Overview
A free, vendor-scored catalogue of installable coding-agent plugins across Claude Code, Codex, Cursor, MCP, Grok, Kimi Code, DeepSeek Harness, Antigravity CLI, and OpenCode. Genuinely useful for discovery; its security signals are static catalogue scans, not install guarantees.
Key features
- One catalogue spanning Claude Code, Codex, Cursor, Grok, Kimi Code, DeepSeek Harness, Antigravity CLI, OpenCode, and MCP
- Trust score blending identity, activity, and verification signals, sortable by newest or featured
- Scanner-backed signals documented publicly, including secret scanning and provenance checks where available
- Per-plugin pages with runtime-specific install commands and named publishers
- Free GitHub-connected submission that opens a pull request on the list the catalogue ingests
- Daily plugin launch feed
- Published plugin-security dataset on Hugging Face stating its own scope and row counts
Trial checklist
Use a real task, not a browse: search for one plugin you already run and one gap in your agent setup. Note whether the install command, publisher identity, and trust signals tell you anything you did not already know from the plugin's own repository. Then submit one of your own public repos through the free flow and see what it actually requires. Pay particular attention to the fallback static scan caveat. Compare the result against simply searching GitHub before deciding.
Use category-specific evidence
SWE-bench Verified [3] ↗ · Terminal-Bench 2.1 leaderboard (frozen; subdomain now serves 4.0) [6] ↗ · LiveBench [4] ↗ · Artificial Analysis methodology [5] ↗
Benchmark numbers are evidence for a specific task and configuration, not a universal product score. See benchmark policy →
Pricing
Current official summary: Free. Browsing the plugin catalogue and submitting a public plugin repository cost nothing - stated in the catalogue's own FAQ ("list your public repository for free") and in the live https://hol.org/plugins/llms.txt, which sells nothing. No paid tier exists for the catalogue itself; paid credits apply to other HOL registry operations, and HOL Guard is a separately priced product with its own plans. Verified 2026-10-14 from the live /plugins/llms.txt plus the archived catalogue page, because live catalogue HTML is served behind a Cloudflare challenge and returned 403 to every scripted client.
Open verification questions
- No general site-wide Terms of Service was located. The footer link labelled "Terms of Service" resolves to https://hol.org/points/legal/terms (a points-programme legal page) in both the live app shell and the archived pages, and that page's actual scope could not be read because live HTML is Cloudflare-challenged. Treat the recorded rights_url as the only terms link found, not as confirmed coverage of the catalogue.
- Catalogue size disagrees between HOL's own surfaces: the archived catalogue page (2026-08-31) read "Showing 243 plugins across 16 ecosystems" while the live /plugins/llms.txt says "205 catalog plugins". The listing therefore quotes no figure.
- Retention periods and named subprocessors are asserted in the privacy summary ("the complete policy names categories of providers and explains ... retention") but the full Privacy Policy, stated as last updated 2026-06-29, could not be read from this host. Retention and processor specifics are unverified.
- Security scoring is a fallback static catalogue scan, not a live exploit test - disclosed by the site itself in its FAQ and llms.txt. Any trust score should be read as a weak signal, and the listing's pros/cons say so.
- The privacy summary warns that information written to a public blockchain can be visible to third parties and may be permanent even after an off-chain account is deleted. This applies to HOL Points and registry features rather than the plugin catalogue, but is not itemised per product.
Submitted via the site form by the vendor (name "HOL Plugins", url https://hol.org/plugins, category Development, contact michael@hol.org) - FormSubmit mail timestamped Thu, 2026-10-15 00:22 UTC, i.e. 2026-10-14 in the site's Pacific working date. Editorial entry written independently; no vendor copy reused and no revenue figure inferred. Operator identity verified twice: (1) the site's own About and Contact pages state that "Hashgraph Online DAO LLC operates hol.org", give the business address 852 Long Island Rd, Majuro 96960, Marshall Islands, and publish +1 347-705-7394 and support@hol.org; (2) independently, the GitHub organisation "hashgraph-online" (display name "HOL (Hashgraph Online)", 66 public repositories, created 2024-02-18) lists hol.org as its blog, Marshall Islands as its location and support@hol.org as its email, and its hol-guard repository lists https://hol.org/guard as its homepage (Apache-2.0, 896 stars, last pushed 2026-10-15). Submitted contact michael@hol.org is a real mailbox: SMTP RCPT probe against the domain's own Google Workspace MX returned 250 2.1.5 OK, while a random local part returned 550 5.1.1, proving the domain is not a catch-all. Provenance limits, stated plainly: hol.org serves its HTML, its sitemap.xml, its OpenAPI document and its live API endpoints behind a Cloudflare challenge (403 to every scripted client; only the llms.txt surfaces load), and the interactive browser was unavailable on this host, so the catalogue, About, Contact and Privacy pages were read from Wayback snapshots (catalogue 2026-08-31; About 2026-09-19; Contact 2026-09-19; Privacy 2026-09-24) and cross-checked against the live surfaces that do load: /plugins/llms.txt, /guard/llms.txt, robots.txt and the live 404 app shell, which carries the site's full navigation. Ownership is not in question on any reading.
Pricing changes often — verify current plans on the official site before buying. Dated snapshots: Pricing Watch.
Use cases
- Finding plugins for one specific coding agent (Claude Code, Codex, Cursor, MCP clients)
- Comparing plugins by publisher and verification signals before installing
- Listing your own public plugin repository without paying
- Following new plugin launches inside one ecosystem
- Checking provenance before adding a plugin to an agent config
Pros
- Free to browse and free to submit a listing — stated on its own catalogue FAQ, not just marketing copy
- Operator is named on the site (Hashgraph Online DAO LLC) with a published business address and telephone
- Nine ecosystems in one catalogue, including skills, MCP servers, and apps
- Unusually candid about limits: "a scan is not a safety guarantee" appears in the catalogue, not buried
- Sponsored and featured placements are documented as not changing organic rank
- Open-source backing — HOL Guard's core is Apache-2.0 and the org runs 66 public repositories
Cons
- Trust and security scores come from a fallback static catalogue scan, not live exploit testing, so a high score is a weak signal
- Catalogue size disagrees between its own surfaces (243 plugins on the 2026-08-31 catalogue page vs 205 in the current llms.txt)
- No general site-wide Terms of Service page was found — the footer's "Terms of Service" opens the HOL Points legal page
- Operator is a Marshall Islands DAO LLC, an offshore jurisdiction, and the domain registrant is privacy-shielded in WHOIS
- Live catalogue HTML sits behind a Cloudflare challenge, which blocks scripted readers and some agent clients
- Community upvotes and GitHub activity are surfaced as proof signals but measure popularity, not quality
- The wider HOL platform is Hedera-backed and some records are written to public chains — permanent and visible by design
Who HOL Registry is for
HOL Registry is aimed at teams and individuals who need discovering and comparing installable claude code, codex, cursor, and mcp plugins with publisher and trust signals. It is designed for development workflows where output quality, adoption effort, and operating cost all matter. Compare alternatives first if you require self-hosting, unusually deep customization, or tighter policy controls than the official plan provides.
Buying decision
| Keep it when | discovering and comparing installable Claude Code, Codex, Cursor, and MCP plugins with publisher and trust signals is the job you repeat. |
|---|---|
| Test first when | Trust and security scores come from a fallback static catalogue scan, not live exploit testing, so a high score is a weak signal. |
| Before you pay | Run the trial checklist and check the current plan limit on the official pricing page. |
Verdict
The call: HOL Registry has an AIToolsEssentials editorial score of 4.0/5. Free to browse and free to submit a listing — stated on its own catalogue FAQ, not just marketing copy. Price this before you renew: trust and security scores come from a fallback static catalogue scan, not live exploit testing, so a high score is a weak signal.
Run one real task from your work this week. That tells you more than this review.
How HOL Registry compares
In development, HOL Registry sits next to Bolt.new, CCC (Claude Command Center), Cursor and 4 others. The useful part is free to browse and free to submit a listing — stated on its own catalogue faq, not just marketing copy. The part to price first is trust and security scores come from a fallback static catalogue scan, not live exploit testing, so a high score is a weak signal. Read the side-by-side before you pay for a second seat.
How we evaluated
The AIToolsEssentials rating is an editorial score—not an external benchmark. It summarizes job fit, likely output quality, ease of adoption, and operational cost using published product information, benchmark context where the exact model is identifiable, and the repeatable trial checklist above. Benchmarks never determine the final product rating by themselves. See our editorial methodology, evidence ledger, and benchmark evidence policy.
Frequently asked questions
Is HOL Registry free?
Yes — browsing is free and submitting a public plugin repository is free. Paid credits apply to other HOL registry operations, and HOL Guard is a separate paid product.
Do the trust scores mean a plugin is safe?
No, and the site says so itself. Scores come from a fallback static catalogue scan, not a live exploit test, so treat them as one weak signal among several.
How is this different from a plain MCP server list?
It indexes plugins, skills, MCP servers, and apps per ecosystem, and keeps catalogue plugin counts separate from its Registry Broker agent counts.
Who runs it?
Hashgraph Online DAO LLC (HOL), a Hedera-ecosystem organisation. It publishes a Marshall Islands business address, a phone number, and support@hol.org.
Cite or embed this audit
The badge links to this review. It is a dated price receipt, not a ranking and not a paid placement.
