# Sigistry Plugin & Skill Catalog (remote · sigistry.com)

Search verified Claude Code plugins and skills; fetch portable SKILL.md sources. Read-only.

- Trust score: 85/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `sigistry.com`: 85/100 (this document), [markdown](https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry.md), [page](https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry)

## Channel facts

- Endpoint: `https://sigistry.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.5.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 74/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 82/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 766 tokens (~95/item across 8 items; 8 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 90/100
  - Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Sigistry Plugin & Skill Catalog MCP server?

Sigistry Plugin & Skill Catalog is a hosted endpoint at https://sigistry.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-sigistry-plugin-catalog 'https://sigistry.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-sigistry-plugin-catalog": {
      "url": "https://sigistry.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-sigistry-plugin-catalog": {
      "type": "http",
      "url": "https://sigistry.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-sigistry-plugin-catalog]
url = "https://sigistry.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-sigistry-plugin-catalog": {
      "type": "remote",
      "url": "https://sigistry.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-sigistry-plugin-catalog --url 'https://sigistry.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-sigistry-plugin-catalog:
    url: "https://sigistry.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-sigistry-plugin-catalog": {
      "Transport": "http",
      "Url": "https://sigistry.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-sigistry-plugin-catalog -t streamable-http -u 'https://sigistry.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-sigistry-plugin-catalog": {
      "type": "http",
      "url": "https://sigistry.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-17 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 81, 0)

- [functional regression] Schema quality: 574 → 766
- [functional] Server version: 1.5.0 → 1.6.0
- [functional] New tool “get_scorecard”
- [functional] New tool “list_scorecards”

### 2026-09-11 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-09 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-07 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (8)

### `search_plugins` (~86 tokens)

Search Claude Code plugins

Search the Sigistry marketplace of Claude Code plugins by keyword and/or category. Returns matches with their install command and verification status (the registry runs an eight-check security audit; prefer "verified" plugins when recommending an install).

Input parameters:

- `category` (string): e.g. "database", "devops", "git"
- `query` (string): keywords, e.g. "database migration"

Output parameters:

- `results` (array): up to 15 matching plugins, best matches first

### `get_plugin` (~68 tokens)

Get a Claude Code plugin

Get the full details of a single Sigistry plugin by its id, including install commands, component counts, and its security-audit result (per-check pass/fail from the Verified by Sigistry methodology).

Input parameters:

- `id` (string, required): the plugin id, e.g. "sql-safety-net"

Output parameters:

- `agents` (array): relative paths to agent files
- `author` (object)
- `category` (string)
- `commands` (array): relative paths to command files
- `counts` (object): component counts
- `description` (string)
- `homepage` (string)
- `id` (string)
- `installCommand` (string): command to install this plugin
- `installMarketplace` (string): command to add the marketplace to Claude Code
- `license` (string)
- `name` (string)
- `searchableText` (string): lowercased text used for matching
- `skills` (array): relative paths to skill manifests
- `tags` (array): keywords from the marketplace entry
- `verification`: security-audit result for this plugin (null when never audited)
- `version` (string)

### `list_categories` (~32 tokens)

List plugin categories

List the distinct plugin categories in the Sigistry marketplace with a count of plugins in each, plus the total plugin count.

Output parameters:

- `categories` (array): categories sorted by descending plugin count
- `total` (integer): total number of plugins

### `search_skills` (~115 tokens)

Search verified Claude Code skills

Search the Sigistry catalog of verified skills (SKILL.md instruction sets for AI agents) by keyword, optionally filtered to one parent plugin. Every skill passed the skill-safety check: no command shadowing, honestly-scoped triggers, no injection or concealment language, no unsafe scripts. Use get_skill to fetch the full portable source of a match.

Input parameters:

- `plugin` (string): restrict to skills shipped by this plugin id
- `query` (string): keywords, e.g. "changelog" or "security review"

Output parameters:

- `results` (array): up to 20 matching skills, best matches first

### `get_skill` (~120 tokens)

Get a verified skill (with portable source)

Get one Sigistry skill by name, including the full raw SKILL.md source. The source is portable: it can be applied directly in any SKILL.md-aware agent (Claude Code, Claude Desktop, and others) without installing anything, or installed natively in Claude Code via the parent plugin, which keeps it verified and updated. The returned skill passed the Sigistry skill-safety check at the parent plugin's verification date.

Input parameters:

- `name` (string, required): the skill name, e.g. "assessment-scoring" (find names via search_skills)

Output parameters:

- `commit` (string): pinned commit the source is served from, when externally hosted
- `description` (string): the skill trigger: when an agent should load it
- `detailUrl` (string): human-readable page for this skill
- `hosting` (string): "registry" (vendored here) or "external" (author repo, verified at a pinned commit)
- `installCommand` (string): Claude Code command installing the parent plugin (skill loads automatically)
- `name` (string): stable skill name, e.g. "assessment-scoring"
- `plugin` (string): parent plugin id that ships this skill
- `pluginCategory` (string|null): category of the parent plugin
- `repo` (string): author repo (owner/name), when externally hosted
- `source` (string|null): the complete raw SKILL.md (frontmatter + body); null only if the fetch failed
- `sourceUrl` (string): GitHub location of the skill directory
- `verification` (string): verification status of the parent plugin; prefer "verified"
- `verifiedDate` (string|null): date of the verification run covering this skill

### `list_scorecards` (~88 tokens)

List MCP server scorecards

List the public MCP servers Sigistry has independently graded against its scorecard rubric (transport, stateless core, lifecycle, authorization, tool design, security hygiene), each with an overall grade A-F and the exact commit graded. Useful before connecting an agent to a third-party MCP server: check whether it has been assessed and how it scored. Use get_scorecard for the full per-axis breakdown.

Output parameters:

- `rubricUrl` (string|null)
- `rubricVersion` (string|null)
- `scorecards` (array)
- `total` (integer)

### `get_scorecard` (~104 tokens)

Get an MCP server scorecard

Get the full scorecard for one graded MCP server by its id: the overall grade, per-axis pass/partial/fail with cited evidence, hardening notes, the rubric version, and the exact commit graded. Grades describe the pinned commit only; a re-grade at a newer commit can be requested via an issue on the marketplace repo.

Input parameters:

- `id` (string, required): scorecard id, e.g. "sigistry-catalog" (find ids via list_scorecards)

Output parameters:

- `axes` (array): per-axis results with evidence
- `commit`
- `date`
- `endpoint`
- `grade` (string)
- `id` (string)
- `name` (string)
- `notes` (array): hardening suggestions and context
- `repo`
- `rubricUrl`
- `rubricVersion`
- `selfAssessment` (boolean)

### `verify_plugin` (~153 tokens)

Verify a Claude Code plugin (pre-publish, runs locally)

Get the recipe to run the Sigistry verification methodology (the eight static checks that gate the Verified badge: manifest integrity, hook safety, agent tool scopes, command hygiene, skill structure, skill safety, no secrets, documentation) against a plugin BEFORE publishing it. The verification runs entirely on the local machine via a dependency-free open-source Node script; the plugin code never leaves the user's computer and this server performs no computation. Call this when the user wants their plugin or skill checked, then follow the returned steps: download the script, run it against the plugin directory, and fix any FAIL findings it reports.

Input parameters:

- `pluginPath` (string): local path to the plugin directory, used to fill in the run command (optional)

Output parameters:

- `checks` (array): the eight checks the script will run
- `commands` (object)
- `interpreting` (string)
- `methodologyUrl` (string)
- `methodologyVersion` (string)
- `nextSteps` (string)
- `runsWhere` (string): always "local": verification executes on the user's machine
- `steps` (array): what the agent should do, in order

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry#diagnostics

## Score history

- 2026-09-20: 85
- 2026-09-19: 85
- 2026-09-18: 84
- 2026-09-17: 84
- 2026-09-16: 83
- 2026-09-15: 83
- 2026-09-14: 82
- 2026-09-13: 82
- 2026-09-12: 81
- 2026-09-11: 81
- 2026-09-10: 80
- 2026-09-09: 80
- 2026-09-08: 79
- 2026-09-07: 79
- 2026-09-06: 78
- 2026-09-05: 78
- 2026-09-04: 78
- 2026-09-03: 77
- 2026-09-02: 77
- 2026-09-01: 76
- 2026-08-31: 76
- 2026-08-30: 75
- 2026-08-29: 75
- 2026-08-28: 74
- 2026-08-27: 74
- 2026-08-26: 73
- 2026-08-25: 71
- 2026-08-24: 71

## Common questions

### What is the Sigistry Plugin & Skill Catalog MCP server?

Sigistry Plugin & Skill Catalog is an MCP server listed in the public MCP registry as com.sigistry/plugin-catalog. Search verified Claude Code plugins and skills; fetch portable SKILL.md sources. Read-only. This page covers its hosted endpoint (https://sigistry.com/mcp).

### Is the Sigistry Plugin & Skill Catalog MCP server safe to use?

Sigistry Plugin & Skill Catalog scores 85 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Sigistry Plugin & Skill Catalog MCP server expose?

Sigistry Plugin & Skill Catalog exposes 8 tools: search_plugins, get_plugin, list_categories, search_skills, get_skill, and 3 more. Their descriptions and schemas cost roughly 766 tokens of context every time the server is loaded.

### Does the Sigistry Plugin & Skill Catalog MCP server require authentication?

No. We connected to Sigistry Plugin & Skill Catalog without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Sigistry Plugin & Skill Catalog MCP server still maintained?

Sigistry Plugin & Skill Catalog is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://sigistry.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry.json
- HTML version of this page: https://verifymcp.io/servers/com-sigistry-plugin-catalog/sigistry