index.html

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <title>HOL Plugin Security</title>
  <meta name="description" content="Hashgraph Online plugin-security dataset explorer: 205 scored plugins, 22 public Guard advisories, modeled runtime fixtures, and an honest OWASP MCP Top 10 mapping. Scan is not a safety guarantee. Guard is local-first, not a cloud MCP gateway." />
  <link rel="stylesheet" href="style.css" />
</head>
<body>
  <div class="wrap">
    <header>
      <h1>HOL Plugin Security</h1>
      <p>Explorer for <strong>HashgraphOnline/hol-plugin-security</strong>: 205 scored registry plugins, 22 public Guard advisories, 220 modeled runtime fixtures, and an honest OWASP MCP Top 10 mapping.</p>
      <div class="links">
        <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">dataset</a>
        <a href="https://hol.org/plugins">hol.org/plugins</a>
        <a href="https://hol.org/guard">hol.org/guard</a>
        <a href="https://owasp.org/www-project-mcp-top-10/">OWASP MCP Top 10</a>
        <a href="llms.txt">llms.txt</a>
      </div>
      <div class="note">
        <strong>Not claimed here:</strong> first firewall, unlabeled 450K+ anything, or Guard-only GitHub stars.
        Hashgraph Online org-wide stars (3.5K+) are not attributed to this Space, this dataset, or Guard.
      </div>
      <div class="limits">
        <strong>Honest limits</strong>
        <ul>
          <li>205 scored <strong>plugins</strong> ≠ Registry Broker agent counts (do not confuse with 249k agents / 24k MCP servers).</li>
          <li>Scanner on plugin rows is <code>registry-broker-fallback</code>. <strong>Scan ≠ safety.</strong> Most findings are publishability, not confirmed vulns.</li>
          <li>HOL Guard is <strong>local-first</strong> (shell, secrets/file reads, MCP server change, plugin/skill install). <strong>Not a cloud MCP gateway.</strong></li>
          <li>Runtime fixtures are <strong>modeled</strong>. Same outcome across harnesses. Latency values are placeholders. No real secrets or attacks executed.</li>
          <li>Cursor artifact trust is <strong>not</strong> full pre-exec of every tool description / MCP tool call.</li>
          <li><strong>Not</strong> a complete prompt-injection preventer.</li>
          <li>MCP08 has <strong>0 advisory rows</strong> in this snapshot.</li>
          <li>HOL publishes this. Not independent third-party validation.</li>
        </ul>
      </div>
    </header>

    <nav class="tabs" aria-label="Sections">
      <button class="active" data-tab="plugins">Plugins</button>
      <button data-tab="advisories">Advisories</button>
      <button data-tab="runtime">Runtime fixtures</button>
      <button data-tab="owasp">OWASP map</button>
    </nav>

    <section id="plugins" class="panel active">
      <p>Default config: <strong>plugins</strong> (205 scored registry plugins). Filterable and sortable. <code>scanner_provider</code> is <code>registry-broker-fallback</code> on every current row. Scan ≠ safety.</p>
      <div class="controls" id="plugin-controls"></div>
      <div class="status" id="plugin-status"></div>
      <div class="table-wrap"><table id="plugin-table"></table></div>
    </section>

    <section id="advisories" class="panel">
      <p>22 public HOL Guard advisory pages. <code>owasp_mcp</code> is HOL's primary mapping to one OWASP MCP Top 10 (beta) ID. <code>threat_class</code> comes from hub listing badges on <a href="https://hol.org/guard/security">hol.org/guard/security</a>, not inferred from titles. A mapped advisory is not proof a plugin is safe. <strong>MCP08 has 0 rows.</strong></p>
      <div class="controls" id="advisory-controls"></div>
      <div class="status" id="advisory-status"></div>
      <div class="table-wrap"><table id="advisory-table"></table></div>
    </section>

    <section id="runtime" class="panel">
      <p>220 <strong>modeled</strong> harness outcomes from the published Guard benchmark record. Same outcome across all 5 harnesses. Latency values are placeholders. No real secrets or attacks executed. This is not a live exploit test.</p>
      <div class="controls" id="runtime-controls"></div>
      <div class="status" id="runtime-status"></div>
      <div class="table-wrap"><table id="runtime-table"></table></div>
    </section>

    <section id="owasp" class="panel">
      <h2>OWASP MCP Top 10 mapping (beta)</h2>
      <p>Copied from the <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">dataset card</a>. HOL's mapping of local Guard + catalog scanner to the <a href="https://owasp.org/www-project-mcp-top-10/">OWASP MCP Top 10</a> beta (Phase 3). <strong>Not complete coverage.</strong></p>
      <p>MCP06 on the Top 10 list is <strong>Intent Flow Subversion</strong>. The same OWASP page later also titles that item "Prompt Injection via Contextual Payloads". HOL Guard is <strong>not</strong> a complete prompt-injection preventer.</p>
      <p>IDs and names are cited; long OWASP descriptions are not copied. OWASP document license: CC BY-NC-SA 4.0. <code>advisory_rows</code> is counted from this snapshot's <code>advisories.owasp_mcp</code> (one primary ID per advisory).</p>
      <div class="table-wrap">
        <table class="owasp">
          <thead>
            <tr>
              <th>ID</th><th>Name</th><th>Advisory rows</th><th>Detect</th><th>Prevent</th><th>Gap</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td>MCP01</td><td>Token Mismanagement &amp; Secret Exposure</td><td>4</td>
              <td>catalog/advisory secret-exfil + mcp-token-theft</td>
              <td>Guard can block secret-file / env reads at the local action boundary</td>
              <td>not a secrets manager; does not rotate tokens; does not scrub secrets already inside model context</td>
            </tr>
            <tr>
              <td>MCP02</td><td>Privilege Escalation via Scope Creep</td><td>1</td>
              <td>tool-permission-creep advisory</td>
              <td>Guard approval on plugin/skill install and MCP server change</td>
              <td>not an OAuth scope-expiry gateway</td>
            </tr>
            <tr>
              <td>MCP03</td><td>Tool Poisoning</td><td>2</td>
              <td>tool-description-poisoning advisory + scanner MCP posture</td>
              <td>Guard on changed MCP servers / plugin install</td>
              <td>Cursor path is artifact trust, not full pre-exec of every tool description</td>
            </tr>
            <tr>
              <td>MCP04</td><td>Software Supply Chain Attacks &amp; Dependency Tampering</td><td>4</td>
              <td>catalog scores, lockfile/publishability findings, supply-chain advisories</td>
              <td>Guard on plugin/skill install</td>
              <td>not a signing/SBOM authority</td>
            </tr>
            <tr>
              <td>MCP05</td><td>Command Injection &amp; Execution</td><td>1</td>
              <td>unsafe-command / rm-rf advisory</td>
              <td>Guard intercepts local shell/file-destructive actions</td>
              <td>does not sandbox every MCP server's own backend</td>
            </tr>
            <tr>
              <td>MCP06</td><td>Intent Flow Subversion</td><td>5</td>
              <td>several prompt-injection advisories (Intent Flow Subversion / contextual payloads)</td>
              <td>limited (some injected-instruction to shell paths hit Guard)</td>
              <td>NOT a complete prompt-injection preventer</td>
            </tr>
            <tr>
              <td>MCP07</td><td>Insufficient Authentication &amp; Authorization</td><td>1</td>
              <td>MCP transport hardening (insecure HTTP, wildcard binds, missing auth posture) on Guard pages</td>
              <td>local only</td>
              <td>not an MCP gateway identity layer</td>
            </tr>
            <tr class="mcp08">
              <td>MCP08</td><td>Lack of Audit and Telemetry</td><td class="zero">0</td>
              <td>local decision trail / receipts on the developer machine</td>
              <td>local decision trail / receipts</td>
              <td>not an immutable SIEM; local logs</td>
            </tr>
            <tr>
              <td>MCP09</td><td>Shadow MCP Servers</td><td>1</td>
              <td>shadow-mcp-server-discovery advisory</td>
              <td>Guard on new/changed MCP servers before the harness launches</td>
              <td>not continuous org-wide network discovery of shadow servers</td>
            </tr>
            <tr>
              <td>MCP10</td><td>Context Injection &amp; Over-Sharing</td><td>3</td>
              <td>context-window-scraping / data-overexposure advisories</td>
              <td>Guard on excessive local file reads</td>
              <td>does not quarantine or partition model context windows</td>
            </tr>
          </tbody>
        </table>
      </div>
      <p>This mapping does not replace the disclaimers above. Guard is local-first, not a cloud MCP gateway. Fixtures are modeled. 205 plugins ≠ Registry Broker agent counts. Scan ≠ safety.</p>
    </section>

    <footer>
      Source dataset: <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">HashgraphOnline/hol-plugin-security</a>.
      License Apache-2.0. OWASP MCP Top 10: <a href="https://owasp.org/www-project-mcp-top-10/">owasp.org/www-project-mcp-top-10</a>.
      Tables are snapshot JSON from the parquet configs; this Space does not download large files.
    </footer>
  </div>
  <script src="app.js"></script>
</body>
</html>