Plugin developer guide

Approved plugin feeds: one policy, every format your team already deploys

By HOL · Reviewed by Michael Kantor on

Direct answer

Create a feed on the Approved plugin feeds page of your Guard Cloud workspace. List the HOL Plugins listings your team approves and the rules each must keep passing: trust score, attested releases, verified publisher, blocked capabilities and pinned versions. Each hour HOL checks them against public evidence and serves the approved set as Claude Code managed settings, managed-mcp.json, a Cursor team marketplace, an MCP Registry and JSON. Every response names its evidence snapshot.

Who this is for

Platform and security teams that decide which agent plugins and MCP servers developers may install.

Good fit

  • Rolling an approved MCP server list out to Claude Code through managed settings
  • Pointing GitHub Copilot, VS Code or Amp at an internal MCP registry
  • Keeping a Cursor team marketplace limited to approved plugins
  • Feeding approvals into your own tooling as JSON

Not a fit

  • Certifying that a plugin is safe; HOL reports evidence and applies your rules, it does not vouch for any plugin
  • Plugins that are not listed on HOL Plugins; a feed can only approve listings HOL can see

Steps

  1. 1.Create the feed and copy its token

    Open Approved plugin feeds from Plugins in your Guard Cloud workspace and choose New feed. Name it and add one HOL Plugins slug per line, such as owner/repo. HOL shows the feed token once and keeps only a hash of it, so store it as a secret straight away. Rotating the token stops the old one immediately.

  2. 2.Set the rules a listing must keep passing

    A listing reaches the feed only when it is on your list and passes every rule: minimum trust score (the score on the listing page; no score fails), attested releases only, verified publishers only, blocked capability classes (skills, apps, hooks, local MCP servers, remote MCP servers) and pinned versions. When HOL cannot tell whether a listing ships a blocked capability, the listing is rejected. Listings on the blocked list are written as disabled or denied in every format.

  3. 3.Check a plugin yourself before you approve it

    The feed uses the scan behind each listing. To look at a candidate locally first, run the same open-source scanner on its repository.

    pipx install plugin-scanner
git clone https://github.com/OWNER/REPO
plugin-scanner scan REPO --fail-on-severity high

  4. 4.Deploy to Claude Code

    claude-code-settings returns the extraKnownMarketplaces and enabledPlugins keys to merge into your managed settings, plus deniedMcpServers for blocked servers. With "Allow only what this feed approves" on, it also sets strictKnownMarketplaces, allowManagedMcpServersOnly and allowedMcpServers; try that on a few machines first. claude-code-mcp returns a managed-mcp.json whose environment values are ${NAME} references, never values.

    curl -fsS -H "Authorization: Bearer $HOL_FEED_TOKEN" https://hol.org/api/v1/guard/feeds/$FEED_ID/claude-code-settings
curl -fsS -H "Authorization: Bearer $HOL_FEED_TOKEN" https://hol.org/api/v1/guard/feeds/$FEED_ID/claude-code-mcp -o managed-mcp.json

  5. 5.Point GitHub Copilot, VS Code or Amp at the MCP registry

    These clients read an MCP registry without credentials, so turn on "Serve the MCP Registry format without a token" for the feed. Only the registry paths become public; every other format still needs the token. Set the registry URL to the feed address ending in /mcp-registry; the client adds /v0.1/servers. Entries follow the MCP Registry v0.1 server.json schema.

    curl -fsS https://hol.org/api/v1/guard/feeds/$FEED_ID/mcp-registry/v0.1/servers

  6. 6.Publish a Cursor team marketplace

    cursor-marketplace returns .cursor-plugin/marketplace.json listing each approved plugin that is listed for Cursor, by its GitHub repository. Commit it to your team marketplace repository on a schedule. Whether each plugin is Default Off, Default On or Required is set by your Cursor admins; the feed does not set it.

    curl -fsS -H "Authorization: Bearer $HOL_FEED_TOKEN" https://hol.org/api/v1/guard/feeds/$FEED_ID/cursor-marketplace -o .cursor-plugin/marketplace.json

  7. 7.Read only what changed and check where it came from

    Every response carries ETag, X-HOL-Feed-Snapshot (an hfs_ id over the policy and the evidence), X-HOL-Feed-Evaluated-At, X-HOL-Feed-Disclaimer and, when a listing could not be written in that format, X-HOL-Feed-Warnings. Send the ETag back in If-None-Match to get 304 when nothing changed. X-HOL-Feed-Signature is sha256= and the HMAC-SHA256 of the exact body bytes keyed by the feed token. The json format lists every decision with the check that passed or failed.

    curl -fsS -D headers.txt -H "Authorization: Bearer $HOL_FEED_TOKEN" https://hol.org/api/v1/guard/feeds/$FEED_ID/json -o feed.json
openssl dgst -sha256 -hmac "$HOL_FEED_TOKEN" feed.json | sed 's/^.*= /sha256=/'

Feed formats

Source or runtimeOutputCarriesDrops
Claude Code managed settings`claude-code-settings`Approved plugins and their marketplaces; blocked MCP servers; strict mode when chosenListings with no Claude Code plugin or marketplace on HOL
Claude Code MCP servers`claude-code-mcp` (`managed-mcp.json`)Approved MCP servers with commands, args, URLs and `${NAME}` referencesEnvironment values; servers whose config HOL could not read from the scanned commit
GitHub Copilot, VS Code, Amp`mcp-registry` (MCP Registry v0.1)Approved MCP servers as `server.json` entries with packages or remotesPlugins without an MCP server
Cursor team marketplace`cursor-marketplace`Approved plugins listed for Cursor, by GitHub repositoryPlugins not listed for Cursor; the Default Off, Default On or Required setting
Your own tooling`json`Every decision, every check and its reason, the policy, the snapshot id and the disclaimerNothing the evaluation recorded

Limitations

  • Every feed response carries this statement: "HOL reports public evidence: scan results, trust scores, attestations and publisher checks. It does not certify that a listing is safe. This workspace chose the policy and the listings; HOL applied that policy to the evidence it had when this snapshot was taken."
  • Feeds are checked every hour. If the registry cannot be read, the feed keeps serving its last snapshot and the workspace page says so.
  • Free, Solo and Pro workspaces can publish 3 feeds and 25 approved listings across them. Guard Team allows 25 feeds and 500 listings; Enterprise allows 100 and 2,000.
  • Paid plans and HOL Blue or Gold on a listing never change its trust score, its checks or whether it is approved.
  • Send the token in an Authorization header. HOL never accepts it in a URL.

Questions

Does HOL decide which plugins are approved?

No. Your workspace lists the plugins and sets the rules. HOL applies those rules to public evidence and writes the result in each format. A listing that is not on your list is never approved.

What happens when a plugin stops passing a rule?

The next hourly check removes it from every format at once, and the feed page shows what was added, removed or updated. Clients pick up the change on their next read.

What is the snapshot id for?

It identifies the exact policy and evidence behind a response. Record it with each deployment so you can show which evidence an approval rested on, and compare it between reads to see whether anything changed.

Why is the MCP registry format public when I turn it on?

GitHub Copilot, VS Code and Amp read MCP registries without credentials. Anyone with the feed address can then read the approved MCP servers, but not your policy, your blocked list or the other formats.

Sources

Related guides

List it on HOL

Connect the repository to verify ownership and claim the listing. New plugins can be submitted for free.

Create an approved feed