Skip to content

Sigistry Plugin & Skill Catalog

by sigistry.com · remote · no sign-in to list tools · v1.5.0 · published by com.sigistry

Search verified Claude Code plugins and skills; fetch portable SKILL.md sources. Read-only.

Read only
CompareRegistry entry

9 tools: 9 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http plugin-catalog https://sigistry.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Only reads 9Claude Code: allow
  • check_mcp_appGet the Sigistry MCP App safety criteria to audit an MCP App (MCP Apps / SEP-1865: a tool that returns an interactive ui:// HTML resource the host renders in a sandboxed iframe) BE…No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get the Sigistry MCP App safety criteria to audit an MCP App (MCP Apps / SEP-1865: a tool that returns an interactive ui:// HTML resource the host renders in a sandboxed iframe) BEFORE shipping it. Returns two groups of checks: spec conformance (ui:// scheme, the text/html;profile=mcp-app mimeType, tool-to-UI linkage via _meta.ui.resourceUri, a text fallback, visibility values, and CSP coverage of external origins) and security hygiene the iframe sandbox does not cover (unsafe DOM sinks, embedded secrets, host-message origin handling, remote scripts). Call this when the user is building or reviewing an MCP App; then apply each check to the app source you have in context and report findings. Nothing is sent to this server; an interactive browser version is at https://sigistry.com/mcp-app-checker.

    Annotations the server declares

    • title: Check an MCP App for safety
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_pluginGet the full details of a single Sigistry plugin by its id, including install commands, component counts, and its security-audit result (per-check pass/fail from the Verified by Si…No findings

    Why it is in this group

    • The name "get_plugin" says "get": a word for reading.
    Description, as the server wrote it
    Get the full details of a single Sigistry plugin by its id, including install commands, component counts, and its security-audit result (per-check pass/fail from the Verified by Sigistry methodology).

    Annotations the server declares

    • title: Get a Claude Code plugin
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_scorecardGet the full scorecard for one graded MCP server by its id: the overall grade, per-axis pass/partial/fail with cited evidence, hardening notes, the rubric version, and the exact co…No findings

    Why it is in this group

    • The name "get_scorecard" says "get": a word for reading.
    Description, as the server wrote it
    Get the full scorecard for one graded MCP server by its id: the overall grade, per-axis pass/partial/fail with cited evidence, hardening notes, the rubric version, and the exact commit graded. Grades describe the pinned commit only; a re-grade at a newer commit can be requested via an issue on the marketplace repo.

    Annotations the server declares

    • title: Get an MCP server scorecard
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_skillGet one Sigistry skill by name, including the full raw SKILL.md source.No findings

    Why it is in this group

    • The name "get_skill" says "get": a word for reading.
    Description, as the server wrote it
    Get one Sigistry skill by name, including the full raw SKILL.md source. The source is portable: it can be applied directly in any SKILL.md-aware agent (Claude Code, Claude Desktop, and others) without installing anything, or installed natively in Claude Code via the parent plugin, which keeps it verified and updated. The returned skill passed the Sigistry skill-safety check at the parent plugin's verification date.

    Annotations the server declares

    • title: Get a verified skill
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_categoriesList the distinct plugin categories in the Sigistry marketplace with a count of plugins in each, plus the total plugin count.No findings

    Why it is in this group

    • The name "list_categories" says "list": a word for reading.
    Description, as the server wrote it
    List the distinct plugin categories in the Sigistry marketplace with a count of plugins in each, plus the total plugin count.

    Annotations the server declares

    • title: List plugin categories
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_scorecardsList the public MCP servers Sigistry has independently graded against its scorecard rubric (transport, stateless core, lifecycle, authorization, tool design, security hygiene), eac…No findings

    Why it is in this group

    • The name "list_scorecards" says "list": a word for reading.
    Description, as the server wrote it
    List the public MCP servers Sigistry has independently graded against its scorecard rubric (transport, stateless core, lifecycle, authorization, tool design, security hygiene), each with an overall grade A-F and the exact commit graded. Useful before connecting an agent to a third-party MCP server: check whether it has been assessed and how it scored. Use get_scorecard for the full per-axis breakdown.

    Annotations the server declares

    • title: List MCP server scorecards
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_pluginsSearch the Sigistry marketplace of Claude Code plugins by keyword and/or category.No findings

    Why it is in this group

    • The name "search_plugins" says "search": a word for reading.
    Description, as the server wrote it
    Search the Sigistry marketplace of Claude Code plugins by keyword and/or category. Returns matches with their install command and verification status (the registry runs an eight-check security audit; prefer "verified" plugins when recommending an install).

    Annotations the server declares

    • title: Search Claude Code plugins
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_skillsSearch the Sigistry catalog of verified skills (SKILL.md instruction sets for AI agents) by keyword, optionally filtered to one parent plugin.No findings

    Why it is in this group

    • The name "search_skills" says "search": a word for reading.
    Description, as the server wrote it
    Search the Sigistry catalog of verified skills (SKILL.md instruction sets for AI agents) by keyword, optionally filtered to one parent plugin. Every skill passed the skill-safety check: no command shadowing, honestly-scoped triggers, no injection or concealment language, no unsafe scripts. Use get_skill to fetch the full portable source of a match.

    Annotations the server declares

    • title: Search verified skills
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_pluginGet the recipe to run the Sigistry verification methodology (the eight static checks that gate the Verified badge: manifest integrity, hook safety, agent tool scopes, command hygie…No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get the recipe to run the Sigistry verification methodology (the eight static checks that gate the Verified badge: manifest integrity, hook safety, agent tool scopes, command hygiene, skill structure, skill safety, no secrets, documentation) against a plugin BEFORE publishing it. The verification runs entirely on the local machine via a dependency-free open-source Node script; the plugin code never leaves the user's computer and this server performs no computation. Call this when the user wants their plugin or skill checked, then follow the returned steps: download the script, run it against the plugin directory, and fix any FAIL findings it reports.

    Annotations the server declares

    • title: Verify a Claude Code plugin
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http plugin-catalog https://sigistry.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__plugin-catalog__search_plugins",
      "mcp__plugin-catalog__get_plugin",
      "mcp__plugin-catalog__list_categories",
      "mcp__plugin-catalog__search_skills",
      "mcp__plugin-catalog__get_skill",
      "mcp__plugin-catalog__list_scorecards",
      "mcp__plugin-catalog__get_scorecard",
      "mcp__plugin-catalog__verify_plugin",
      "mcp__plugin-catalog__check_mcp_app"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as plugin-catalog. Review it before you use it.