Barnburner121 Plugin Hub MCP Server
@barnburner121/plugin-hub-mcp
npm
v4.2.2
Published by @barnburner121 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The largest Claude Code plugin marketplace. 500 plugins, 600+ developer tools in one MCP server. Security, testing, DevOps, CI/CD, databases, frontend, backend, API design, ML/AI, mobile, cloud, serverless, authentication, monitoring, and more.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Package runs install-time scripts MTC-SUP-010 | supply-chain |
2. Client adoption risk — 99 − 4 = 95. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
high Reads a sensitive credential path or dumps the environment (dist/tools/workspace-setup.js)MTC-SRC-006
In the server's implementation (`dist/tools/workspace-setup.js:19`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ng all packages. Include .npmrc and workspace protocol dependencies.`, }, null, 2),
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/workspace-setup.js
low Package runs install-time scripts (postinstall)MTC-SUP-010
"@barnburner121/plugin-hub-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.
Evidence: tsc || true
Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.
Location: package @barnburner121/plugin-hub-mcp
Tools 200
Each tool and what it can reach — statically extracted from the published source.
blog_add_rssingests untrusted inputa11y_add_ariano sensitive capabilitya11y_generate_reportno sensitive capabilitya11y_scan_htmlno sensitive capabilityalert_generate_pagerdutyno sensitive capabilityalert_generate_prometheusno sensitive capabilityalert_generate_runbooksno sensitive capabilityanon_create_scriptno sensitive capabilityanon_detect_piino sensitive capabilityanon_generate_rulesno sensitive capability
Show 190 more tools ↓
api_benchmarkno sensitive capabilityapi_contract_testno sensitive capabilityapi_create_mockno sensitive capabilityapi_generate_testsno sensitive capabilityapidep_generate_warningsno sensitive capabilityapidep_migration_guideno sensitive capabilityapidep_scanno sensitive capabilityapikey_add_rotationno sensitive capabilityapikey_add_scopingno sensitive capabilityapikey_generate_systemno sensitive capabilityarch_analyze_structureno sensitive capabilityarch_generate_diagramno sensitive capabilityarch_generate_docsno sensitive capabilityaudit_add_triggersno sensitive capabilityaudit_generate_schemano sensitive capabilityaudit_query_builderno sensitive capabilityauth_audit_securityno sensitive capabilityauth_generate_jwtno sensitive capabilityauth_generate_oauthno sensitive capabilityauth_generate_sessionno sensitive capabilitybatch_add_checkpointsno sensitive capabilitybatch_add_progressno sensitive capabilitybatch_generate_processorno sensitive capabilityblog_add_seono sensitive capabilityblog_generate_setupno sensitive capabilitybooking_add_availabilityno sensitive capabilitybooking_add_remindersno sensitive capabilitybooking_generate_systemno sensitive capabilitybundle_analyze_sizeno sensitive capabilitybundle_find_heavy_depsno sensitive capabilitybundle_optimizeno sensitive capabilitycache_design_strategyno sensitive capabilitycache_generate_redisno sensitive capabilitycache_invalidation_setupno sensitive capabilitycal_add_syncno sensitive capabilitycal_generate_uino sensitive capabilitycal_setup_apino sensitive capabilitycb_add_fallbacksno sensitive capabilitycb_configure_thresholdsno sensitive capabilitycb_generate_patternno sensitive capabilitycf_add_kv_storageno sensitive capabilitycf_configure_routesno sensitive capabilitycf_generate_workerno sensitive capabilitychangelog_formatno sensitive capabilitychangelog_from_commitsno sensitive capabilitychangelog_from_prsno sensitive capabilitycli_add_commandsno sensitive capabilitycli_add_helpno sensitive capabilitycli_generate_scaffoldno sensitive capabilityclidocs_generate_helpno sensitive capabilityclidocs_generate_manpageno sensitive capabilityclidocs_generate_markdownno sensitive capabilitycliprogress_add_multibarno sensitive capabilitycliprogress_add_spinnersno sensitive capabilitycliprogress_generate_barsno sensitive capabilitycliprompt_add_themesno sensitive capabilitycliprompt_add_validationno sensitive capabilitycliprompt_generate_wizardno sensitive capabilityclitest_add_mocksno sensitive capabilityclitest_add_snapshotsno sensitive capabilityclitest_generate_suiteno sensitive capabilitycms_add_previewno sensitive capabilitycms_generate_typesno sensitive capabilitycms_setup_headlessno sensitive capabilitycomment_add_moderationno sensitive capabilitycomment_add_threadingno sensitive capabilitycomment_generate_systemno sensitive capabilitycommit_setup_conventionalno sensitive capabilitycommit_setup_huskyno sensitive capabilitycommit_validate_historyno sensitive capabilitycomplexity_analyzeno sensitive capabilitycomplexity_reportno sensitive capabilitycomplexity_suggest_simplificationsno sensitive capabilitycompose_add_serviceno sensitive capabilitycompose_generateno sensitive capabilitycompose_optimizeno sensitive capabilitycompress_add_staticno sensitive capabilitycompress_optimizeno sensitive capabilitycompress_setup_gzipno sensitive capabilitycontainer_audit_dockerfileno sensitive capabilitycontainer_optimize_imageno sensitive capabilitycontainer_scan_composeno sensitive capabilitycontainer_security_reportno sensitive capabilitycookie_add_preferencesno sensitive capabilitycookie_generate_bannerno sensitive capabilitycookie_generate_policyno sensitive capabilitycors_analyze_configno sensitive capabilitycors_generate_middlewareno sensitive capabilitycors_generate_policyno sensitive capabilitycost_analyze_infrano sensitive capabilitycost_generate_reportno sensitive capabilitycost_optimize_databaseno sensitive capabilitycost_optimize_dockerno sensitive capabilitycoverage_analyze_gapsno sensitive capabilitycoverage_reportno sensitive capabilitycoverage_suggest_testsno sensitive capabilitycss_find_duplicatesno sensitive capabilitycss_find_unusedno sensitive capabilitycss_optimizeno sensitive capabilitydata_generate_edge_casesno sensitive capabilitydata_generate_from_schemano sensitive capabilitydata_generate_realisticno sensitive capabilityddb_design_tableno sensitive capabilityddb_generate_gsino sensitive capabilityddb_optimize_queriesno sensitive capabilitydead_cleanup_planno sensitive capabilitydead_find_unused_exportsno sensitive capabilitydead_find_unused_importsno sensitive capabilitydead_find_unused_varsno sensitive capabilitydep_auditno sensitive capabilitydep_license_checkno sensitive capabilitydep_outdatedno sensitive capabilitydep_update_planno sensitive capabilitydevcontainer_add_extensionsno sensitive capabilitydevcontainer_configureno sensitive capabilitydevcontainer_generateno sensitive capabilitydocs_generate_openapino sensitive capabilitydocs_generate_swagger_uino sensitive capabilitydocs_validate_specno sensitive capabilitydq_add_monitoringno sensitive capabilitydq_generate_checksno sensitive capabilitydq_generate_reportsno sensitive capabilitydr_assess_risksno sensitive capabilitydr_create_runbooksno sensitive capabilitydr_generate_planno sensitive capabilitydup_find_copy_pasteno sensitive capabilitydup_find_similar_blocksno sensitive capabilitydup_suggest_extractionno sensitive capabilitye2e_generate_cypressno sensitive capabilitye2e_generate_playwrightno sensitive capabilitye2e_generate_scenariosno sensitive capabilityemail_generate_htmlno sensitive capabilityemail_generate_reactno sensitive capabilityemail_generate_systemno sensitive capabilityencrypt_key_managementno sensitive capabilityencrypt_setup_atrestno sensitive capabilityencrypt_setup_intransitno sensitive capabilityentitlement_middlewareno sensitive capabilityenv_generate_templateno sensitive capabilityenv_rotate_secretsno sensitive capabilityenv_scan_secretsno sensitive capabilityenv_validateno sensitive capabilityerror_generate_boundaryno sensitive capabilityerror_generate_fallbackno sensitive capabilityerror_setup_reportingno sensitive capabilityerrtrack_custom_contextno sensitive capabilityerrtrack_setup_sentryno sensitive capabilityerrtrack_setup_sourcemapsno sensitive capabilityeslint_add_pluginsno sensitive capabilityeslint_fix_violationsno sensitive capabilityeslint_generate_configno sensitive capabilityetl_design_pipelineno sensitive capabilityetl_generate_transformsno sensitive capabilityetl_schedule_setupno sensitive capabilityexp_add_metricsno sensitive capabilityexp_generate_reportsno sensitive capabilityexp_setup_trackingno sensitive capabilityexpo_add_configno sensitive capabilityexpo_generate_projectno sensitive capabilityexpo_setup_easno sensitive capabilityfeature_flag_systemno sensitive capabilityfeedback_add_analysisno sensitive capabilityfeedback_add_widgetsno sensitive capabilityfeedback_generate_systemno sensitive capabilityflag_ab_test_setupno sensitive capabilityflag_generate_checksno sensitive capabilityflag_setup_systemno sensitive capabilitygenerate_dotnet_configno sensitive capabilitygenerate_dotnet_solutionno sensitive capabilityinvoice_generatorno sensitive capabilitymapper_add_validationno sensitive capabilitymapper_create_layerno sensitive capabilitymapper_generate_transformsno sensitive capabilitymetered_billingno sensitive capabilityplan_limits_configno sensitive capabilityretention_add_automationno sensitive capabilityretention_generate_policyno sensitive capabilityretention_generate_reportno sensitive capabilityscaffold_dotnet_projectno sensitive capabilitysmell_detect_feature_envyno sensitive capabilitysmell_detect_god_classesno sensitive capabilitysmell_detect_long_methodsno sensitive capabilitysmell_refactor_planno sensitive capabilitysplit_add_prefetchno sensitive capabilitysplit_analyze_chunksno sensitive capabilitysplit_generate_configno sensitive capabilitysubscription_billing_setupno sensitive capabilitytrace_add_spansno sensitive capabilitytrace_configure_exportno sensitive capabilitytrace_setup_otelno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v4.2.2 latest |
A 95/100 | 2 | 1.13.0 | 2026-09-09 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @barnburner121/plugin-hub-mcp --onlineMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.