Guide · updated Oct 27, 2026

How to tell if a plugin is worth installing (and safe)

Nobody, us included, audits every community plugin. But you can catch most of the bad ones in about two minutes.

Is it alive? Look at the last commit and open issues. Every PickAPlugin listing shows when the repo was last updated and whether it's archived.
What does it run? Open .mcp.json and any hooks.json. Hooks and MCP servers run code on your machine.
What does it ask for? Tokens, filesystem access, network. Does that match what it says it does?
Who made it? A known company or an active maintainer is a better bet than a fresh account.
License. If there's none, you technically can't reuse the code. Browse plugins by license.
Manifest sanity. Run it through the validator. Absolute paths or secrets in the manifest are a red flag.

Questions people ask

No. We sort and describe them, show last update, license and install command, and link to the source. Read the code before installing anything.

They're curated by OpenAI, which is a real signal, but it's still worth knowing what you're connecting.