
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Install open-plugin format plugins into coding agents and editors, including Claude Code, Cursor, Codex, Grok Build, Kimi Code, GitHub Copilot CLI, and VS Code.
npx plugins add owner/repo
# GitHub shorthand
npx plugins add vercel/vercel-plugin
# Full HTTPS URL
npx plugins add https://github.com/vercel/vercel-plugin
# SSH URL (auto-retries via HTTPS if SSH auth fails)
npx plugins add git@github.com:vercel/vercel-plugin.git
npx plugins add ./my-plugins
npx plugins add /absolute/path/to/plugins
npx plugins discover owner/repo
npx plugins targets
| Command | Description |
|---|---|
plugins add <source> | Discover and install plugins from a source |
plugins discover <source> | Inspect plugins without installing (dry run) |
plugins targets | List available agent tools and their detection status |
If no subcommand is given, plugins <source> defaults to add.
| Flag | Short | Default | Description |
|---|---|---|---|
--target | -t | auto-detect | Install to a specific agent tool (for example, grok or vscode) |
--scope | -s | user | Installation scope: user, project, or local |
--yes | -y | false | Skip the confirmation prompt |
--help | -h | Show usage information |
The CLI auto-detects which agent tools are installed and installs to all of them.
| Target | Detection |
|---|---|
| Claude Code | claude binary on PATH |
| Cursor | cursor binary on PATH |
| Codex | codex binary on PATH |
| Grok Build | grok binary on PATH |
| Kimi Code | kimi on PATH or Kimi's install directory |
| GitHub Copilot CLI | copilot binary on PATH |
| Visual Studio Code | code or code-insiders binary on PATH |
vercel/vercel-plugin through Codex's curated vercel@openai-curated marketplace entry. That native package contains the Codex-supported Vercel surfaces and avoids upstream lifecycle hooks that are not compatible with Codex.grok plugin install command. Its Claude Code compatibility provides skills, commands, agents, hooks, MCP servers, and LSP support./plugins TUI reads on reload. Kimi plugins support skills, commands, hooks, and MCP servers; Kimi does not currently expose plugin agents or LSP servers.copilot plugin marketplace add, then installs plugin@marketplace. This avoids Copilot's deprecated direct local-path installs and keeps copilot plugin update working. This is the standalone Copilot CLI, not the legacy gh copilot extension.chat.pluginLocations setting. VS Code agent plugins are currently a Preview feature; enable chat.plugins.enabled if your organization manages that setting.Kimi, Copilot CLI, and VS Code install plugins per-user. Their native plugin systems do not currently provide the CLI's project or local installation scopes.
The CLI accepts GitHub shorthand (owner/repo), HTTPS URLs, SSH URLs, or local paths. Remote repos are shallow-cloned to ~/.cache/plugins/<slug>. SSH URLs that fail automatically retry via HTTPS.
Discovery follows a 3-step fallback:
marketplace.json that indexes multiple pluginsA plugin is any directory containing skills, commands, agents, rules, hooks, MCP servers, or LSP servers.
The CLI translates the vendor-neutral .plugin/ format into target-specific formats, then installs via the target's native plugin system. Plugin authors write once; the CLI handles the rest.
| Variable | Purpose |
|---|---|
DISABLE_TELEMETRY | Disable anonymous install telemetry |
DO_NOT_TRACK | Disable anonymous install telemetry (standard) |
NO_COLOR | Disable color output |
FORCE_COLOR | Force color output |
npm install
npm run build
node dist/index.js --help
Zero runtime dependencies. Built with tsup as a single bundled ESM file targeting Node.js 18+.
FAQs
Install open-plugin format plugins into agent tools
The npm package plugins receives a total of 10,221 weekly downloads. As such, plugins popularity was classified as popular.
We found that plugins demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.