[External Plugin]: mcp-pin

Plugin name

mcp-pin

Short description

Know when an MCP server's tools change after you approved them: read-only lookup tools against a public log of tool definition changes, a skill for checking servers and explaining blocks, and a session-start note listing local servers that run without mcp-pin.

GitHub repository

GautamTalksDev/mcp-pin

Plugin path inside the repository

plugins/mcp-pin

Ref to review

No response

Commit SHA to review

4af6b8a7fff0b377ff055f5648a01141c8a131b5

Version

0.2.2

License identifier

MIT

Author name

Gautam Khosla

Author URL

http://github.com/GautamTalksDev

Homepage URL

https://mcp-pin.gautamkhosla.com

Keywords

mcp
security
tool-poisoning
rug-pull
supply-chain

Additional notes for reviewers

The plugin starts one local MCP server, npx -y mcp-pin@0.2.2 lookup (npm package with provenance, also in the official MCP Registry as io.github.GautamTalksDev/mcp-pin). Its four tools are read-only and return no third-party text. The only network request is a GET of https://mcp-pin.gautamkhosla.com/api/servers.json. The SessionStart hook runs a Node script that reads local MCP config to list server names, makes no network call and changes nothing. Full disclosure in plugins/mcp-pin/README.md; privacy policy in PRIVACY.md.

This issue was filed with help from an AI assistant (Claude Code) at the maintainer's request.

Submission checklist

The plugin lives in a public GitHub repository.
The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
This submission follows this repository's contribution, security, and responsible AI policies.
This plugin is not already listed in the Awesome Copilot marketplace.

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

View workflow run · Download full quality gate logs

Plugin: mcp-pin
Repository: http://github.com/GautamTalksDev/mcp-pin
SHA: 4af6b8a7fff0b377ff055f5648a01141c8a131b5

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	33 day(s)
Repository activity	0 watchers; 0 forks
Repository counts	3 stars · 0 watchers · 0 forks · 1 open issues/PRs
Homepage heuristics	⚠️ pricing

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

spec compliance: pass
vally lint: pass
install smoke test: pass
version match: pass
ref/sha consistency: not_run
canvas structure: not_run
overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ mcp-pin (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-YrN4KD/copilot-home/.copilot/installed-plugins/external-plugin-intake/mcp-pin/plugin.json.

Version match output

- 4af6b8a7fff0b377ff055f5648a01141c8a131b5: matched version "0.2.2" at "plugins/mcp-pin/plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "mcp-pin",
  "description": "Know when an MCP server's tools change after you approved them: read-only lookup tools against a public log of tool definition changes, a skill for checking servers and explaining blocks, and a session-start note listing local servers that run without mcp-pin.",
  "version": "0.2.2",
  "author": {
    "name": "Gautam Khosla",
    "url": "http://github.com/GautamTalksDev"
  },
  "repository": "http://github.com/GautamTalksDev/mcp-pin",
  "homepage": "https://mcp-pin.gautamkhosla.com",
  "license": "MIT",
  "keywords": [
    "mcp",
    "security",
    "tool-poisoning",
    "rug-pull",
    "supply-chain"
  ],
  "source": {
    "source": "github",
    "repo": "GautamTalksDev/mcp-pin",
    "path": "plugins/mcp-pin",
    "sha": "4af6b8a7fff0b377ff055f5648a01141c8a131b5"
  }
}

/rerun-intake

Navigation Menu

Repository navigation

[External Plugin]: mcp-pin #4542

Plugin name

Short description

GitHub repository

Plugin path inside the repository

Ref to review

Commit SHA to review

Version

License identifier

Author name

Author URL

Homepage URL

Keywords

Additional notes for reviewers

Submission checklist

✅ External plugin intake passed

Reviewer signals

Quality gate summary

Canonical external.json payload

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[External Plugin]: mcp-pin #4542

Description

Plugin name

Short description

GitHub repository

Plugin path inside the repository

Ref to review

Commit SHA to review

Version

License identifier

Author name

Author URL

Homepage URL

Keywords

Additional notes for reviewers

Submission checklist

Activity

github-actions commented on Oct 6, 2026

github-actions commented on Oct 6, 2026

✅ External plugin intake passed

Reviewer signals

Quality gate summary

Canonical external.json payload

GautamTalksDev commented on Oct 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions