Security Model

A checked plugin matched marketplace policy at a pinned source commit and has validation context available for inspection. It does not mean the plugin is guaranteed safe.

Automated

automated

Maintainer reviewed

reviewed

Awaiting review

awaiting review

Automated validation is separate from maintainer approval.

Risk labels should describe actual behavior: network access, filesystem access, command execution, auth requirements, external mutations, telemetry, scanner coverage, and update changes.

Validation may use manifest checks, Semgrep, plugin-scanner with Cisco coverage, ClamAV malware evidence, npm audit, OSV Scanner, OpenSSF Scorecard, Gitleaks, SBOM generation, license policy, provenance checks, MCP fingerprints, Docker sandbox smoke checks, and diff checks. Missing strict coverage blocks publication.

Codex Commons records plugin-scanner score, grade, max severity, and findings as external evidence. It informs review and auto-publication, but Codex Commons policy remains the source of marketplace decisions.

Malware scanner findings block publication and maintainer approval cannot override them. Canary tests use the harmless EICAR anti-malware test file instead of real malware samples.

Runtime dependencies are checked separately from plugin source. Remote MCP and HTTP API dependencies need verified source/provenance; downloadable dependencies need pinned versions, lockfiles, or full git SHAs.

The public audit log shows sanitized submission status, risk, hard/review/advisory blockers, scanner health, dependency counts, and review events. Raw scanner output and secret values are not public.

Maintainers use a private review queue for submissions that need action. Hard blockers cannot be approved; review blockers need a written reason before approval.

A reachable endpoint only proves that something answered without user secrets. Source-reviewed means Codex Commons has source/provenance metadata tied to a pinned commit or version.

Maintainers can quarantine or revoke listings for suspicious behavior, misleading metadata, unavailable source, broken validation context, dependency risk, or policy violations. Revoked listings are not installable recommendations.

Review the source repository, pinned commit, plugin path, manifest, risk labels, validation report, review history, and any remote service privacy or terms links before installing.