Agent plugins

ECZ-ID evidence reviews inside the agent you already use.

Six free plugins, one marketplace. Each one inspects a workspace by file name and path, reports evidence observed and not observed with a deterministic Review Priority and the reasons, explains why it matters, and routes to the next step. Read-only. No sign-in. No source upload. No telemetry. No scores.

2 install routes are available now. Everything is generated from one estate on GitHub, so this page names the estate rather than restating its facts.

Install

Marketplace name eczid-plugins, estate Ecocitizenz/eczid-agent-plugins. Plugins are Agent Plugins 1.0.0 packages and also carry the Claude Code manifest.

Claude Code

Available now

The estate is a Claude Code marketplace (.claude-plugin/marketplace.json). Add it once, then install any plugin by name.

In Claude Code

/plugin marketplace add Ecocitizenz/eczid-agent-plugins
/plugin install eczid-dora-readiness@eczid-plugins

VS Code and GitHub Copilot

Available now

VS Code reads Agent Plugins 1.0 manifests and the estate publishes the Copilot marketplace file (.github/plugin/marketplace.json). Add the marketplace, then install from the Extensions view or from source.

settings.json

{
  "chat.plugins.marketplaces": ["Ecocitizenz/eczid-agent-plugins"]
}

Cursor, Codex CLI, Gemini CLI, Kiro and other Agent Skills hosts

Not verified by us

Every plugin is an Agent Plugins 1.0.0 package: plain SKILL.md skills, dependency-free review scripts and an mcp.json server entry. Copy the plugin directory (or just skills/) into the host and add the MCP entry where the plugin ships one.

The packages follow the Agent Plugins and Agent Skills specifications these hosts document. We have not run an end-to-end transcript in each of them, so we do not claim tested compatibility; we state only that this is the documented way to add them.

The plugins

Each plugin composes an existing ECZ-ID capability. Nothing here rebuilds the Resolver, the Verifier, TrustOps or entitlement. The current list and versions live in the estate's plugins/index.json.

ECZ-ID MCP Verifier

Does this MCP server, agent, API, package, domain or business have public ECZ-ID Resolver proof?

@ecocitizenz/ecz-id-mcp-verifier@0.9.0 over stdio: three read-only tools, launched by the host with npx.

Claude Code

/plugin install eczid-mcp-verifier@eczid-plugins

Product documentation Open the source

ECZ-ID MCP Trust

What can the MCP servers in this workspace reach, and what has public proof?

A portable, filename-only review script plus the Verifier. Same detectors and Review Priority as ECZ-ID MCP Trust for VS Code.

Claude Code

/plugin install eczid-mcp-trust@eczid-plugins

Product documentation Open the source

ECZ-ID Agent Trust

What can this agent reach, who authorised it, and what has public proof?

A portable review script plus the Verifier. Same doctrine as ECZ-ID Agent Trust for VS Code.

Claude Code

/plugin install eczid-agent-trust@eczid-plugins

Product documentation Open the source

ECZ-ID SBOM & CRA Readiness

Could your team identify an affected component and its evidence chain within the CRA reporting window?

The exact detectors, guidance and Review Priority of ECZ-ID SBOM & CRA Readiness for VS Code.

Claude Code

/plugin install eczid-sbom-cra-readiness@eczid-plugins

Product documentation Open the source

ECZ-ID API Trust

Which API surfaces does this workspace expose, how are they secured, and what has public proof?

A portable review script plus the Verifier.

Claude Code

/plugin install eczid-api-trust@eczid-plugins

Product documentation Open the source

ECZ-ID DORA Readiness

Can you produce your ICT third-party evidence today?

The exact detectors, guidance and Review Priority of ECZ-ID DORA Readiness for VS Code.

Claude Code

/plugin install eczid-dora-readiness@eczid-plugins

Product documentation Open the source

What a plugin does, and does not do

Reviews read file names and paths in the workspace you point them at. No file is opened, no SBOM is parsed, no secret value is read, and nothing is written unless you redirect the JSON output yourself.
Results use EVIDENCE OBSERVED, EVIDENCE NOT OBSERVED, REVIEW RECOMMENDED and REVIEW REQUIRED with a Review Priority of LOW, NORMAL, ELEVATED or HIGH and the reasons shown. Never a score, never a verdict. Missing evidence is neutral; local policy decides; re-check before reliance.
OBSERVED is not ENFORCED. No plugin mediates traffic. The ECZ-ID Local Trust Gate that produces ENFORCED runs only in the VS Code extension, and no plugin claims it.
Where an ECZ-ID product has Community and Pro editions, those belong to the VS Code extensions and an existing licence already covers them. No plugin sells a separate subscription. Free Passports are offered in context only where they are live.
Plugins inspect, explain and route. TrustOps handles any setup or checkout at https://trustops.ecocitizenz.com/start; the Resolver at https://resolver.ecocitizenz.org proves public state; this site documents and routes.

Source, validator and parity tests: https://github.com/Ecocitizenz/eczid-agent-plugins. Prefer the CLI, CI or a raw MCP server? See Universal Install.