G

GraphFlow

roarpeng/graphflow · v3.9.2 · 7df8fb9 · Development & Workflow

by RoarpengScan grade: Acceptable

MCP server and cross-agent installer providing surgical symbol read, edit, exec and macro tools for coding agents

InstallSourceClaim this plugin
Follow0
Trust Score74Security scan78Components2
Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is GraphFlow a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

  • Standalone
  • 2 skills

Before you install

Sign-in
Not declared
Declared access
Not declared
License
Not declared

Check before relying on it

  • Some security checks did not finish: Cisco skill scan. See the evidence
  • The publisher has not verified ownership on HOL.
  • No license declared in the manifest.

What is GraphFlow?

GraphFlow is a published development & workflow plugin for AI coding agents in the Standalone ecosystem, developed by Roarpeng and distributed through the HOL AI plugin registry. MCP server and cross-agent installer providing surgical symbol read, edit, exec and macro tools for coding agents.

Canonical slug
roarpeng/graphflow
Version
v3.9.2 · 7df8fb9 · updated Nov 4, 2026

Registry snapshot

Owner verification
Not verified
Scanner
HOL plugin scanner
Security result
Needs review
Digest verified
Yes
2 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

74

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability
95/100
Maintenance
100/100
MCP server setup
100/100
Plugin Security
78/100
Provenance
70/100
Publisher Quality
75/100

Provenance

Plugin root
.
Source repo
https://github.com/Roarpeng/GraphFlow
Source commit
7df8fb99005f…
Publisher verified
No
Owner verified
Not owner verified
Agent Plugins 1.0
Not detected

Continuous scanner CI not detected

This plugin remains listed. Its overall trust score is reduced by 10% because security checks are not maintained in the source repository's CI.

Optional: maintain the scanner in the source repository's CI to receive the full trust score. Listing does not require that change.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed
Needs review
Security result
78
Security score
0
High findings
Provider
codex-plugin-scanner
Grade
C · Acceptable
Version
3.24.2
cisco-skill-scanner: failedcisco-mcp-scanner: skipped

Manifest Validation

19/31

9 checks

Security

16/16

9 checks

Operational Security

3/6

5 checks

Best Practices

9/12

5 checks

Marketplace

N/A

3 checks · not applicable

Skill Security

5/5

4 checks

Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked . This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

lowmanifest-validationPLUGIN_JSON_BAD_NAME

The plugin name "GraphFlow" does not follow the recommended kebab-case style.

Rename the plugin to use lowercase words separated by hyphens.

lowoperational-securityDEPENDABOT_MISSING

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_AUTHOR

The manifest is missing the documented recommended field "author".

Add "author" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_LICENSE

The manifest is missing the documented recommended field "license".

Add "license" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_KEYWORDS

The manifest is missing the documented recommended field "keywords".

Add "keywords" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION

The interface object is missing a valid "shortDescription" value.

Add a valid "shortDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION

The interface object is missing a valid "longDescription" value.

Add a valid "longDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES

The interface object is missing a valid "capabilities" value.

Add a valid "capabilities" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL

The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.

Update "websiteURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL

The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.

Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL

The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.

Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON

The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.

Update "composerIcon" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO

The interface field "logo" must use HTTPS or point to a safe in-repo asset.

Update "logo" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Source

Install v3.9.2 from a native release archive or pinned source.

Install guide
  1. 1

    Download the release archive

    Use the v3.9.2 archive. That tag is a different source revision from later commits on the default branch.

    shell
  2. 2

    Follow the publisher install guide

    https://github.com/Roarpeng/GraphFlow/blob/v3.9.2/docs/INSTALL.md

Did setup work in Source?

No setup reports for Source yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W44, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "GraphFlow",
  "version": "3.9.2",
  "description": "MCP server and cross-agent installer providing surgical symbol read, edit, exec and macro tools for coding agents",
  "repository": "https://github.com/Roarpeng/GraphFlow",
  "homepage": "https://github.com/Roarpeng/GraphFlow",
  "interface": {
    "displayName": "GraphFlow",
    "developerName": "Roarpeng",
    "category": "Development & Workflow"
  },
  "skills": "./",
  "holReleaseTag": "v3.9.2",
  "holAssessedCommit": "7df8fb99005f5b1b3765e6008c6f0ae3e21f742e",
  "holManifestOrigin": "synthesized",
  "registryIndexVersion": 9
}

Skills

2 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

Share
skills-cli

  • graphflow

    packages/graphflow-dsh/skills/graphflow/SKILL.md

    Token-First Surgical Code Engine (gf_read, gf_edit, gf_exec, gf_macro) for TS/JS, Python, Go, Rust, C/C++, C# — true AST for all six language families (TS/JS via `@babel/parser`; Python/Go/Rust/C/C++/C# via optional tree-sitter grammars, structural fallback), self-written L0 semantic index, inheritance-aware blast-radius guards, ambiguous-safe rename, type-aware knowledge-graph calls with alias-resolved imports, precision-capped BM25 doc↔code links, `extends`-aware affected-test routing, six-language parity (51 tests) with packed EN/ZH recall 1.000, offline task reflection/auto-harvest, dehydrated test logs (1-line PASS), bilingual 中文/pinyin code search, git co-change habit macros. 外科手术级省 Token 代码引擎：6 种语言真 AST（TS/JS 用 `@babel/parser`；其余用可选 tree-sitter，缺省回退结构化分析）、自研 L0 语义索引、含继承/super 的爆炸半径守卫、歧义安全重命名、类型感知知识图谱 calls 与别名解析 imports、BM25 上限控制的文档↔代码链接、extends 感知的受影响测试路由、六语言平价（51 项）与 packed EN/ZH 召回 1.000、离线任务反射/自动收割、测试日志脱水、双语检索、习惯宏。

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • graphflow

    skills/graphflow/SKILL.md

    Token-First Surgical Code Engine (gf_read, gf_edit, gf_exec, gf_macro) for TS/JS, Python, Go, Rust, C/C++, C# — true AST for all six language families (TS/JS via `@babel/parser`; Python/Go/Rust/C/C++/C# via optional tree-sitter grammars, structural fallback), self-written L0 semantic index, inheritance-aware blast-radius guards, ambiguous-safe rename, type-aware knowledge-graph calls with alias-resolved imports, precision-capped BM25 doc↔code links, `extends`-aware affected-test routing, six-language parity (51 tests) with packed EN/ZH recall 1.000, offline task reflection/auto-harvest, dehydrated test logs (1-line PASS), bilingual 中文/pinyin code search, git co-change habit macros. 外科手术级省 Token 代码引擎：6 种语言真 AST（TS/JS 用 `@babel/parser`；其余用可选 tree-sitter，缺省回退结构化分析）、自研 L0 语义索引、含继承/super 的爆炸半径守卫、歧义安全重命名、类型感知知识图谱 calls 与别名解析 imports、BM25 上限控制的文档↔代码链接、extends 感知的受影响测试路由、六语言平价（51 项）与 packed EN/ZH 召回 1.000、离线任务反射/自动收割、测试日志脱水、双语检索、习惯宏。

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

File inventory

.codex-plugin/plugin.json

plugin-manifest

536 bytes

0727af523f565d92…

LICENSE

file

13,000 bytes

369e173d7471c0f9…

package-lock.json

file

67,335 bytes

59e9f8dcacb172c1…

package.json

file

2,254 bytes

dffb42e5bd6ac60f…

packages/graphflow-dsh/skills/graphflow/SKILL.md

skill

27,910 bytes

950a6a1daa9b8ddc…

README.md

file

7,967 bytes

37cd2148141622ca…

README.md

file

7,967 bytes

37cd2148141622ca…

SECURITY.md

file

528 bytes

44f04d3978249048…

skills/graphflow/SKILL.md

skill

27,910 bytes

950a6a1daa9b8ddc…

tsconfig.json

file

1,259 bytes

6c5f9c3c7eb383ee…

GraphFlow — Frequently asked questions

What is GraphFlow?
GraphFlow is an AI plugin in the HOL registry. MCP server and cross-agent installer providing surgical symbol read, edit, exec and macro tools for coding agents.
How do I install GraphFlow?
Install GraphFlow in your harness: Source — https://github.com/Roarpeng/GraphFlow/releases/tag/v3.9.2; Any agent — npx [email protected] add Roarpeng/GraphFlow. Full step-by-step guidance is on the HOL plugin page.
How do I install GraphFlow in Source?
To install GraphFlow in Source, start with https://github.com/Roarpeng/GraphFlow/releases/tag/v3.9.2. The complete step-by-step install guide for Source is on the HOL plugin page.
How is the Trust Score for GraphFlow computed?
GraphFlow has a HOL Trust Score of 74 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/roarpeng%2Fgraphflow/trust
Who publishes GraphFlow?
GraphFlow is published by Roarpeng and listed on HOL.

Directory acceptance

Listed in 0 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Lists last read . HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here
<5
HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports
<10
Machines that reported installing it through HOL Guard in week 2026-W44. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces
<5
Workspaces that approved it or include it in an approved-plugin feed, as of today.

Related plugins

Ordered by Trust Score. Listings cannot pay for these positions. Check each one fits your task before switching from GraphFlow.

Alternatives in Development & Workflow

See all Development & Workflow plugins

Reviews and similar plugins