How I vet a Codex plugin or MCP server in about two minutes

AI model plugins, such as those for ChatGPT and Codex, along with MCP servers, are designed to extend functionality but pose a security challenge because they execute code directly on a user's system. Installation is often straightforward, yet community-contributed plugins rarely undergo independent security audits, creating a risk of unintended operations or malicious activity.

The proposed vetting process involves several key checks. Users should first assess a plugin's maintenance status by examining its last commit date, open issues, and repository archival status. Crucially, reviewing the `.mcp.json` and `hooks.json` files reveals the specific commands the plugin will execute. Furthermore, users are advised to scrutinize requested permissions, such as access to tokens, filesystem, or network, ensuring they align with the plugin's stated function; for example, a Markdown formatter requesting GitHub tokens warrants closer inspection.

Additional steps include evaluating the developer's reputation, preferring known companies or maintainers with established project histories over new accounts. The presence of a software license indicates a level of development diligence. Users should also inspect `plugin.json` for red flags like absolute paths or hardcoded secrets. While plugins from curated built-in directories, such as those from OpenAI, offer a signal of trustworthiness, they still require individual review, especially if they interact with sensitive data like email or files.

Although this checklist offers a sensible initial pass to avoid most overtly problematic plugins, it is not a comprehensive security audit. For enhanced protection, especially against changes made after initial vetting, the article suggests examining tool definitions for explicit shell or file write access and implementing version pinning, along with diffing the manifest after each update to detect unexpected modifications.