| <!DOCTYPE html> |
| <html lang="en"> |
| <head> |
| <meta charset="utf-8" /> |
| <meta name="viewport" content="width=device-width, initial-scale=1" /> |
| <title>HOL Plugin Security</title> |
| <meta name="description" content="Hashgraph Online plugin-security dataset explorer: 205 scored plugins, 22 public Guard advisories, modeled runtime fixtures, and an honest OWASP MCP Top 10 mapping. Scan is not a safety guarantee. Guard is local-first, not a cloud MCP gateway." /> |
| <link rel="stylesheet" href="style.css" /> |
| </head> |
| <body> |
| <div class="wrap"> |
| <header> |
| <h1>HOL Plugin Security</h1> |
| <p>Explorer for <strong>HashgraphOnline/hol-plugin-security</strong>: 205 scored registry plugins, 22 public Guard advisories, 220 modeled runtime fixtures, and an honest OWASP MCP Top 10 mapping.</p> |
| <div class="links"> |
| <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">dataset</a> |
| <a href="https://hol.org/plugins">hol.org/plugins</a> |
| <a href="https://hol.org/guard">hol.org/guard</a> |
| <a href="https://owasp.org/www-project-mcp-top-10/">OWASP MCP Top 10</a> |
| <a href="llms.txt">llms.txt</a> |
| </div> |
| <div class="note"> |
| <strong>Not claimed here:</strong> first firewall, unlabeled 450K+ anything, or Guard-only GitHub stars. |
| Hashgraph Online org-wide stars (3.5K+) are not attributed to this Space, this dataset, or Guard. |
| </div> |
| <div class="limits"> |
| <strong>Honest limits</strong> |
| <ul> |
| <li>205 scored <strong>plugins</strong> ≠ Registry Broker agent counts (do not confuse with 249k agents / 24k MCP servers).</li> |
| <li>Scanner on plugin rows is <code>registry-broker-fallback</code>. <strong>Scan ≠ safety.</strong> Most findings are publishability, not confirmed vulns.</li> |
| <li>HOL Guard is <strong>local-first</strong> (shell, secrets/file reads, MCP server change, plugin/skill install). <strong>Not a cloud MCP gateway.</strong></li> |
| <li>Runtime fixtures are <strong>modeled</strong>. Same outcome across harnesses. Latency values are placeholders. No real secrets or attacks executed.</li> |
| <li>Cursor artifact trust is <strong>not</strong> full pre-exec of every tool description / MCP tool call.</li> |
| <li><strong>Not</strong> a complete prompt-injection preventer.</li> |
| <li>MCP08 has <strong>0 advisory rows</strong> in this snapshot.</li> |
| <li>HOL publishes this. Not independent third-party validation.</li> |
| </ul> |
| </div> |
| </header> |
|
|
| <nav class="tabs" aria-label="Sections"> |
| <button class="active" data-tab="plugins">Plugins</button> |
| <button data-tab="advisories">Advisories</button> |
| <button data-tab="runtime">Runtime fixtures</button> |
| <button data-tab="owasp">OWASP map</button> |
| </nav> |
|
|
| <section id="plugins" class="panel active"> |
| <p>Default config: <strong>plugins</strong> (205 scored registry plugins). Filterable and sortable. <code>scanner_provider</code> is <code>registry-broker-fallback</code> on every current row. Scan ≠ safety.</p> |
| <div class="controls" id="plugin-controls"></div> |
| <div class="status" id="plugin-status"></div> |
| <div class="table-wrap"><table id="plugin-table"></table></div> |
| </section> |
|
|
| <section id="advisories" class="panel"> |
| <p>22 public HOL Guard advisory pages. <code>owasp_mcp</code> is HOL's primary mapping to one OWASP MCP Top 10 (beta) ID. <code>threat_class</code> comes from hub listing badges on <a href="https://hol.org/guard/security">hol.org/guard/security</a>, not inferred from titles. A mapped advisory is not proof a plugin is safe. <strong>MCP08 has 0 rows.</strong></p> |
| <div class="controls" id="advisory-controls"></div> |
| <div class="status" id="advisory-status"></div> |
| <div class="table-wrap"><table id="advisory-table"></table></div> |
| </section> |
|
|
| <section id="runtime" class="panel"> |
| <p>220 <strong>modeled</strong> harness outcomes from the published Guard benchmark record. Same outcome across all 5 harnesses. Latency values are placeholders. No real secrets or attacks executed. This is not a live exploit test.</p> |
| <div class="controls" id="runtime-controls"></div> |
| <div class="status" id="runtime-status"></div> |
| <div class="table-wrap"><table id="runtime-table"></table></div> |
| </section> |
|
|
| <section id="owasp" class="panel"> |
| <h2>OWASP MCP Top 10 mapping (beta)</h2> |
| <p>Copied from the <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">dataset card</a>. HOL's mapping of local Guard + catalog scanner to the <a href="https://owasp.org/www-project-mcp-top-10/">OWASP MCP Top 10</a> beta (Phase 3). <strong>Not complete coverage.</strong></p> |
| <p>MCP06 on the Top 10 list is <strong>Intent Flow Subversion</strong>. The same OWASP page later also titles that item "Prompt Injection via Contextual Payloads". HOL Guard is <strong>not</strong> a complete prompt-injection preventer.</p> |
| <p>IDs and names are cited; long OWASP descriptions are not copied. OWASP document license: CC BY-NC-SA 4.0. <code>advisory_rows</code> is counted from this snapshot's <code>advisories.owasp_mcp</code> (one primary ID per advisory).</p> |
| <div class="table-wrap"> |
| <table class="owasp"> |
| <thead> |
| <tr> |
| <th>ID</th><th>Name</th><th>Advisory rows</th><th>Detect</th><th>Prevent</th><th>Gap</th> |
| </tr> |
| </thead> |
| <tbody> |
| <tr> |
| <td>MCP01</td><td>Token Mismanagement & Secret Exposure</td><td>4</td> |
| <td>catalog/advisory secret-exfil + mcp-token-theft</td> |
| <td>Guard can block secret-file / env reads at the local action boundary</td> |
| <td>not a secrets manager; does not rotate tokens; does not scrub secrets already inside model context</td> |
| </tr> |
| <tr> |
| <td>MCP02</td><td>Privilege Escalation via Scope Creep</td><td>1</td> |
| <td>tool-permission-creep advisory</td> |
| <td>Guard approval on plugin/skill install and MCP server change</td> |
| <td>not an OAuth scope-expiry gateway</td> |
| </tr> |
| <tr> |
| <td>MCP03</td><td>Tool Poisoning</td><td>2</td> |
| <td>tool-description-poisoning advisory + scanner MCP posture</td> |
| <td>Guard on changed MCP servers / plugin install</td> |
| <td>Cursor path is artifact trust, not full pre-exec of every tool description</td> |
| </tr> |
| <tr> |
| <td>MCP04</td><td>Software Supply Chain Attacks & Dependency Tampering</td><td>4</td> |
| <td>catalog scores, lockfile/publishability findings, supply-chain advisories</td> |
| <td>Guard on plugin/skill install</td> |
| <td>not a signing/SBOM authority</td> |
| </tr> |
| <tr> |
| <td>MCP05</td><td>Command Injection & Execution</td><td>1</td> |
| <td>unsafe-command / rm-rf advisory</td> |
| <td>Guard intercepts local shell/file-destructive actions</td> |
| <td>does not sandbox every MCP server's own backend</td> |
| </tr> |
| <tr> |
| <td>MCP06</td><td>Intent Flow Subversion</td><td>5</td> |
| <td>several prompt-injection advisories (Intent Flow Subversion / contextual payloads)</td> |
| <td>limited (some injected-instruction to shell paths hit Guard)</td> |
| <td>NOT a complete prompt-injection preventer</td> |
| </tr> |
| <tr> |
| <td>MCP07</td><td>Insufficient Authentication & Authorization</td><td>1</td> |
| <td>MCP transport hardening (insecure HTTP, wildcard binds, missing auth posture) on Guard pages</td> |
| <td>local only</td> |
| <td>not an MCP gateway identity layer</td> |
| </tr> |
| <tr class="mcp08"> |
| <td>MCP08</td><td>Lack of Audit and Telemetry</td><td class="zero">0</td> |
| <td>local decision trail / receipts on the developer machine</td> |
| <td>local decision trail / receipts</td> |
| <td>not an immutable SIEM; local logs</td> |
| </tr> |
| <tr> |
| <td>MCP09</td><td>Shadow MCP Servers</td><td>1</td> |
| <td>shadow-mcp-server-discovery advisory</td> |
| <td>Guard on new/changed MCP servers before the harness launches</td> |
| <td>not continuous org-wide network discovery of shadow servers</td> |
| </tr> |
| <tr> |
| <td>MCP10</td><td>Context Injection & Over-Sharing</td><td>3</td> |
| <td>context-window-scraping / data-overexposure advisories</td> |
| <td>Guard on excessive local file reads</td> |
| <td>does not quarantine or partition model context windows</td> |
| </tr> |
| </tbody> |
| </table> |
| </div> |
| <p>This mapping does not replace the disclaimers above. Guard is local-first, not a cloud MCP gateway. Fixtures are modeled. 205 plugins ≠ Registry Broker agent counts. Scan ≠ safety.</p> |
| </section> |
|
|
| <footer> |
| Source dataset: <a href="https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security">HashgraphOnline/hol-plugin-security</a>. |
| License Apache-2.0. OWASP MCP Top 10: <a href="https://owasp.org/www-project-mcp-top-10/">owasp.org/www-project-mcp-top-10</a>. |
| Tables are snapshot JSON from the parquet configs; this Space does not download large files. |
| </footer> |
| </div> |
| <script src="app.js"></script> |
| </body> |
| </html> |
|
|
