CodeTruss icon

CodeTruss

codetruss/codetruss · v0.1.6 · Development & Workflow

by CodeTrussOwner verifiedAwesome AI Plugins

Local-first acceptance gate that checks coding-agent scope, sensitive surfaces, deterministic analyzers, and repository verification from immutable Git snapshots, then writes signed receipts before the PR.

InstallSource
Follow0
Trust Score93Security scanPartialComponents3
Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is CodeTruss a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

  • Codex
  • 3 skills

Before you install

Sign-in
Asks you to sign in when you install it
Declared access
Interactive, Read, Write
License
MIT

Check before relying on it

What is CodeTruss?

CodeTruss is a published development & workflow plugin for AI coding agents in the Codex ecosystem, developed by CodeTruss and distributed through the HOL AI plugin registry. Local-first acceptance gate that checks coding-agent scope, sensitive surfaces, deterministic analyzers, and repository verification from immutable Git snapshots, then writes signed receipts before the PR.

Canonical slug
codetruss/codetruss
Version
v0.1.6 · updated Nov 8, 2026

Registry snapshot

Owner verification
Verified on HOL as @DeliriumPulse
Marketplace source
.claude-plugin/marketplace.json
Scanner
HOL plugin scanner
Security result
Partial scan
Digest verified
Yes
3 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

On-Chain Verified
93

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability
100/100
Maintenance
100/100
MCP server setup
100/100
Plugin Security
92/100
Provenance
80/100
Publisher Quality
100/100

Provenance

Plugin root
.
Source repo
https://github.com/DeliriumPulse/codetruss-plugins
Source commit
110a54a27b21…
Publisher verified
Yes
Owner verified
@DeliriumPulse
Agent Plugins 1.0
Not detected

Continuous scanner CI detected

No action is required. This plugin receives the full trust score.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed
Partial scan
Security result
92
Score from finished checks
0
High findings

Some checks did not finish: Cisco skill scan. No blocking issue was found in the checks that did finish, but this is not a passed scan.

Provider
codex-plugin-scanner
Grade
A · Excellent
Version
3.24.2
codex:hol-plugin-scanner-JhrxA0 / cisco-skill-scanner: failedcodex:hol-plugin-scanner-JhrxA0 / cisco-mcp-scanner: skipped

[claude:.] Claude Plugin

22/22

5 checks

[claude:.] Security

16/16

6 checks

[claude:.] Operational Security

3/6

5 checks

[claude:.] Code Quality

10/10

2 checks

[codex:.] Manifest Validation

28/31

9 checks

[codex:.] Security

16/16

9 checks

[codex:.] Operational Security

3/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

15/15

3 checks

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked . This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

lowoperational-securityDEPENDABOT_MISSINGReported 2 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Codex

Install through the Codex CLI plugin marketplace.

Codex plugin docs

Optional: install HOL Guard for Codex first, so it can check this plugin's tools on your machine before Codex uses them.

  1. 1

    Register the marketplace

    Run in any terminal. Codex reads the marketplace entry from .agents/plugins/marketplace.json (or the legacy .claude-plugin path) in the repository. If the repository ships none, add the generated entry from the Advanced section below first.

    shell
  2. 2

    Install the plugin

    Installs the codetruss entry from the codetruss marketplace. You can also install it from the Plugins browser inside Codex.

    shell
  3. 3

    Check the marketplace is registered

    This confirms the marketplace source only. Confirm the plugin itself is enabled in the Plugins browser before relying on it.

    shell

To remove it later, run codex plugin remove codetruss@codetruss.

Did setup work in Codex?

No setup reports for Codex yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W45, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "codetruss",
  "version": "0.1.6",
  "description": "The deterministic first-pass verification gate for AI-written code.",
  "author": {
    "name": "CodeTruss",
    "email": "[email protected]",
    "url": "https://codetruss.com"
  },
  "homepage": "https://codetruss.com/cli",
  "repository": "https://github.com/DeliriumPulse/codetruss-plugins",
  "license": "MIT",
  "keywords": [
    "acceptance-gate",
    "coding-agents",
    "scope-drift",
    "local-first",
    "verification",
    "receipts"
  ],
  "skills": "./",
  "interface": {
    "displayName": "CodeTruss",
    "developerName": "CodeTruss",
    "shortDescription": "First-pass verification gate for AI-written code",
    "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.",
    "category": "Developer Tools",
    "capabilities": [
      "Interactive",
      "Read",
      "Write"
    ],
    "websiteURL": "https://codetruss.com",
    "privacyPolicyURL": "https://codetruss.com/privacy",
    "termsOfServiceURL": "https://codetruss.com/terms",
    "defaultPrompt": [
      "Set up CodeTruss for this repository",
      "Review my current changes against the task",
      "Verify and explain my latest CodeTruss receipt"
    ],
    "brandColor": "#B93A26",
    "composerIcon": "./assets/icon.svg",
    "logo": "./assets/icon.svg",
    "logoDark": "./assets/icon.svg"
  },
  "holManifestOrigin": "repository",
  "registryIndexVersion": 9
}

Marketplace source

Repo URL
https://github.com/DeliriumPulse/codetruss-plugins
Marketplace path
.claude-plugin/marketplace.json
Source path
plugins/DeliriumPulse/codetruss-plugins
Install policy
AVAILABLE

Skills

3 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

Share
skills-cli

  • codetruss

    plugins/codetruss-claude/skills/codetruss/SKILL.md

    Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • codetruss

    plugins/codetruss/skills/codetruss/SKILL.md

    Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • codetruss

    skills/codetruss/SKILL.md

    Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

File inventory

.agents/plugins/marketplace.json

file

400 bytes

49fa398b33b725a5…

.claude-plugin/marketplace.json

file

821 bytes

8fb7bc27f8f7a18f…

.codex-plugin/plugin.json

plugin-manifest

1,376 bytes

ca569a78f000bfc0…

assets/icon.svg

asset

330 bytes

bb28cc6a348a7f93…

LICENSE

file

1,424 bytes

f05cdf170ca2ca93…

package-lock.json

file

286 bytes

b2b62f505086ded2…

package.json

file

407 bytes

34c06839f9f4d6d4…

plugins/codetruss-claude/skills/codetruss/agents/openai.yaml

file

203 bytes

3ef6e74c328d0fa9…

plugins/codetruss-claude/skills/codetruss/SKILL.md

skill

7,965 bytes

0a46b9173f1b5e8f…

plugins/codetruss/skills/codetruss/agents/openai.yaml

file

203 bytes

3ef6e74c328d0fa9…

plugins/codetruss/skills/codetruss/SKILL.md

skill

7,965 bytes

0a46b9173f1b5e8f…

README.md

file

9,936 bytes

dc4a28b070232a52…

SECURITY.md

file

1,088 bytes

dec066169a48dc6a…

skills/codetruss/agents/openai.yaml

skill

203 bytes

3ef6e74c328d0fa9…

skills/codetruss/SKILL.md

skill

7,965 bytes

0a46b9173f1b5e8f…

CodeTruss — Frequently asked questions

What is CodeTruss?
CodeTruss is an AI plugin in the HOL registry. Local-first acceptance gate that checks coding-agent scope, sensitive surfaces, deterministic analyzers, and repository verification from immutable Git snapshots, then writes signed receipts before the PR.
How do I install CodeTruss?
Install CodeTruss in your harness: Codex — codex plugin marketplace add DeliriumPulse/codetruss-plugins; Any agent — npx [email protected] add DeliriumPulse/codetruss-plugins. Full step-by-step guidance is on the HOL plugin page.
How do I install CodeTruss in HOL Guard?
To install CodeTruss in HOL Guard, start with hol-guard plugin install codetruss/codetruss --apply. The complete step-by-step install guide for HOL Guard is on the HOL plugin page.
How do I install CodeTruss in Codex?
To install CodeTruss in Codex, start with codex plugin marketplace add DeliriumPulse/codetruss-plugins. The complete step-by-step install guide for Codex is on the HOL plugin page.
How is the Trust Score for CodeTruss computed?
CodeTruss has a HOL Trust Score of 93 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/codetruss%2Fcodetruss/trust
Who publishes CodeTruss?
CodeTruss is published by CodeTruss and listed on HOL.

Directory acceptance

Listed in 1 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Lists last read . HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here
<5
HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports
<10
Machines that reported installing it through HOL Guard in week 2026-W45. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces
<5
Workspaces that approved it or include it in an approved-plugin feed, as of today.
New GitHub stars
<5
From HOL's GitHub snapshots of the repository, 2026-10-13 to 2026-11-10.

Related plugins

Ordered by Trust Score. Listings cannot pay for these positions. Check each one fits your task before switching from CodeTruss.

Alternatives in Development & Workflow

See all Development & Workflow plugins

Reviews and similar plugins