All commands are exposed as npm scripts and run through src/cli.ts.
PlugScout scope order is: Claude plugins, Claude connectors, Copilot extensions, Skills, MCP servers.
Packaged CLI behavior:
plugscoutwith no arguments opens the home screen.plugscout upgrade checkperforms a release check against GitHub Releases.plugscout web --openwrites a readable browser report and opens it.--no-update-checkdisables the daily automatic update check for the current command run.
npm run aboutnpm run status [-- --verbose]npm run sync [-- --kind skill,mcp,claude-plugin,claude-connector,copilot-extension] [-- --dry-run]
npm run setup— one-step: install prerequisites + write default config + sync all catalogsnpm run init [-- --project .]— interactive config init onlynpm run doctor [-- --project .]npm run doctor -- --project . --install-depssetupis the recommended first command after installing the package; it callsinitnon-interactively and runs an initial syncinitdefault kinds includeskill,mcp,claude-plugin,claude-connector,copilot-extensionriskPosture=strictmakeslistandrecommenddefault to safe-only viewsdoctor --install-depsbootstraps the supportedskillsCLI when it is missing- supported legacy MCP installs now prefer direct
npm install -gordocker pullwhen the target is unambiguous
npm run list -- --kind mcp --limit 10npm run list -- --kind claude-plugin --limit 20(includes source, catalog type, confidence columns)npm run list -- --kind claude-connector --limit 20(separate Claude Connectors catalog)npm run list -- --kind claude-plugin --limit 20 --readable(wrapped wide table mode)npm run list -- --kind claude-plugin --limit 10 --details(per-item decision evidence: trust/risk/provenance/install)npm run search -- securitynpm run explain -- --limit 20npm run explain -- --kind mcp --format jsonnpm run scan -- --project . --format tablenpm run scan -- --project . --format json --out scan-report.jsonnpm run show -- --id mcp:filesystemnpm run show -- --id claude-connector:asana(prints provenance source/sourcePage when present)npm run top -- --project . --limit 5npm run top -- --project . --limit 5 --details(score equation + block reason + install hint per item)
npm run recommend -- --project . --format tablenpm run recommend -- --project . --only-safe --sort trust --limit 10 --explain-scannpm run recommend -- --project . --only-safe --sort trust --limit 10 --detailsnpm run recommend -- --project . --llm --explain-scannpm run recommend -- --project . --export csv --out recommendations.csvnpm run recommend -- --project . --export md --out recommendations.md
npm run assess -- --id mcp:remote-browsernpm run install:item -- --id mcp:filesystem --yes --install-depsnpm run install:item -- --id mcp:remote-browser --yes --override-risknpm run install:item -- --id skill:playwright --yes --install-deps
npm run whitelist:verifynpm run quarantine:apply -- --report data/security-reports/YYYY-MM-DD/report.json
plugscout upgrade checkplugscout recommend --project . --no-update-checkplugscout status --no-update-check
plugscout web --out .plugscout/report.htmlplugscout web --kind claude-connector --limit 200 --open(includes score legend + decision cards per item)
npm run validate:datanpm run ingest:skillsnpm run ingest:mcpsnpm run ingest:claude-pluginsnpm run ingest:copilot-extensionsnpm run ingest:all