Every entry is reviewed for source-backed identity and metadata completeness before it lands. We surface the trust signals you'd look for yourself — not malware verdicts. Always read the source before installing anything that touches your filesystem, network, or credentials.
Last rebuilt 2026-07-12 00:00 UTC
These notes define the public labels used across entries, exports, and reports. They are editorial metadata checks for source identity, install caution, and registry completeness. These checks are not a guarantee that upstream code is safe, and they are not malware scans or vulnerability assessments.
Trusted means a maintainer reviewed the listing metadata and source backing. Review, limited, and blocked are caution states that ask readers to inspect the source before installing. A trust badge is not an endorsement or runtime security guarantee.
Source-backed means the listing has a reachable repository, package registry, official documentation, or project source URL that supports the claimed identity. We do not infer source backing from marketing copy alone.
Risk-bearing categories should explain execution, filesystem access, network access, credentials, destructive actions, background workers, or account-write behavior before a user runs them.
Privacy notes call out local files, prompts, credentials, telemetry, third-party services, logs, retention, or user-data exposure so readers can decide whether a resource fits their threat model.
Checksums pin hosted downloads byte-for-byte. Package verification means maintainers reviewed the package metadata and source path for the listed artifact. It is not a code audit, malware verdict, or proof that future releases are safe. Community PRs cannot mark packages as verified.
Reviewed and verified dates show the last source or metadata check we recorded. Older checks are still useful provenance, but stale entries should be rechecked before install or citation.
Lowest-scoring entries by completeness and trust signals.
Solid entries with one or two recommendations.
Build freshness and item counts for every public feed.
Every public registry artifact ships with a SHA-256 and build timestamp. Verify against /api/registry/integrity.
/data/directory-index.json3019.6 KBc1a53c3c5cfbdc560d82174d52e6f51d28648e96760d7a73b3d78a5856256ae12026-07-12 00:00/data/search-index.json2187.2 KBbabf4b14c1e34fc6b925e7cf9bba68843b8de85fba4a6dfe443a48a29a8077512026-07-12 00:00/data/raycast-index.json1516.8 KBda5a237bd9b6148a869ed1ebf6d70feb446217f6004db8fa185f97c7ace8c86b2026-07-12 00:00/data/ecosystem-feed.json2557.7 KB0010835975631e95aed627e9712c269fc136deca0c1feb3bd03ee22709fb1f262026-07-12 00:00/data/mcp-registry-feed.json444.8 KBe67a94f12c7cb50e5de09f2ac24356a5d7d8cc58c9e965cb16bf6b41d981668a2026-07-12 00:00/data/plugin-export-feed.json707.6 KBba1bd3c168b4c2e2e7f8f7a058f068298b3fdcf67d814f1a62d46f14579758432026-07-12 00:00/data/registry-changelog.json674.0 KBa3df68a84f882b12ab41ee19305dc8eed8315bb4f3c0dadc828989b99183e1ec2026-07-12 00:00/data/relation-graph.json2053.4 KBd89bd34f654c9dee48142b6e1feb00d419afc1974de79e4d28e9185e2ca111072026-07-12 00:00/data/registry-trust-report.json875.7 KBef450f10c6e425b7f86a96c0dfffd04b1b3a752e4f27c9335cac87ac8352019c2026-07-12 00:00/data/feeds/index.json2.3 KB21ce5139ded2f33568480dea62933c743d2f96161d2a9f5cb39b13cd0b9e8aef2026-07-12 00:00/data/submission-spec.json25.0 KB8b45dc3b81df6ede39b5b87765c7110a14a07304f604955189a8775196db9f9b2026-07-12 00:00/data/content-quality-report.json947.4 KB18d2beda6f6997564a156841b150e822beec81ea82f8bc19237d852899e2d3c52026-07-12 00:00Additions, updates, and removals from the public registry feed.
tools/localaiskills/maoxuan-product-agenttools/prompt-flowtools/txtaitools/unslothtools/atomic-agentsEach signal is binary at the entry level. Category scores are averages.
Wrong metadata, stale source, broken install command? Authors and readers can both flag it.
Coverage shifts, new safety notes, and what landed each week.