Published guides for HOL Guard and plugin-scanner, pulled from the AI Plugin Scanner library docs so the product page stays aligned with the canonical documentation source.
Published guides for HOL Guard and plugin-scanner, pulled from the AI Plugin Scanner library docs so the product page stays aligned with the canonical documentation source.
If your repository uses a Codex marketplace root like .agents/plugins/marketplace.json, keep plugin_dir: ".". The scanner will discover local ./plugins/... entries automatically, scan each local plugin manifest, and skip remote marketplace entries instead of treating the repository root as one plugin.
Codex packaging alignment
The scanner follows the current Codex packaging conventions more closely:
local manifest paths should use ./ prefixes
.agents/plugins/marketplace.json is the preferred marketplace manifest location
root marketplace.json is still supported in compatibility mode
interface metadata no longer requires an undocumented type field
verify performs an MCP initialize handshake before probing declared capabilities
submit remains intentionally single-plugin so the emitted artifact always points at one concrete plugin package.
Useful discovery commands
plugin-scanner --list-ecosystems
plugin-scanner . --ecosystem auto
plugin-scanner . --ecosystem claude
Next guides
Ecosystems and repository mode
plugin-scanner can work against one plugin package or auto-detect multiple supported ecosystems inside a repository root.
If your repository uses a Codex marketplace root like .agents/plugins/marketplace.json, keep plugin_dir: ".". The scanner will discover local ./plugins/... entries automatically, scan each local plugin manifest, and skip remote marketplace entries instead of treating the repository root as one plugin.
Codex packaging alignment
The scanner follows the current Codex packaging conventions more closely:
local manifest paths should use ./ prefixes
.agents/plugins/marketplace.json is the preferred marketplace manifest location
root marketplace.json is still supported in compatibility mode
interface metadata no longer requires an undocumented type field
verify performs an MCP initialize handshake before probing declared capabilities
submit remains intentionally single-plugin so the emitted artifact always points at one concrete plugin package.
Useful discovery commands
plugin-scanner --list-ecosystems
plugin-scanner . --ecosystem auto
plugin-scanner . --ecosystem claude