ECZ-ID Plugin Trust

Review who publishes a plugin, what it declares, and what changed before you rely on it.

Free, local-first. No account is required to run a workspace review, and source code, prompts, credentials and secret values are not uploaded.

Useful for

• VS Code / Open VSX extension maintainers and reviewers
• plugin and app-marketplace publishers
• platform and AppSec teams reviewing third-party plugins
• organisations that need a stable identity for a plugin across releases and marketplaces

What it looks for

ECZ-ID Plugin Trust reviews local evidence such as plugin/extension manifests, marketplace metadata, publisher references, permission/capability declarations and release/package files. Results are evidence observations, not an approval or certification.

What you can do in under a minute

1. Open a trusted workspace containing the plugin or extension.
2. Run ECZ-ID Plugin Trust: Review Workspace.
3. Review the observed and not-observed evidence locally.
4. Resolve existing public proof, request current proof from a third party, or continue to the free Plugin Passport if you operate the subject.

Example use cases

• Check whether a plugin manifest and publisher/repository evidence are present before installation review.
• Re-run after a release to see whether the evidence surface has materially changed.
• Give a plugin a persistent ECZ-ID Plugin Passport that can be resolved independently of one marketplace listing.
• Request current evidence from a plugin supplier without treating missing proof as evidence that the plugin is unsafe.

Result semantics

The extension uses neutral evidence language: observed, not observed, unknown where applicable, review recommended, and re-check before reliance. Local policy decides whether the available evidence is sufficient.

A free Plugin Passport identifies the plugin subject. It is not a security certification, approval or guarantee. Stronger Parent verification and operating services such as publisher / permission integrity are separate optional layers.

Privacy & permissions

Free vs operating services

• Free: local evidence review and permanent core Plugin Passport identity.
• Optional paid layer: stronger Parent verification, managed currentness and operating controls where required.
• Buying an operating service never creates a different identity for the plugin; identity and paid operations remain separate.

Machine-readable facts

First use

Install ECZ-ID Plugin Trust, open a trusted workspace, then run ECZ-ID Plugin Trust: Review Workspace from the Command Palette.

ECZ-ID is independent trust infrastructure. Third-party names describe compatible ecosystems only and do not imply endorsement or affiliation.