The plugin you reviewed is not always the code that runs.
Claude Code marketplaces pin plugins to a commit. Often that pin covers a wrapper, while the thing that actually executes is fetched from the network at launch — from a branch, or from @latest. Plugrade reads what plugins actually ship, and watches what changes after you install them.
First audit, publishing August 2026
Twelve plugins read line by line, nine of them from the official directory. No malware and nothing hidden — but six fetch code over the network when they start, and one plugin with roughly 88,500 installs is six lines of config pointing at a branch.
What this is
- Audits with evidence. Every finding cites a file and a line at a fixed commit, and gets checked by a second reviewer whose job is to throw it out.
- What a plugin costs before you install it. Skill count and the context tokens it adds to every session — the number you feel two months and eight plugins later.
- A daily record of the directory.Install counts captured every morning, so “what changed” is answerable rather than guessed at.
Not built yet, in this order: change alerts when an installed plugin’s hooks or source move, and with/without benchmarks measuring whether a plugin actually helps. Both are on the record so you can hold me to them.