[External Plugin]: BackBond Agent Scan

[CorwinFoundation]

Plugin name

backbond-agent-scan

Short description

Vet proposed MCP and AI-agent tool manifests before attachment with a pinned local deterministic static gate. The skill returns block, review, or no blocking finding without running tools or uploading scan inputs.

GitHub repository

BackBond/agent-scan

Plugin path inside the repository

plugins/backbond-agent-scan

Ref to review

v0.5.14

Commit SHA to review

6c7e728de5defa434f5e3647f80f7d822daba588

Version

0.5.14

License identifier

MIT

Author name

BackBond

Author URL

https://backbond.ai

Homepage URL

https://backbond.ai/agent-scan/

Keywords

mcp-security
agent-security
tool-vetting
pre-attachment
static-analysis

Additional notes for reviewers

This is deliberately a skill-only Agent Plugin: no hooks, commands, or plugin-level MCP configuration. The dedicated marketplace source root contains only plugin metadata and the agent-scan skill. Installing it cannot start a process or run a scan. The manifest explicitly declares the skill path; the skill pins @backbond/agent-scan@0.5.14, treats incomplete evidence as review, and states that output is not a safety determination, runtime attestation, or insurance decision. The npm package has zero runtime and development dependencies; the release publishes provenance and reproducible standalone/package assets.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

⚠️ External plugin intake passed with spec warnings

This submission passed blocking quality checks and is ready for maintainer review, but it has non-blocking Agent Plugins spec compliance warnings.

• Plugin: backbond-agent-scan
• Repository: https://github.com/BackBond/agent-scan
• Ref: v0.5.14
• SHA: 6c7e728de5defa434f5e3647f80f7d822daba588

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	2 day(s)
Repository activity	repository is 2 day(s) old; 0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 0 open issues/PRs
Homepage heuristics	⚠️ checkout

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	⚠️ warning
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: warning
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: pass

spec compliance output (⚠️ warning)

Agent Plugins v1.0.0 manifest warnings:
- top-level field "skills" is not part of Agent Plugins v1.0.0
- schema validation: manifest must NOT have additional properties

vally lint output (✅ pass)

✅ agent-scan (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-S5KcWb/copilot-home/.copilot/installed-plugins/external-plugin-intake/backbond-agent-scan/plugin.json.

Version match output

- v0.5.14: matched version "0.5.14" at "plugins/backbond-agent-scan/plugin.json".
- 6c7e728de5defa434f5e3647f80f7d822daba588: matched version "0.5.14" at "plugins/backbond-agent-scan/plugin.json".

Ref/SHA consistency output

source.ref "v0.5.14" resolves to the same commit as source.sha "6c7e728de5defa434f5e3647f80f7d822daba588".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "backbond-agent-scan",
  "description": "Vet proposed MCP and AI-agent tool manifests before attachment with a pinned local deterministic static gate. The skill returns block, review, or no blocking finding without running tools or uploading scan inputs.",
  "version": "0.5.14",
  "author": {
    "name": "BackBond",
    "url": "https://backbond.ai"
  },
  "repository": "https://github.com/BackBond/agent-scan",
  "homepage": "https://backbond.ai/agent-scan/",
  "license": "MIT",
  "keywords": [
    "mcp-security",
    "agent-security",
    "tool-vetting",
    "pre-attachment",
    "static-analysis"
  ],
  "source": {
    "source": "github",
    "repo": "BackBond/agent-scan",
    "path": "plugins/backbond-agent-scan",
    "ref": "v0.5.14",
    "sha": "6c7e728de5defa434f5e3647f80f7d822daba588"
  }
}

View workflow run