Review a plugin before it reaches your app.

A plugin can bring a useful feature and new permissions. The Plugin Trust Centre puts the evidence beside the decision in your existing EmDash administration.

Open Plugin Trust Centre

Administrator sign-in required. Your installed inventory stays private.

Start with the exact release.

The first read-only evaluator covers two curated releases observed on 25 October 2026. It records the publisher DID, package slug, version, profile and release CIDs, inspected artifact digest, declared permissions, outbound hosts and EmDash compatibility. You can see why each result needs attention and follow its source.

Unknown stays visible.

Policy blocked means a release conflicts with the stated local review policy. It does not accuse its publisher of malicious behaviour. Needs review names an authority or evidence gap. Unknown means a required check has not been established; evidence older than 14 days becomes Unknown. No plugin receives an overall secure rating from these checks.

The current snapshot has no advisory-feed coverage or completed native installation receipt. Publisher policy and a matching artifact digest do not independently verify build provenance.

EmDash owns installation.

The Trust Centre cannot install or change plugins. EmDash’s native installer verifies publisher records and artifact identity and asks for permission consent. Composer’s production registry runner is not enabled. A separate Node/workerd run now proves a real Publish Check installation, configuration, update and settings recovery after reinstall through native EmDash APIs. Worker Loader configuration, provider entitlement and Cloudflare lifecycle qualification remain required before enabling registry installation on this site.

Read the local lifecycle receipt · Browse the official registry · Read EmDash’s installation guide