Compare commits

...

12 Commits

Author SHA1 Message Date
tobin
3f2f08f955 Revert mintlify and netsuite-suitecloud changes
The validate-plugins check requires a plugin manifest at the pinned SHA
even for strict:false entries. Neither repo has one at any SHA, so a
SHA bump fails CI. Leave them at the existing pin until either the
upstream adds a manifest or the validator learns to honor strict:false.
2026-05-18 19:18:49 +00:00
tobin
791f2de6ce Fix broken plugin source configs and bump their SHAs
Several external plugins had source configs that no longer matched the
upstream layout, so the automated SHA bump skipped them indefinitely.
Add the missing path field where the manifest moved into a subdirectory,
correct stale ref/commit metadata, and update the skills list for the
one strict:false skills-only entry.

- rc, revenuecat: upstream moved the plugin from repo root into
  revenuecat/. Add path and bump SHA.
- zilliz: plugin moved from repo root into plugins/zilliz/. Add path
  and bump SHA.
- sumup: plugin lives at providers/claude/plugin/ (declared by the
  upstream marketplace.json) but our entry never had a path. Add it
  and bump SHA.
- mintlify: pure SHA bump. Repo layout unchanged between SHAs; the
  upstream remains a marketplace-style repo with no plugin.json, same
  as the currently pinned SHA.
- netsuite-suitecloud (strict:false skills entry): bump SHA and add
  the four new skill directories upstream added since the last pin.
- 42crunch-api-security-testing: ref said v1.0.1 but the pinned SHA
  is actually v1.5.5. Correct the label; the SHA is already current.
- jfrog: commit and sha fields had drifted apart. Set both to
  upstream HEAD.

Each new SHA verified to be on the upstream default branch and the
referenced manifest validated with claude plugin validate.
2026-05-18 19:13:39 +00:00
Tobin South
e98784f00e Run plugin SHA bump nightly instead of weekly (#1909)
Upstream plugins move daily; a weekly sweep with a 20-bump cap can fall
behind. Each run force-resets the bump branch, so stale unmerged PRs are
replaced rather than piling up.
2026-05-18 19:53:59 +01:00
Tobin South
237a6b9707 Add CI check for HTTP MCP server URL liveness (#1910)
Walks marketplace.json for vendored plugins, extracts http/sse MCP
server URLs from .mcp.json / mcp.json / plugin.json, and probes each
with HEAD then a JSON-RPC POST fallback. Fails on 404/410 and
connection errors; passes on auth/method errors (expected without
credentials). Runs on PR, daily schedule, and manual dispatch.

External (SHA-pinned) plugins are out of scope — their .mcp.json
isn't checked out here.
2026-05-18 13:24:31 -05:00
github-actions[bot]
0c54d4ac15 Bump 20 plugin SHA pin(s) to upstream HEAD (#1904)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-05-18 18:52:12 +01:00
Bryan Thompson
61b760aafc Add save-to-spotify plugin (#1905) 2026-05-18 08:59:59 -07:00
Bryan Thompson
f475d3ce58 Add zoominfo plugin (#1885) 2026-05-17 17:49:38 -07:00
Bryan Thompson
d7b273d2b4 Bump crowdstrike-falcon-foundry SHA to v1.0.0 (#1842)
Pins to the v1.0.0 tag (a6a500c) instead of pre-release HEAD (e7fa026).
2026-05-17 17:49:15 -07:00
Bryan Thompson
b5a156b6ec Add carta-cap-table plugin (#1876) 2026-05-16 07:55:29 -05:00
Tobin South
32b176e6aa Bump pagerduty plugin to latest upstream SHA (#1862)
Picks up v1.1.0: new /create-pagerduty-skill command (Early Access).
2026-05-16 07:55:14 -05:00
Bryan Thompson
d8e4105231 Bump vanta-mcp-plugin SHA to 345d86b5 (#1843) 2026-05-16 07:55:04 -05:00
Bryan Thompson
5dbfa0fade Bump box plugin SHA and enumerate skills (#1845) 2026-05-15 23:54:38 +01:00
3 changed files with 221 additions and 33 deletions

View File

@@ -18,8 +18,8 @@
"source": "git-subdir",
"url": "https://github.com/42Crunch-AI/claude-plugins.git",
"path": "plugins/api-security-testing",
"ref": "v1.0.1",
"sha": "56273e0e20762d76640838300a7431c4260cad32"
"ref": "v1.5.5",
"sha": "faf5305385de8afed9468904e8639be737aff39e"
},
"homepage": "https://42crunch.com"
},
@@ -35,7 +35,7 @@
"url": "https://github.com/adobe/skills.git",
"path": "plugins/creative-cloud/adobe-for-creativity",
"ref": "main",
"sha": "0f1ad97af8b4de2107c2417184fc4c3114bda9d3"
"sha": "9ca1da262869ca2fb5f6c3daae2f7eeb648c937d"
},
"homepage": "https://github.com/adobe/skills/tree/main/plugins/creative-cloud/adobe-for-creativity"
},
@@ -57,7 +57,7 @@
"source": {
"source": "url",
"url": "https://github.com/SalesforceAIResearch/agentforce-adlc.git",
"sha": "9ef4d9b1958d4ed21179017d0452a81ec13c1de2"
"sha": "d645d2c8ce0689a568224436061872ab9f0ab179"
},
"homepage": "https://github.com/SalesforceAIResearch/agentforce-adlc"
},
@@ -77,7 +77,7 @@
"source": {
"source": "url",
"url": "https://github.com/AikidoSec/aikido-claude-plugin.git",
"sha": "5d9c13d367218e9b43a11d4502f623ab98859225"
"sha": "79ac524f87c9faa9a356ff3d495b8a5b77e01bbd"
},
"homepage": "https://github.com/AikidoSec/aikido-claude-plugin"
},
@@ -107,7 +107,7 @@
"source": {
"source": "url",
"url": "https://github.com/gemini-cli-extensions/alloydb.git",
"sha": "0723d3ada808fe8f33e1b2808fd7a843c3d63ad2"
"sha": "4a75653275b095fcacf1508796b0fee8cc758c07"
},
"homepage": "https://cloud.google.com/alloydb"
},
@@ -120,7 +120,7 @@
"url": "https://github.com/awslabs/agent-plugins.git",
"path": "plugins/amazon-location-service",
"ref": "main",
"sha": "6cfb70e55aa142a8eda66e6ef7966d5921bdf9a2"
"sha": "95381e8bcb92f58a28edb4f83eb7e163c7461a0a"
},
"homepage": "https://github.com/awslabs/agent-plugins"
},
@@ -165,7 +165,7 @@
"source": {
"source": "url",
"url": "https://github.com/astronomer/agents.git",
"sha": "5935c4330dea4dfb8e93568956b10a543ecdb3d1"
"sha": "535a040ca9e27aaed6da13f0f959625fb3294820"
},
"homepage": "https://github.com/astronomer/agents"
},
@@ -175,7 +175,7 @@
"source": {
"source": "url",
"url": "https://github.com/atlanhq/agent-toolkit.git",
"sha": "acdf284da6aa98b14f8dad90a9827006d8df425c"
"sha": "790398c87378f128bdc74c31bb7ecfb8e4695f29"
},
"homepage": "https://docs.atlan.com/"
},
@@ -217,7 +217,7 @@
"url": "https://github.com/auth0/agent-skills.git",
"path": "plugins/auth0",
"ref": "main",
"sha": "f7724bf7984c5b00496cac0f54526bb1cf505dcb"
"sha": "1c32754fcb934109451435ecd4a6ea9b068f0937"
},
"homepage": "https://auth0.com/docs/quickstart/agent-skills"
},
@@ -233,7 +233,7 @@
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
"path": "plugins/aws-agents",
"ref": "main",
"sha": "750230758fbf23acd60d075dedd7ead4092127ce"
"sha": "14780bf3440aa1532eadfbb2ff547f58969fcfb2"
},
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
},
@@ -246,7 +246,7 @@
"url": "https://github.com/awslabs/agent-plugins.git",
"path": "plugins/aws-amplify",
"ref": "main",
"sha": "6cfb70e55aa142a8eda66e6ef7966d5921bdf9a2"
"sha": "95381e8bcb92f58a28edb4f83eb7e163c7461a0a"
},
"homepage": "https://github.com/awslabs/agent-plugins"
},
@@ -262,7 +262,7 @@
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
"path": "plugins/aws-core",
"ref": "main",
"sha": "750230758fbf23acd60d075dedd7ead4092127ce"
"sha": "14780bf3440aa1532eadfbb2ff547f58969fcfb2"
},
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
},
@@ -278,7 +278,7 @@
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
"path": "plugins/aws-data-analytics",
"ref": "main",
"sha": "750230758fbf23acd60d075dedd7ead4092127ce"
"sha": "14780bf3440aa1532eadfbb2ff547f58969fcfb2"
},
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
},
@@ -307,7 +307,7 @@
"url": "https://github.com/awslabs/agent-plugins.git",
"path": "plugins/aws-serverless",
"ref": "main",
"sha": "6cfb70e55aa142a8eda66e6ef7966d5921bdf9a2"
"sha": "95381e8bcb92f58a28edb4f83eb7e163c7461a0a"
},
"homepage": "https://github.com/awslabs/agent-plugins"
},
@@ -318,7 +318,7 @@
"source": {
"source": "url",
"url": "https://github.com/microsoft/azure-skills.git",
"sha": "ed25b85a13ec001c53f538b07e0bfbe732673885"
"sha": "2a5c5080b8c501d00408eb00f7ee4ed8effa7b2c"
},
"homepage": "https://github.com/microsoft/azure-skills"
},
@@ -327,7 +327,7 @@
"source": {
"source": "url",
"url": "https://github.com/AzureCosmosDB/cosmosdb-claude-code-plugin.git",
"sha": "23c168856e4435793bd27a72d4714f022a3a1e90"
"sha": "f1e0498579a9251e5f3179b92d25d6ce3409bae5"
},
"description": "Expert assistant for Azure Cosmos DB — data modeling, query optimization, performance tuning, and best practices.",
"category": "database",
@@ -340,7 +340,7 @@
"source": {
"source": "url",
"url": "https://github.com/base44/skills.git",
"sha": "c7039b37eca0e2916a565a7395040c00055bcf8b"
"sha": "ec420cf2edd2c7e9a523d5afe2e71498a6357fa4"
},
"homepage": "https://docs.base44.com"
},
@@ -356,7 +356,7 @@
"url": "https://github.com/Bigdata-com/bigdata-plugins-marketplace.git",
"path": "plugins/bigdata-com",
"ref": "main",
"sha": "274b5365bdc61130225de736d3f3ca5210c0e37d"
"sha": "c77a09caabdc8783adbcbf8bbe05a0f57da12b19"
},
"homepage": "https://docs.bigdata.com"
},
@@ -367,8 +367,15 @@
"source": {
"source": "url",
"url": "https://github.com/box/box-for-ai.git",
"sha": "0fb23244e3c35cd562206c80eff1e22c456046ea"
"sha": "16f1a0427710b0812519ea634cd5ce6830bde8fc"
},
"skills": [
"./skills/box",
"./skills/box-legal-workflows",
"./skills/box-legal-workflows-contract",
"./skills/box-legal-workflows-intake",
"./skills/box-legal-workflows-ma"
],
"homepage": "https://github.com/box/box-for-ai"
},
{
@@ -377,10 +384,26 @@
"source": {
"source": "url",
"url": "https://github.com/brightdata/skills.git",
"sha": "44b24797d82cfd535c5b97831d5c6ba86c9d60df"
"sha": "37145178dfc9b52e28dd224afeccc7184f7711fc"
},
"homepage": "https://docs.brightdata.com"
},
{
"name": "carta-cap-table",
"description": "Carta Cap Table plugin — skills and hooks for querying cap tables, grants, SAFEs, 409A valuations, waterfall scenarios, and more",
"author": {
"name": "Carta Engineering"
},
"category": "productivity",
"source": {
"source": "git-subdir",
"url": "https://github.com/carta/plugins.git",
"path": "plugins/carta-cap-table",
"ref": "main",
"sha": "980fd3966ec79b61ff94f39db4592f7df9d6ed80"
},
"homepage": "https://carta.com"
},
{
"name": "cds-mcp",
"description": "AI-assisted development of SAP Cloud Application Programming Model (CAP) projects. Search CDS models and CAP documentation.",
@@ -610,7 +633,7 @@
"source": {
"source": "url",
"url": "https://github.com/CrowdStrike/foundry-skills.git",
"sha": "e7fa0260b5a413d9a459d3afbc5ba427da6c6e04"
"sha": "4b517aa5729d5bb5e397ff779f98eb05c91d1b21"
},
"homepage": "https://github.com/CrowdStrike/foundry-skills"
},
@@ -1026,8 +1049,8 @@
"source": {
"source": "github",
"repo": "jfrog/claude-plugin",
"commit": "761921eaa12b845beba1688d699a2d45091dfe83",
"sha": "d80db066e219aab8190f3dc4a463b71a3a180250"
"commit": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d",
"sha": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d"
},
"homepage": "https://jfrog.com"
},
@@ -1365,7 +1388,7 @@
"source": {
"source": "url",
"url": "https://github.com/PagerDuty/claude-code-plugins.git",
"sha": "b16c23e0d790deceaa7a6182616d0e36673f2eae"
"sha": "761cba75bd50fd561405c3b173ecf36084432089"
},
"homepage": "https://github.com/PagerDuty/claude-code-plugins"
},
@@ -1631,7 +1654,8 @@
"source": {
"source": "url",
"url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
"sha": "af7cb77996aee4e7e3c109c5afec81f716139032"
"path": "revenuecat",
"sha": "407e4651ff74dbaf47c457948ab540e620403c2a"
},
"homepage": "https://www.revenuecat.com"
},
@@ -1652,7 +1676,8 @@
"source": {
"source": "url",
"url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
"sha": "af7cb77996aee4e7e3c109c5afec81f716139032"
"path": "revenuecat",
"sha": "407e4651ff74dbaf47c457948ab540e620403c2a"
},
"homepage": "https://www.revenuecat.com"
},
@@ -1764,6 +1789,22 @@
},
"homepage": "https://help.sap.com/docs/MDK"
},
{
"name": "save-to-spotify",
"description": "Create polished audio episodes with TTS narration, rich timelines, cover images, and save them to Spotify via the save-to-spotify CLI.",
"author": {
"name": "Spotify"
},
"category": "productivity",
"source": {
"source": "git-subdir",
"url": "https://github.com/spotify/save-to-spotify.git",
"path": "plugin",
"ref": "main",
"sha": "b3d362f7851d184098dcb220ba2fab10c996d1f2"
},
"homepage": "https://github.com/spotify/save-to-spotify"
},
{
"name": "security-guidance",
"description": "Security reminder hook that warns about potential security issues when editing files, including command injection, XSS, and unsafe code patterns",
@@ -1968,7 +2009,8 @@
"source": {
"source": "url",
"url": "https://github.com/sumup/sumup-skills.git",
"sha": "0fd0a911ecaffd7187fe35e914d8ead6de584ffd"
"path": "providers/claude/plugin",
"sha": "a4b5a9789e10e27fb375b68279bb0916074b8dd4"
},
"homepage": "https://www.sumup.com/"
},
@@ -2121,7 +2163,7 @@
"source": {
"source": "url",
"url": "https://github.com/VantaInc/vanta-mcp-plugin.git",
"sha": "a9dac8bef2ccda299b3a4ba7a1bc7e0dbb7195ac"
"sha": "345d86b55faa649e955b7ea5569cf52d8425c2d5"
},
"homepage": "https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp#h_887ce3f337"
},
@@ -2208,7 +2250,8 @@
"source": {
"source": "url",
"url": "https://github.com/zilliztech/zilliz-plugin.git",
"sha": "17cf04e6a3c272320b707d429484e4c00b3bec0b"
"path": "plugins/zilliz",
"sha": "e960396da0bd0b1cb219fa97e3bcbb425ee1abbd"
},
"homepage": "https://docs.zilliz.com"
},
@@ -2223,6 +2266,20 @@
},
"homepage": "https://developers.zoom.us/"
},
{
"name": "zoominfo",
"description": "Search companies and contacts, enrich leads, find lookalikes, and get AI-ranked contact recommendations. Pre-built skills chain multiple ZoomInfo tools into complete B2B sales workflows.",
"author": {
"name": "ZoomInfo"
},
"category": "productivity",
"source": {
"source": "url",
"url": "https://github.com/Zoominfo/zoominfo-mcp-plugin.git",
"sha": "14752e4553312d8af3eb3a3264a97d76bb3e0215"
},
"homepage": "https://www.zoominfo.com"
},
{
"name": "zscaler",
"description": "Manage Zscaler cloud security platform including ZPA (private access), ZIA (internet access), ZDX (digital experience), ZCC (client connector), EASM (attack surface), and Z-Insights (analytics). Create and manage policies, troubleshoot connectivity, audit security configurations, and investigate incidents across the full Zscaler ecosystem.",

View File

@@ -1,8 +1,10 @@
name: Bump Plugin SHAs
# Weekly sweep: for each external entry whose upstream HEAD has moved past
# Nightly sweep: for each external entry whose upstream HEAD has moved past
# its pinned SHA, validate at the new SHA with `claude plugin validate`
# inline, then open one PR with all passing bumps.
# inline, then open one PR with all passing bumps. Each run force-resets the
# bump/plugin-shas branch, so a previous night's unmerged PR is replaced (and
# its review state discarded) — review and merge same-day to avoid churn.
#
# Bot-free — uses the default GITHUB_TOKEN. PRs opened with GITHUB_TOKEN don't
# trigger on:pull_request workflows, so the policy scan (`Scan Plugins`, a
@@ -14,7 +16,7 @@ name: Bump Plugin SHAs
on:
schedule:
- cron: '23 7 * * 1' # Monday 07:23 UTC
- cron: '23 7 * * *' # Daily 07:23 UTC
workflow_dispatch:
inputs:
max_bumps:

129
.github/workflows/check-mcp-urls.yml vendored Normal file
View File

@@ -0,0 +1,129 @@
name: Check MCP URLs
# Liveness check for http/sse MCP server URLs declared by plugins vendored
# in this repo. Catches typos in new submissions and upstream endpoints that
# disappear after merge.
#
# Scope: only plugins whose files live in this working tree (marketplace
# entries with a string `source`, e.g. "./plugins/foo"). External entries
# are pinned to an upstream repo at a SHA — reading their .mcp.json would
# mean cloning every upstream on each run, which is slow and flaky. Those
# are out of scope for now.
#
# What counts as "alive": anything that proves the hostname/path resolves to
# a server. 401/403/405/5xx all pass — auth and method errors are expected
# without credentials. Only 404/410 and connection/DNS/TLS failures fail.
on:
pull_request:
paths:
- '.claude-plugin/marketplace.json'
- 'plugins/**'
- 'external_plugins/**'
- '.github/workflows/check-mcp-urls.yml'
schedule:
- cron: '0 6 * * *'
workflow_dispatch:
permissions:
contents: read
jobs:
check:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- name: Discover and probe MCP server URLs
run: |
set -euo pipefail
MARKETPLACE=".claude-plugin/marketplace.json"
# Each line: "<plugin>\t<server>\t<url>". Marketplace entries with a
# string `source` are local paths; objects describe an external repo
# pinned at a SHA, which we don't have checked out — skip those.
discover() {
jq -r '.plugins[] | select(.source | type == "string") | "\(.name)\t\(.source)"' "$MARKETPLACE" |
while IFS=$'\t' read -r plugin src; do
dir="${src#./}"
[[ -d "$dir" ]] || continue
for cfg in "$dir/.mcp.json" "$dir/mcp.json" "$dir/.claude-plugin/plugin.json"; do
[[ -f "$cfg" ]] || continue
# MCP config comes in two shapes: a bare map of server name ->
# config, or wrapped under a top-level "mcpServers" key (also
# the shape inside plugin.json). Normalize, then keep entries
# with an http/sse type and a string url.
jq -r --arg plugin "$plugin" '
(if (type == "object" and has("mcpServers")) then .mcpServers else . end)
| to_entries[]
| select((.value | type) == "object")
| select(.value.type == "http" or .value.type == "sse")
| select(.value.url | type == "string")
| "\($plugin)\t\(.key)\t\(.value.url)"
' "$cfg" 2>/dev/null || true
done
done | sort -u
}
# Returns 0 on pass, 1 on fail; prints "PASS|FAIL <code> <note>".
probe() {
local url="$1"
local code
# HEAD first — cheap and covers plain web endpoints. -L follows
# redirects so a permanent redirect to a live page still passes.
code="$(curl -sS -o /dev/null -w '%{http_code}' \
--connect-timeout 10 --max-time 10 \
--retry 2 --retry-delay 2 \
-L -I "$url" 2>/dev/null || echo "000")"
# MCP endpoints typically reject HEAD (404/405) but answer POST
# with a JSON-RPC body. Retry as a real MCP client would.
if [[ "$code" == "000" || "$code" == "404" || "$code" == "405" ]]; then
code="$(curl -sS -o /dev/null -w '%{http_code}' \
--connect-timeout 10 --max-time 10 \
--retry 2 --retry-delay 2 \
-L -X POST \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
--data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}' \
"$url" 2>/dev/null || echo "000")"
fi
case "$code" in
000) echo "FAIL $code unreachable"; return 1 ;;
404|410) echo "FAIL $code gone"; return 1 ;;
*) echo "PASS $code"; return 0 ;;
esac
}
entries="$(discover)"
if [[ -z "$entries" ]]; then
echo "::notice::No http/sse MCP server URLs found in vendored plugins."
exit 0
fi
failures=0
printf '%-24s %-18s %-52s %s\n' "PLUGIN" "SERVER" "URL" "RESULT"
while IFS=$'\t' read -r plugin server url; do
# Skip URLs with template placeholders — they need user config
# and can't be probed as-is.
if [[ "$url" == *'${'* || "$url" == *'{{'* ]]; then
printf '%-24s %-18s %-52s %s\n' "$plugin" "$server" "$url" "SKIP templated"
continue
fi
result="$(probe "$url")" || true
printf '%-24s %-18s %-52s %s\n' "$plugin" "$server" "$url" "$result"
if [[ "$result" == FAIL* ]]; then
failures=$((failures + 1))
echo "::error::MCP server URL for plugin '$plugin' (server '$server') is unreachable: $url ($result)"
fi
done <<< "$entries"
echo
if (( failures > 0 )); then
echo "::error::$failures MCP server URL(s) failed liveness check."
exit 1
fi
echo "All MCP server URLs reachable."