Skip to content

[External Plugin]: controlloop #6003

Open

Description

@controlloop-security

Plugin name

controlloop

Short description

Ask Copilot what a branch lets your AI agents do. Runs the open-source ControlLoop CLI locally against the default branch and explains the verdict, each authority change, and each finding with its rule documentation. Read-only.

GitHub repository

controlloop-security/controlloop-plugins

Plugin path inside the repository

No response

Ref to review

v0.1.1

Commit SHA to review

083d04382a0c48697f111d2b3894862d643a1636

Version

0.1.1

License identifier

Apache-2.0

Author name

ControlLoop

Author URL

https://controlloop.ai

Homepage URL

No response

Keywords

security
agents
mcp
hooks
permissions
code-review

Additional notes for reviewers

  • The plugin is the repository root: an Agent Plugins 1.0 plugin.json with one skill (skills/controlloop). It declares no hooks and no MCP server, so nothing starts with a session.
  • The skill runs the controlloop CLI on the user's PATH, or uvx controlloop after asking the user. It never installs anything itself and never edits configuration.
  • The CLI makes no network calls on its own. If a repository opts into ControlLoop Team (team_enabled = true plus CONTROLLOOP_TEAM_TOKEN), controlloop gate sends a scan summary to Team; the skill asks before such a run. This is described in the README's Data section.
  • Install for testing: copilot plugin marketplace add controlloop-security/controlloop-plugins, then copilot plugin install controlloop@controlloop.

Submission checklist

  • The plugin lives in a public GitHub repository.
  • The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
  • This submission follows this repository's contribution, security, and responsible AI policies.
  • This plugin is not already listed in the Awesome Copilot marketplace.

Activity

  1. github-actions commented on Oct 30, 2026

    @github-actions
    Contributor

    🟡 Contributor Reputation Check: MEDIUM risk

    Check Risk
    Profile MEDIUM
    Credential audit NONE

    Maintainers: please review this contributor before merging.
    See the workflow run for full details.
    Automated check powered by AGT.

  2. added
    needs-review:MEDIUMContributor reputation check flagged MEDIUM risk
    ready-for-reviewSubmission passed intake validation and is ready for maintainer review
    and removed
    awaiting-reviewSubmission is waiting for automated intake validation
    on Oct 30, 2026
  3. github-actions commented on Oct 30, 2026

    @github-actions
    Contributor

    ✅ External plugin intake passed

    This submission passed automated intake validation and quality checks and is ready for maintainer review.

    View workflow run · Download full quality gate logs

    Reviewer signals

    These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

    Signal Result
    Repository age 0 day(s)
    Repository activity repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
    Repository counts 0 stars · 0 watchers · 0 forks · 0 open issues/PRs

    Quality gate summary

    Legend: ✅ pass · ⚠️ warning · 🛑 fail

    Gate Status
    spec compliance ✅ pass
    vally lint ✅ pass
    install smoke test ✅ pass
    version match ✅ pass
    ref/sha consistency ✅ pass
    canvas structure ⚪ not_run
    • spec compliance: pass
    • vally lint: pass
    • install smoke test: pass
    • version match: pass
    • ref/sha consistency: pass
    • canvas structure: not_run
    • overall: pass
    spec compliance output (✅ pass)
    Agent Plugins v1.0.0 manifest checks passed for plugin.json.
    
    vally lint output (✅ pass)
    ✅ controlloop (2/2 checks passed)
        ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
            ✓ spec-compliance: All spec checks passed.
        ✓ [valid-refs] All file references across 1 skill(s) are valid.
            ✓ valid-refs: All file references resolve to existing files within the skill directory.
    
    1 skill(s) linted, 1 passed
    
    install smoke test output (✅ pass)
    Install smoke test succeeded. Verified /tmp/external-plugin-quality-89ibUg/copilot-home/.copilot/installed-plugins/external-plugin-intake/controlloop/plugin.json.
    
    Version match output
    - v0.1.1: matched version "0.1.1" at "plugin.json".
    - 083d04382a0c48697f111d2b3894862d643a1636: matched version "0.1.1" at "plugin.json".
    
    Ref/SHA consistency output
    source.ref "v0.1.1" resolves to the same commit as source.sha "083d04382a0c48697f111d2b3894862d643a1636".
    
    Canvas structure output
    Canvas structure gate skipped because plugin is not tagged with "canvas".
    

    Canonical external.json payload

    {
      "name": "controlloop",
      "description": "Ask Copilot what a branch lets your AI agents do. Runs the open-source ControlLoop CLI locally against the default branch and explains the verdict, each authority change, and each finding with its rule documentation. Read-only.",
      "version": "0.1.1",
      "author": {
        "name": "ControlLoop",
        "url": "https://controlloop.ai"
      },
      "repository": "https://github.com/controlloop-security/controlloop-plugins",
      "license": "Apache-2.0",
      "keywords": [
        "security",
        "agents",
        "mcp",
        "hooks",
        "permissions",
        "code-review"
      ],
      "source": {
        "source": "github",
        "repo": "controlloop-security/controlloop-plugins",
        "ref": "v0.1.1",
        "sha": "083d04382a0c48697f111d2b3894862d643a1636"
      }
    }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    external-pluginPublic external plugin submissionneeds-review:MEDIUMContributor reputation check flagged MEDIUM riskready-for-reviewSubmission passed intake validation and is ready for maintainer review

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions