schemaVersion: 2
providers:
  orditra-policy:
    description: Native managed policy blocks.
    kind: builtin
    source: orditra
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  orditra-skills:
    description: Native bundled skills with repo-local or shared activation.
    kind: builtin
    source: orditra
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  orditra-skill-lock:
    description: Immutable external skill fetch and quarantine pipeline.
    kind: builtin
    source: orditra
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: true
    hooks: false
  orditra-reporting:
    description: Native structured findings and report renderers.
    kind: builtin
    source: orditra
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  context-mode:
    description: Context-protection plugin and hooks.
    kind: plugin
    source: https://github.com/mksglu/context-mode
    version: 1.0.169
    commit: 7ee0f2982f59e213d5c5b88ca60fcb3053d60f5f
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: true
    hooks: true
  serena:
    description: LSP-backed semantic code MCP.
    kind: mcp
    source: https://github.com/oraios/serena
    version: 1.5.3
    commit: f1d78a88cec2031d6b699c9944839979e9a0175d
    executable: serena
    transport: stdio
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: true
    hooks: false
  ast-grep:
    description: Structural code CLI.
    kind: cli
    source: https://github.com/ast-grep/ast-grep
    version: 0.43.0
    commit: 5aa00e1dd5e0077589a6c0c23c640e39947403ec
    executable: sg
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  context7:
    description: Current library documentation over streamable HTTP MCP.
    kind: mcp
    source: https://github.com/upstash/context7
    version: 4.0.2
    commit: ca15df0443ee770506fc4eb270d1efc71d483933
    transport: http
    endpoint: https://mcp.context7.com/mcp
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: false
    hooks: false
  repomix:
    description: Tree-sitter compressed repository maps and token counts.
    kind: cli
    source: https://github.com/yamadashy/repomix
    version: 1.18.0
    commit: e3b15a406ed78d8a463620a032a059ce911bfc0e
    executable: repomix
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  probe:
    description: AST/BM25 and optional LSP code search.
    kind: mcp
    source: https://github.com/probelabs/probe
    version: 0.6.0-rc88
    commit: 868bae31b6141093e7e51c6a22322c99d972e0a8
    executable: probe
    args: [mcp]
    serverName: probe
    transport: stdio
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: false
    hooks: false
  playwright-cli:
    description: Token-efficient browser automation CLI and skills.
    kind: cli
    source: https://github.com/microsoft/playwright-cli
    version: 0.1.18
    commit: e2d8f311f38a4828fc44a1026481481442ed962b
    executable: playwright-cli
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: true
    hooks: false
  chrome-devtools-mcp:
    description: Chrome performance and debugging MCP.
    kind: mcp
    source: https://github.com/ChromeDevTools/chrome-devtools-mcp
    version: 1.7.0
    commit: b58c613f4b05ade36bbf0d6ba44d5a525ec4d19a
    executable: chrome-devtools-mcp
    serverName: chrome-devtools
    transport: stdio
    clients: [codex, claude, opencode]
    risk: high
    network: true
    authenticated: false
    writes: false
    hooks: false
  dependency-cruiser:
    description: JavaScript and TypeScript dependency-boundary analysis.
    kind: cli
    source: https://github.com/sverweij/dependency-cruiser
    version: 18.2.0
    commit: ec603451d07d699280234808f91c4c8d3813f6e8
    executable: depcruise
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: false
    hooks: false
  agent-scan:
    description: Security scanner for agent, MCP, prompt, and skill supply chains.
    kind: cli
    source: https://github.com/snyk/agent-scan
    version: 0.5.17
    commit: ea959964ce4728426fca9fa78c9e7809b972f313
    executable: snyk-agent-scan
    versionArgs: [help]
    clients: [codex, claude, opencode]
    risk: high
    network: true
    authenticated: true
    writes: false
    hooks: false
  osv-scanner:
    description: Multi-ecosystem dependency vulnerability scanner.
    kind: cli
    source: https://github.com/google/osv-scanner
    version: 2.5.0
    commit: 0af25542cef1b8980cdad15d8bddc3d953cb2de2
    executable: osv-scanner
    clients: [codex, claude, opencode]
    risk: low
    network: true
    authenticated: false
    writes: false
    hooks: false
  zizmor:
    description: Static analysis for GitHub Actions.
    kind: cli
    source: https://github.com/zizmorcore/zizmor
    commit: b4393f9e92dcff49337fdba0a491e20640073a60
    executable: zizmor
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: false
    hooks: false
  promptfoo:
    description: Cross-model skill and agent behavior evaluation.
    kind: cli
    source: https://github.com/promptfoo/promptfoo
    version: 0.122.0
    commit: be44f8389bcd234e7144861957f670548ce85326
    executable: promptfoo
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: true
    hooks: false
  github-mcp:
    description: Official authenticated GitHub MCP server.
    kind: mcp
    source: https://github.com/github/github-mcp-server
    commit: d6cab9757ac577eecf1821ff167895a76b342beb
    serverName: github
    transport: http
    endpoint: https://api.githubcopilot.com/mcp/
    clients: [codex, claude, opencode]
    risk: high
    network: true
    authenticated: true
    writes: true
    hooks: false
  qmd:
    description: Local Markdown knowledge search.
    kind: cli
    source: https://github.com/tobi/qmd
    version: 2.5.3
    commit: 53232770867ccb16538c2c6034e7d891dffc9ce3
    executable: qmd
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: true
    hooks: false
  toolhive:
    description: Isolated MCP runtime, registry, and policy layer.
    kind: cli
    source: https://github.com/stacklok/toolhive
    commit: 52ad2932e0b41f2ad7cb37ac50abddd3556252c7
    executable: thv
    versionArgs: [version]
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: true
    hooks: false
  semgrep:
    description: Optional deep static security analysis.
    kind: cli
    source: https://github.com/semgrep/semgrep
    commit: 4fadea628509108b6b8b621236779f37bf52a08e
    executable: semgrep
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: false
    hooks: false
  trivy:
    description: Optional container, filesystem, and IaC security scanner.
    kind: cli
    source: https://github.com/aquasecurity/trivy
    version: 0.74.0
    commit: e1fd17a0ea4a8cf24bc4b4dd7e2cfbf4bb31b994
    executable: trivy
    clients: [codex, claude, opencode]
    risk: medium
    network: true
    authenticated: false
    writes: false
    hooks: false
  joern:
    description: Optional code-property-graph analysis engine.
    kind: cli
    source: https://github.com/joernio/joern
    version: 4.0.600
    commit: d661fa90174a423c5e9aa871280bd023b5ac526f
    executable: joern
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: true
    hooks: false
  d2:
    description: Optional polished diagram renderer.
    kind: cli
    source: https://github.com/d2lang/d2
    version: 0.8.1
    commit: 0a1b5d9be6f6956169c8a4e49f8b3a51bdf9ad9a
    executable: d2
    clients: [codex, claude, opencode]
    risk: low
    network: false
    authenticated: false
    writes: true
    hooks: false
  scip:
    description: Optional persistent symbol graph interchange.
    kind: cli
    source: https://github.com/scip-code/scip
    version: 0.9.0
    commit: e8ee0ae6038f8298e2195812eea9d7b1196748ae
    executable: scip
    clients: [codex, claude, opencode]
    risk: medium
    network: false
    authenticated: false
    writes: true
    hooks: false
  opentelemetry:
    description: Explicit opt-in telemetry export.
    kind: hook
    source: https://github.com/open-telemetry/opentelemetry-js
    commit: 96fc1622453047a1cb4173786a2eddfad595adb0
    clients: [codex, claude, opencode]
    risk: high
    network: true
    authenticated: false
    writes: true
    hooks: true