Monthly report
State of agent plugins: October 2026
By HOL · Reviewed by Michael Kantor · Snapshot taken · Download CSV
Direct answer
In October 2026 the HOL catalog listed 49,665 agent extensions: 1,002 packaged plugins and 48,663 MCP servers. Most plugins target Codex, Claude Code, Cursor, and 47% declare two or more runtimes. HOL scanned 84.2% of plugins; 0.5% had at least one high-severity finding. Every number here comes from a stored script and a downloadable CSV.
The catalog at a glance
- Listings
- 49,665
- Packaged plugins
- 1,002
- MCP servers
- 48,663
- 0 scanned by HOL
- Median trust score
- 66
- 844 plugins scored
48,663 listings come from the official MCP registry and have not been scanned by HOL yet. They count toward catalog totals only; every rate below uses the 1,002 packaged plugins as its base.
Where plugins ship
47% of plugins declare two or more agent runtimes, and the average plugin declares 1.73. MCP, Agent Skills and other packaging formats appear in the table but do not count as runtimes. The runtime compatibility map shows which runtimes plugins declare together.
| Runtime or format | Plugins | Share of plugins |
|---|---|---|
| Codex | 611 | 61% |
| Claude Code | 600 | 59.9% |
| MCPformat | 342 | 34.1% |
| Cursor | 164 | 16.4% |
| Gemini CLI | 130 | 13% |
| Agent Pluginformat | 109 | 10.9% |
| OpenCode | 76 | 7.6% |
| Grok | 46 | 4.6% |
| Agent Skillsformat | 34 | 3.4% |
| Kimi | 28 | 2.8% |
| Deepseek Harness | 23 | 2.3% |
| GitHub Copilot | 21 | 2.1% |
| Standaloneformat | 15 | 1.5% |
| Openclaw | 11 | 1.1% |
| Ollama | 8 | 0.8% |
| Qwen | 6 | 0.6% |
| Cline | 4 | 0.4% |
| Windsurf | 4 | 0.4% |
| Openrouter | 2 | 0.2% |
| Perplexity | 2 | 0.2% |
| Plugins that bundle | Plugins | Share |
|---|---|---|
| At least one skill | 638 | 63.7% |
| At least one MCP server | 255 | 25.4% |
What scans find
HOL scanned 844 plugins (84.2%). They produced 16,999 findings, 20.14 per scanned plugin on average. 5 plugins (0.5%) had at least one high-severity finding.
| Scan result | Plugins |
|---|---|
| No findings at scan time | 150 (17.8%) |
| Findings to review | 155 (18.4%) |
| Findings to review closely | 533 (63.2%) |
| High-severity findings | 6 (0.7%) |
| Severity | Findings |
|---|---|
| critical | 0 |
| high | 5 |
| medium | 1,904 |
| low | 691 |
| info | 14,399 |
| Category | Plugins affected | Findings |
|---|---|---|
publishability | 685 | 1,883 |
skill-security | 638 | 14,399 |
operational-security | 598 | 598 |
mcp-security | 90 | 98 |
provenance | 21 | 21 |
Trust and maintenance
Trust scores follow the published methodology. Owner verification means the publisher proved control of the source repository; continuous scanning means a scanner workflow runs in the repository's CI.
| Signal | Plugins | Share |
|---|---|---|
| Trust score 90–100 | 27 | 2.7% |
| Trust score 75–89 | 173 | 17.3% |
| Trust score 50–74 | 636 | 63.5% |
| Trust score 0–49 | 8 | 0.8% |
| Owner verified | 446 | 44.5% |
| Continuous scanning in CI | 302 | 30.1% |
Who this report is for
Plugin and MCP server authors deciding which runtimes to ship to, security teams sizing agent extension risk, and analysts tracking the agent plugin market.
Use it to
- Choose which runtimes to package a plugin for, based on where other authors ship.
- Benchmark a plugin scan result against the catalog-wide label and severity mix.
- Cite current counts of agent plugins and MCP servers with a downloadable source.
Not for
- Judging one plugin: open its listing and trust score instead.
- Install or download counts: runtimes do not publish them, so this report does not estimate them.
- A security guarantee: a scan finds known patterns and cannot prove a plugin is safe.
Methodology
On 2026-10-24, a script read every listing from the HOL plugin catalog API (/api/v1/plugins/catalog, 49,665 rows) and aggregated them with one function (scripts/plugins/state-of-agent-plugins.ts). The page and the CSV read the same committed output, so every figure here appears in the download. A plugin counts toward each runtime its listing declares. Shares use packaged plugins as the base unless a row says otherwise.
Limitations
- Most MCP servers come from the official MCP registry and are counted but not scanned, so scan rates use packaged plugins only.
- A plugin counts toward every runtime its manifest or listing declares; the report does not load each plugin in each runtime.
- Trust scores and safety labels follow the published methodology in force on the snapshot date; a methodology change shifts them between editions.
- The snapshot is one point in time. Listings added, removed or rescanned after it are in the next edition.
Other editions
Related
Count your plugin in
Claim your listing to verify ownership, add continuous scanning, and appear in next month's owner-verified share.