Add ai-plugin-scanner

[kantorcodes]

Project

Add ai-plugin-scanner, a Python security and quality scanner used to lint and verify AI plugin packages and local harness policy before release.

Why OSS-Fuzz

• The scanner parses and validates untrusted plugin metadata, marketplace manifests, MCP configuration, skills, and related package inputs.
• It already has an Atheris fuzz target in the upstream repository (fuzzers/manifest_fuzzer.py).
• The project also runs ClusterFuzzLite in CI today, so there is already an active fuzzing workflow to build on.
• This project sits on the release and security-review path for multi-ecosystem AI plugin packages (Codex, Claude, Gemini, OpenCode), so parser and validation hardening has supply-chain value beyond a single app.

Upstream repository

• Homepage: https://github.com/hashgraph-online/ai-plugin-scanner
• Main repo: https://github.com/hashgraph-online/ai-plugin-scanner

Contact

• Primary contact is the established maintainer email from the project commit history. If OSS-Fuzz needs a different Google-account-linked address for dashboard access, we can provide that during review.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

kantorcodes is integrating a new project:
- Main repo: https://github.com/hashgraph-online/ai-plugin-scanner
- Criticality score: 0.24780