[External Plugin]: mcp-pin

[GautamTalksDev]

Plugin name

mcp-pin

Short description

Know when an MCP server's tools change after you approved them: read-only lookup tools against a public log of tool definition changes, a skill for checking servers and explaining blocks, and a session-start note listing local servers that run without mcp-pin.

GitHub repository

GautamTalksDev/mcp-pin

Plugin path inside the repository

plugins/mcp-pin

Ref to review

No response

Commit SHA to review

4af6b8a7fff0b377ff055f5648a01141c8a131b5

Version

0.2.2

License identifier

MIT

Author name

Gautam Khosla

Author URL

https://github.com/GautamTalksDev

Homepage URL

https://mcp-pin.gautamkhosla.com

Keywords

mcp
security
tool-poisoning
rug-pull
supply-chain

Additional notes for reviewers

The plugin starts one local MCP server, npx -y mcp-pin@0.2.2 lookup (npm package with provenance, also in the official MCP Registry as io.github.GautamTalksDev/mcp-pin). Its four tools are read-only and return no third-party text. The only network request is a GET of https://mcp-pin.gautamkhosla.com/api/servers.json. The SessionStart hook runs a Node script that reads local MCP config to list server names, makes no network call and changes nothing. Full disclosure in plugins/mcp-pin/README.md; privacy policy in PRIVACY.md.

This issue was filed with help from an AI assistant (Claude Code) at the maintainer's request.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

View workflow run · Download full quality gate logs

• Plugin: mcp-pin

• Repository: https://github.com/GautamTalksDev/mcp-pin

• SHA: 4af6b8a7fff0b377ff055f5648a01141c8a131b5

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	33 day(s)
Repository activity	0 watchers; 0 forks
Repository counts	3 stars · 0 watchers · 0 forks · 1 open issues/PRs
Homepage heuristics	⚠️ pricing

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: not_run
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ mcp-pin (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-YrN4KD/copilot-home/.copilot/installed-plugins/external-plugin-intake/mcp-pin/plugin.json.

Version match output

- 4af6b8a7fff0b377ff055f5648a01141c8a131b5: matched version "0.2.2" at "plugins/mcp-pin/plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "mcp-pin",
  "description": "Know when an MCP server's tools change after you approved them: read-only lookup tools against a public log of tool definition changes, a skill for checking servers and explaining blocks, and a session-start note listing local servers that run without mcp-pin.",
  "version": "0.2.2",
  "author": {
    "name": "Gautam Khosla",
    "url": "https://github.com/GautamTalksDev"
  },
  "repository": "https://github.com/GautamTalksDev/mcp-pin",
  "homepage": "https://mcp-pin.gautamkhosla.com",
  "license": "MIT",
  "keywords": [
    "mcp",
    "security",
    "tool-poisoning",
    "rug-pull",
    "supply-chain"
  ],
  "source": {
    "source": "github",
    "repo": "GautamTalksDev/mcp-pin",
    "path": "plugins/mcp-pin",
    "sha": "4af6b8a7fff0b377ff055f5648a01141c8a131b5"
  }
}

[GautamTalksDev]

/rerun-intake