HOL Registry
How to compare AI plugins before you install
Maker: HOL · Updated 2026-10-21
Direct answer
Compare plugins on evidence, not adjectives. In HOL Registry every listing carries the same fields: HOL trust score (identity, activity, verification, and related signals), a scanner-backed security score, owner verification, what is inside (skills, MCP servers, apps), GitHub stars and recency, and the agents it supports. Open the collection for your agent to see its highest-trust listings compared in one table, then copy the install command from the card. A scan is not a safety guarantee.
Limitations
- Scores compare publishability and published evidence; they are not hands-on product tests.
- A scan is not a safety guarantee. HOL does not certify every plugin forever.
- GitHub stars measure attention, not quality or safety.
- Featured and sponsored placements are labeled and do not change organic rank.
The six signals on every listing
| Signal | What it tells you | Watch out |
|---|---|---|
| HOL trust score | How well evidenced the listing is: publisher identity, activity, verification, and related signals combined into one comparable number. | A high score is better evidence, not a safety certification. |
| Security score | Scanner-backed signals on the indexed code and manifest, including secret scanning and provenance checks where available. | The public scanner is static/catalog scoring, not a live exploit test. |
| Owner verified | The publisher proved control of the repository behind the listing, so the listing and the code are connected. | Verification proves ownership, not that the code is benign. |
| What’s inside | Counts of skills, MCP servers, and apps, so you know whether you are installing instructions, a live tool connection, an interface, or all three. | More contents is not better; match the kind to the job. |
| GitHub stars & recency | Community attention and whether the project is actively maintained (recent pushes beat stale releases). | Stars measure attention. A popular plugin still needs a security read. |
| Supported agents | Which runtimes the plugin declares — Claude Code, Codex, Cursor, OpenCode, Antigravity CLI, Grok, Kimi Code, DeepSeek Harness, MCP — and therefore which install command applies. | Declared support is the publisher’s claim; the plugin page carries the per-runtime guide. |
Compare the best for your agent
Each collection page opens with its highest-trust listings in one comparison table — trust, security, what’s inside, stars, and updated — ranked by trust score. Pick yours:
Comparing plugins questions
How do I compare two AI plugins?
Put the same fields side by side: trust score, security score, owner verification, what is inside, GitHub activity, and supported agents. HOL Registry shows those fields on every card and in the comparison table on each agent’s collection page, so two listings can be compared without opening both. Then open the stronger candidate for its full install guide and security detail.
What is a good trust score for a plugin?
There is no universal pass mark. Trust score combines identity, activity, verification, and related signals, so compare listings within the same job: the higher score is the better-evidenced option. Pair it with the security score and owner verification, and remember a scan is not a safety guarantee.
Should I pick the plugin with the most GitHub stars?
Not on stars alone. Stars show attention; trust and security scores show evidence. A maintained, owner-verified plugin with fewer stars can be the safer install than a popular stale one. Use stars as a tiebreaker after trust, security, and fit for your agent.
Do paid placements change the ranking?
Only the default Recommended order pins paid featured placements, and they are labeled Sponsored. Best match search results and the Trust, Security and Recently updated sorts never move for payment, and paid membership marks do not change any order. Sort by Trust to see scanner order alone, and use the comparison tables on collection pages, which rank by trust score.
Put it into practice
Open the catalog, sort by Trust, and read two or three cards side by side — the fields line up because every listing carries the same signals. A scan is not a safety guarantee.