One catalog, three types
Skills are task instructions, plugins bundle client capabilities, and MCP servers expose tools or data through a declared protocol. They share one versioned metadata table and search engine. A contained skill is not deduplicated into its parent plugin. Native plugin formats for the same repository and package root are merged; MCP aliases with the same declared distributions are grouped.
Sources and reuse
Public pinned GitHub manifests and repository metadata supply plugin evidence. The Official MCP Registry supplies MCP metadata under its CC0 metadata terms. Package software and connected services have their own licenses and terms. Registry publication is not a safety assessment or an endorsement by the registry maintainers. AI Craft Pad is an independent catalog.
HOL is a research reference; its catalog and scores are not bulk imported. Skills.sh discovery remains inactive without authorized API access. We do not infer install counts, downloads or third-party audit verdicts.
Explainable score, hub-1.0
The score uses the same eight weights as the Skills method: documentation 20%, maintenance 15%, license clarity 10%, repository health 10%, compatibility evidence 10%, repository popularity 5%, originality 10%, static safety 20%. For Plugins and MCP, runtime safety is Unknown and contributes zero. Missing repository, documentation, license and compatibility evidence also remains Unknown. A low score can mean limited evidence. Do not compare different evidence scopes as a security ranking.
Repository freshness is shown separately using the actual repository observation date and push date. A registry update date is not a repository commit or a package security review. Stars describe the whole repository. First-party source labels apply only where source ownership has been checked, and never certify dependencies.
Sync and trending
The scheduled build runs daily at 03:25 UTC. Registry pages are cached for six hours, requested sequentially with a rate limit, and read using the registry-confirmed latest flag and opaque cursor. GitHub metadata checks use a bounded rotating budget. Unchecked repositories retain Unknown; retained evidence keeps its own date. Deprecated, deleted, archived and inaccessible sources stay distinguishable.
Trending needs actual repository-star observations 20–48 hours apart. No first-sync history is created. New means first seen in this catalog, not the package release date. An unavailable trend remains Unknown.
Safety and private data
Ingestion does not execute SKILL.md, package commands, hooks, repository scripts or remote MCP endpoints. Metadata is sanitized and output escaped. Fetching is restricted to known registry/GitHub hosts with timeouts, response limits, bounded retries and no arbitrary endpoint requests. Credential values, header defaults and publisher extension metadata are dropped; requirement names may be shown. Declared network or shell behavior is a reason for review, not proof of malicious intent.
Publication quality
Bulk metadata stays noindex. An indexable detail requires a substantive original review bound to the exact metadata and content hashes, a checked source, a clear license, current repository evidence, no duplicate or unavailable status, and no high-risk scan flags. Filter and comparison selections are noindex and canonicalize to clean collection routes. Only eligible pages enter the shared segmented sitemap. No SoftwareApplication claim is made for an instruction or metadata listing.
Comparison and stack privacy
Your comparison selection uses sessionStorage in this browser tab and can be cleared. The selected public catalog slugs appear in the comparison URL. Do not put secrets in URLs or search queries. Stack suggestions are deterministic searches over public metadata, without a paid LLM call. They do not install tools or grant access.