According to Google's plugin docs, a plugin is one versioned folder that can bundle five things: skills, MCP servers, custom agents and subagents, rules, and lifecycle hooks. The manifest is plugin.json at the plugin root, or .antigravity-plugin/plugin.json in repos that also ship Claude Code or Cursor manifests. Skills go in skills/, MCP servers in mcp_config.json, hooks in hooks.json at the root, and rules in rules/. A plugin installed in the app also shows up in the CLI.

How to install an Antigravity plugin

In the Antigravity app

Open Customizations in the left sidebar, below Automations, and pick the Marketplace tab. Click + on a plugin card to install it, or open the card to see its skills, MCP servers, agents and rules first and then click Add. If a plugin needs an API key, switching it on under Installed opens a form for it. Plugins that use OAuth open your browser to sign in.

From the terminal

Google publishes the agy installer on its getting started page. Once it's installed, these are the plugin commands from Google's docs:

agy plugin install firebase
agy plugin install https://github.com/owner/repo
agy plugin install ./path/to/plugin
agy plugin import gemini
agy plugin list
agy plugin validate --strict ./my-plugin

A bare name installs from Google's official marketplace, antigravity-plugins-official, which needs you signed in. Installing from a GitHub URL or a folder did not ask us to sign in. agy plugin import gemini converts everything in ~/.gemini/extensions, and agy plugin import claude does the same for Claude Code plugins. Inside a session, /plugin opens the plugin manager with Installed and Discover tabs. Space switches a plugin on or off, and Ctrl+S installs or uninstalls it. Installed plugins land in ~/.gemini/config/plugins/.

Antigravity skills vs plugins

Google's skills docs say Antigravity reads only each skill's name and description at the start of a session and opens the full file when your request matches it. Gemini CLI projects that kept skills in .gemini/skills/ have to move them to .agents/skills/.

The 10 best Antigravity plugins

1. Harness Kit: plan the feature before the agent writes code

Harness Kit runs a fixed loop. One skill writes architecture notes for your repo, another turns a feature request into a domain model and test scenarios, and a third makes the agent write a failing test before any production code. It also brings ten agents, among them a CTO, a software architect, backend and frontend developers and a QA developer, plus a review skill the README calls the grumpy tech lead.

• Trust Score 88, security 96 (Safe), no findings above info level
• 30 GitHub stars; not owner verified on HOL; runs the HOL scanner in its own CI
• What Antigravity loaded: 13 skills and 10 agents, from a native plugin.json. Nothing was dropped except a GEMINI.md that plugins don't read.

Install, from the README:

agy plugin install https://github.com/romabeckman/harness-kit

Example commands from the README, without the Claude Code harness-kit: prefix, since Antigravity calls plugin skills by name:

/project-memory
/scope-refinement

Pros: the only pick that loads agents, and every piece of it loaded. You can start a session as one of its agents with agy --agent cto, or switch with /agents.

Cons: the README files the agy command under a "Gemini CLI" heading, which is easy to skip past. The validator warned that the agents field in its manifest is ignored, though the agents still load from the agents/ folder. With 30 stars, few people have tried it yet.

HOL listing · GitHub

2. Android Engineering Skills: one way to structure every Android feature

Three skills that teach the agent one set of opinions about Android apps: package by feature, keep the domain layer free of Android code, expose one UI state per screen, and write tests in a fixed order with JUnit 5 and Turbine. The README says it is meant to sit next to Google's own Android skills, which handle one-off jobs like migrating XML layouts to Compose.

• Trust Score 93, security 98 (Safe), one info-level finding
• 40 GitHub stars; owner verified on HOL; runs the HOL scanner in its own CI
• What Antigravity loaded: all 3 skills, converted from its Claude Code plugin

Install. The README has no Antigravity section, but this is the command we ran:

agy plugin install https://github.com/lennonpetrick/android-engineering-skills

The README's manual option copies the three folders into .agents/skills/, which is Antigravity's default project skills folder. Example prompts from the README:

Add a transactions screen that loads a list from the API and supports pull to refresh.
Write unit tests for TransactionsViewModel.

Pros: the highest Trust Score of the ten, nothing to configure, and nothing that runs on its own.

Cons: the rules are strict, and the README tells you to check that they match how your team works. It assumes Hilt, Retrofit, JUnit 5 and Turbine. If you use Koin or XML views you'll have to fork it.

HOL listing · GitHub

3. XposedOrNot: check whether an email was in a data breach

XposedOrNot runs a public breach index, and this plugin connects the agent to it. Its six tools check an email against known breaches, show an email's breach history and risk score, list the breach catalog, sum up exposure for a domain, and show the newest breaches. The README says no key or account is needed, every tool is read-only, and none of them returns passwords.

• Trust Score 79, security 81 (Review), 0 high findings
• Findings behind the label: two medium (no lockfile for requirements.txt) and two low (no Dependabot config), all about the API server code in the same repo
• 102 GitHub stars; owner verified on HOL
• What Antigravity loaded: 1 hosted MCP server at api.xposedornot.com/mcp. The installer renamed the Gemini httpUrl key to the serverUrl key Antigravity expects.

Install. The repo's install guide gives the Gemini CLI command, gemini extensions install https://github.com/XposedOrNot/XposedOrNot-API. For Antigravity we ran:

agy plugin install https://github.com/XposedOrNot/XposedOrNot-API

There are no example prompts in the README. It names the tools instead, such as check_email_breaches and domain_breach_summary, so ask in plain words for what one of those does.

Pros: works the moment it's installed, with nothing to sign up for, and you don't need to write code to use it.

Cons: the server limits requests per IP address. Checking breaches across your own verified domains goes through a separate API key flow in XposedOrNot's dashboard, not this plugin. It brings no skills, so there's no slash command.

HOL listing · GitHub

4. SEO GSC Wizard: Search Console reports without the spreadsheet

This plugin connects the agent to the GSC Wizard service, which pulls data from Google Search Console, GA4, Bing Webmaster, Merchant Center and Yandex, and adds 34 skills for jobs like dating a traffic drop, finding pages that compete for the same keyword, and writing a weekly report. The README says the server does the statistics itself and every skill must name the tool and date range behind each number it reports.

• Trust Score 80, security 90 (Safe), three low findings (no SECURITY.md)
• 0 GitHub stars per HOL's fetch; owner verified on HOL
• What Antigravity loaded: all 34 skills and 1 hosted MCP server. agy printed a note that if the server needs you to sign in, you do it from /plugin.

Install. The README gives gemini extensions install https://github.com/jbobbink/seo-gsc-wizard for Gemini CLI. For Antigravity we ran:

agy plugin install https://github.com/jbobbink/seo-gsc-wizard

Example prompts from the README. Outside Claude Code each skill goes by its folder name:

why is my site losing traffic?
/weekly-report

Pros: all 34 skills and the server came through the move. Sign-in is OAuth in the browser, so no key sits in a config file.

Cons: you need a GSC Wizard account with a paid plan or a free trial. The repo has no stars yet, and HOL flags no SECURITY.md.

HOL listing · GitHub

5. Cortex: memory that outlasts the session

Cortex stores decisions, bug fixes and project context in a local SQLite file by default, and brings them back when a similar problem comes up. The README says it runs on your machine, needs no account or API key, and the memory file is yours to delete. It has 13 skills for storing, searching and curating memories, plus a project wiki.

• Trust Score 81, security 86 (Review), 0 high findings
• Findings behind the label: three medium (no lockfile next to pyproject.toml) and three low (no Dependabot config)
• 76 GitHub stars; owner verified on HOL
• What Antigravity loaded: 13 skills and 1 local MCP server, started with uvx --from hypermnesia-mcp[sqlite] hypermnesia-mcp

Install. The README's Gemini CLI command is gemini extensions install https://github.com/cdeust/Cortex. For Antigravity we ran:

agy plugin install https://github.com/cdeust/Cortex

Example prompts, taken from the trigger phrases in its cortex-remember and cortex-recall skills:

remember this
what did we decide about X

Pros: local by default, and the skill count matched HOL's exactly.

Cons: the README's automatic capture and recall comes from 11 lifecycle hooks in its Claude Code and Codex plugins. None of them came across to Antigravity, so you ask it to remember and recall yourself. You need uv installed, and the server command isn't pinned to a version.

HOL listing · GitHub

6. Ponytail: talk the agent out of writing more code than it needs

Ponytail is one prompt, as its README puts it: use what the codebase and the standard library already have, and leave out what nobody asked for. In Antigravity it also brings a review command that reads the code your change touches and not just the diff, a whole-repo audit ranked by what to fix first, and a ledger of the shortcuts you've marked for later.

• Trust Score 70, security 79 (Review), 0 high findings
• Findings behind the label: six medium (four missing lockfiles, two about a marketplace file's source path) and nine low (no SECURITY.md, no Dependabot)
• 188,813 GitHub stars, by far the most of any pick; not owner verified on HOL
• What Antigravity loaded: 6 skills. Its six commands were converted to the same six skills. HOL counts 12 because the repo carries two copies.

Install, from the repo's INSTALL.md:

agy plugin install https://github.com/DietrichGebert/ponytail

Example commands from the README:

/ponytail-review uncommitted
/ponytail-audit

Pros: the install notes match what we saw, down to the six skills, and say they were checked with Antigravity CLI 1.3.3.

Cons: the always-on ruleset lives in AGENTS.md, which a plugin can't load. INSTALL.md says to copy it into your project, where Antigravity reads it as a workspace rule. It has no hooks in Antigravity, so the level you pick doesn't stick between sessions. It has the lowest Trust Score of the ten.

HOL listing · GitHub

7. Brooks Lint: code review that cites its sources

Brooks Lint reviews code against six kinds of decay drawn from twelve software engineering books, and writes each finding as symptom, source, consequence and remedy. There are six modes: PR review, architecture audit with a dependency graph, tech debt, test quality, a quick health score, and a sweep that applies safe fixes.

• Trust Score 76, security 82 (Review), 0 high findings
• Findings behind the label: six medium (four missing lockfiles and two about its DeepSeek Harness package) and four low (no Dependabot)
• 1,572 GitHub stars; not owner verified on HOL
• What Antigravity loaded: 6 skills plus their shared reference folder. HOL counts 12 because it also counts three repo-maintenance skills, twice, that the plugin doesn't ship.

Install. The README lists Antigravity as a target for its npm installer, which copies the skills without the plugin wrapper:

npx brooks-lint install antigravity

As a plugin, agy plugin install https://github.com/hyhmrright/brooks-lint worked for us. Example prompts from the README:

review this PR
audit the architecture

Pros: six focused modes, each with its own slash command, such as /brooks-review and /brooks-debt.

Cons: agy said it installed a hook, but the validator rejected the converted hooks.json, so the loader skips the whole file. That hook copies short command files into ~/.claude/commands, which Antigravity doesn't use, and Antigravity already names the skills /brooks-review and so on, so you lose little. The repo's Antigravity guide uses the .agent/skills folder, which Google still reads for backward compatibility but no longer uses by default.

HOL listing · GitHub

8. mcp-server-kubernetes: run your cluster by asking

An MCP server that gives the agent kubectl and Helm: get, describe, logs, apply, scale, rollouts, port-forward, chart installs, node drains and pod cleanup. It also ships a troubleshooting prompt, k8s-diagnose, that takes a keyword for the pods you care about and an optional namespace. Secrets are masked in kubectl get secrets output.

• Trust Score 75, security 74 (Review), 0 high findings
• Findings behind the label: three medium (two missing lockfiles, one missing description in its Codex manifest) and two low (no Dependabot)
• 1,611 GitHub stars; owner verified on HOL
• What Antigravity loaded: 1 local MCP server, started with npx mcp-server-kubernetes, converted from its Gemini CLI extension

Install. The README covers Claude, VS Code and other clients but not Gemini or Antigravity. The repo ships a Gemini extension file, and this is what we ran:

agy plugin install https://github.com/Flux159/mcp-server-kubernetes

Example: the k8s-diagnose prompt with a pod keyword. The README has no other example prompts.

Pros: covers day-to-day cluster work and Helm in one server, with a non-destructive mode and secret masking built in.

Cons: the converted plugin starts the server with every tool on, including delete, node drains and running commands inside pods. The README's non-destructive mode needs the environment variable ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true, and the plugin doesn't set it. The server command isn't pinned to a version, so you get whatever npm has that day. Point it at a test cluster first.

HOL listing · GitHub

9. Rootly: work an incident without leaving the terminal

Rootly's server builds its tools from the Rootly API, so the agent can list and search incidents, find similar past ones, suggest fixes from how those were resolved, check who's on call, and create action items. The README explains how to expose only a chosen set of tools, and keeps tools that set up later automations separate from the ones that read.

• Trust Score 90, security 85 (Review), two low findings (no Dependabot)
• 45 GitHub stars; owner verified on HOL; runs the HOL scanner in its own CI
• What Antigravity loaded: 1 local MCP server, started with uvx --from rootly-mcp-server rootly-mcp-server

Install. The README's Gemini CLI command is gemini extensions install https://github.com/rootlyhq/rootly-mcp-server. For Antigravity we ran:

agy plugin install https://github.com/rootlyhq/rootly-mcp-server

Example prompt from the README:

Check the current on-call status

Pros: the second-highest Trust Score of the ten, from a vendor that publishes its own server, with clear notes on limiting what the agent can change.

Cons: in Gemini CLI the extension asks for your Rootly API token when you install it. In Antigravity that prompt is gone. The plugin installed switched on with no token, so the server starts without one. You have to supply ROOTLY_API_TOKEN yourself, for example in your own server entry in ~/.gemini/config/mcp_config.json, the global MCP file Google's migration guide names. The README also says Rootly's hosted SSE endpoint goes away after Nov 20, 2026. This plugin runs the local server, so that change doesn't affect it.

HOL listing · GitHub

10. grip: prove you understand the change before it ships

grip reads your diff and asks five questions about it: why it's built this way, where it fails, what a malicious caller could do, how you know it works. A model grades the answers out of 100, and below your team's pass mark the push waits. The README puts it this way: let AI write it, just be able to defend it.

• Trust Score 80, security 84 (Review), 0 high findings
• Findings behind the label: two medium (no lockfile next to pyproject.toml) and two low (no Dependabot)
• 219 GitHub stars; owner verified on HOL
• What Antigravity loaded: 4 skills and 1 PreToolUse hook on Antigravity's command tool, converted from its Claude Code plugin

Install the grip command first, from the README:

pipx install grip-hook

Then add the plugin. The README has no Antigravity section, so this is the command we ran:

agy plugin install https://github.com/guilyx/grip

Example commands from the repo's agent docs:

/grip
/grip --unpushed

Pros: you can try the whole flow offline with grip quiz --provider fake, and the git pre-push hook that grip init installs works whatever agent wrote the code.

Cons: the plugin's hook runs grip agent-hook claude-code. In grip's source, that reads the command from Claude Code's tool_input.command field, while Antigravity's hook docs put it in toolCall.args.CommandLine. So in Antigravity the hook never sees a git push and never blocks one. Rely on the git hook from grip init instead.

HOL listing · GitHub

What we left out

• PixelLab Pip installed cleanly, but its one skill is 60,033 bytes and Antigravity loads the first 24,000. Its own install guide also says not to install the repo root as an Antigravity CLI plugin.
• NotFair and Digital Marketing Pro were picked in earlier roundups. Remove AI Watermarks, with 6,348 stars, was left out because it strips provenance marks such as SynthID.
• Bookstack MCP, QVeris and GDS Agent lose their key or login prompts in the move, the same way Rootly does. We kept one example of that.
• Kernel, superlite, last30days-cn and nine others install hooks that the validator rejects.

Build your own Antigravity plugin

Start from Google's build plugins guide. Create a folder with a plugin.json that has at least a lowercase name, a version and a description, add a skill at skills/<name>/SKILL.md, then check and install it locally:

agy plugin validate --strict ./my-plugin
agy plugin install ./my-plugin
agy plugin list

The failures in our test point to six rules. Put hooks.json at the plugin root, in Antigravity's format, with relative paths, since hooks run from the plugin folder. Put MCP servers in mcp_config.json and use serverUrl for remote ones. Declare API keys as variables on the server so Antigravity asks for them and leaves the plugin off until they're filled in. Move always-on instructions into rules/. Keep each SKILL.md under 24,000 bytes and push detail into reference files. If the same repo ships a Claude Code manifest, put Antigravity's in .antigravity-plugin/plugin.json and keep the component folders at the root.

Before you publish, run the HOL Plugin Scanner on the repo, ideally in GitHub Actions, then submit the plugin to HOL Plugins for a public listing. Google takes submissions to the Antigravity Marketplace through an interest form linked from its marketplace docs. To review what a plugin does while it runs, HOL Guard checks agent actions before they happen.

What do people ask about Antigravity plugins?

What is the best Antigravity plugin in 2026?

It depends on the job. Harness Kit and Android Engineering Skills came through the install whole. XposedOrNot is the quickest to try because it needs no account. Android Engineering Skills has the highest Trust Score of the ten at 93. For every Antigravity listing ranked by Trust Score, see the Best Antigravity plugins page on hol.org.

Do Gemini CLI extensions work in Antigravity?

Most do, after conversion. agy plugin install converts a Gemini CLI extension when you point it at the repo, and agy plugin import gemini converts the ones already in ~/.gemini/extensions. In our test the conversion kept skills and MCP servers but dropped API key prompts and ignored GEMINI.md context files.

How do I install a plugin in Antigravity CLI?

Run agy plugin install with a marketplace name, a GitHub URL or a local folder, then agy plugin list to check it. Inside a session, type /plugin to open the plugin manager. Plugins you add in the Antigravity app also show up in the CLI.

Do Claude Code plugins work in Antigravity?

Many do. Antigravity's installer recognized 82 HOL listings as Claude Code plugins and converted them, and agy plugin import claude converts plugins already in ~/.claude/plugins. Hooks are the weak spot: in 12 of the 24 listings that brought hooks, the converted hooks file failed validation.

What is the difference between an Antigravity skill and a plugin?

A skill is a SKILL.md file with instructions for one kind of task. A plugin is a versioned bundle that can hold skills along with MCP servers, agents, rules and hooks, so it can give Antigravity live tools and run code on events as well as instructions.

Where does Antigravity store installed plugins?

In ~/.gemini/config/plugins/, one folder per plugin. A plugin folder placed in .agents/plugins/ in a project loads only in that project.

Are Antigravity plugins safe to install?

Not automatically. Hooks run shell commands on agent events and MCP servers start programs, and a plugin you install from GitHub isn't one of the curated plugins in Google's marketplace. Check the HOL listing's label and findings, run agy plugin validate on the folder, and look at what agy plugin list says it loaded.