Rubric
How we grade
A PlugVet grade is a hygiene check of a skill, plugin or MCP server. It is a public note of what we looked at, and what we found, on a given date.
Grades are a hygiene check, not a security guarantee. We say "no issues found" when that is what the checks showed. We do not say a grade makes something safe forever.
The five grades
There is no E. The set is A, B, C, D and F. Each grade has a letter, a shape and its own colour. The shape still works in grey. The logo is magenta, and magenta is never a grade. Spark yellow is a small accent on the site, and it is never a grade.
A, Clean
Shield
No issues found. Safe to install.
B, Solid
Circle
Minor issues only. Low risk, worth a quick read.
C, Mixed
Hexagon
Some concerns. Read the report before installing.
D, Risky
Triangle
Serious risks found. Only try it in a sandbox.
F, Fail
Octagon
Fail. Do not install.
What we check
Every entry gets the same six checks. A grader can add a further check, but these six are always there.
Permissions
Files, shell, browser, and anything else the item can touch.
Install and update
Install scripts, extra downloads, and binaries the description does not mention.
Network
Hosts it can reach, and whether the description names them.
Secrets
Tokens, keys, environment variables and ssh material.
Agent instructions
Hidden goals, orders to ignore earlier instructions, and orders to hide a step.
Obfuscation
Encoded blobs in an item that should be readable.
How the letter is chosen
- A. Every check is a pass. No issues on the list.
- B. Only notes, and nothing stronger. Minor issues, worth a quick read.
- C. At least one concern, and nothing serious or a fail. Read the report before installing.
- D. At least one serious result, and no fail. Sandbox only.
- F. Any fail. Do not install.
The words on a check mean:
- Pass. Nothing to add on that check.
- Note. Minor. Worth a glance.
- Concern. Read this before you install.
- Serious. A real risk. A sandbox is the only sensible place to try it.
- Fail. Do not install.
We can hold a grade back if the evidence is too thin to call. We never raise a grade because someone paid. A sponsor label, if one appears later, sits next to the grade. It does not replace it.
What a grade is not
- It is not a penetration test, and we do not run the item with your credentials.
- It is not a promise that we found every problem.
- It is not a watch on later commits. The date on the page is part of the result.
- It is not for sale. Items graded D or F cannot take a paid slot.
Appeals
A queue for grade appeals is not open yet. When real grades are published, the way to challenge one will be written here, with the date of any change.
The twelve entries in the directory are example data. Their letters follow this rubric so the layout can be judged. They are not reviews of real software.