ph — Scan Claude Code / Codex CLI / Gemini CLI plugins for malicious hooks, poisoned SKILL.md, and MCP tool-poisoning *before* you install. Uses your local LLM CLI as the judge — no API key required.
{
"mcpServers": {
"plugin-hunter": {
"command": "npx",
"args": [
"-y",
"plugin-hunter"
]
}
}
}