Skip to content

[External Plugin]: odin #6226

Closed
Closed

Description

@tiaanduplessis

Plugin name

odin

Short description

Bring your Odin security findings into your agent: read the remediation, fix the code, link the pull request and follow the retest.

GitHub repository

BorgDevelopment/odin-plugin

Plugin path inside the repository

No response

Ref to review

v0.3.3

Commit SHA to review

3aad62cc7a5bf657b65fbd2185a6cbe9d46d9a4c

Version

0.3.3

License identifier

MIT

Author name

Borg Research

Author URL

https://borghq.io

Homepage URL

https://docs.borghq.io/platform/odin-mcp

Keywords

security
vulnerabilities
pentest
remediation
mcp

Additional notes for reviewers

Odin is Borg's platform for pentest and continuous security findings. The plugin adds the hosted Odin MCP server (https://odin.borghq.io/api/mcp, Streamable HTTP) and two skills: set-up-odin and fix-odin-finding. It has no hooks, scripts or bundled binaries.

Users sign in with their Odin account through MCP OAuth (PKCE, with client registration by metadata document or dynamic registration), so no credentials are stored in the plugin. Tools act within the user's organisation and role; tools that change data are annotated destructiveHint: true, and none of them create commits, push branches, or open or merge pull requests. Using the tools needs an Odin account.

Submission checklist

  • The plugin lives in a public GitHub repository.
  • The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
  • This submission follows this repository's contribution, security, and responsible AI policies.
  • This plugin is not already listed in the Awesome Copilot marketplace.

Activity

  1. added
    awaiting-reviewSubmission is waiting for automated intake validation
    external-pluginPublic external plugin submission
    ready-for-reviewSubmission passed intake validation and is ready for maintainer review
    and removed
    awaiting-reviewSubmission is waiting for automated intake validation
    on Nov 3, 2026
  2. github-actions commented on Nov 3, 2026

    @github-actions
    Contributor

    ✅ External plugin intake passed

    This submission passed automated intake validation and quality checks and is ready for maintainer review.

    View workflow run · Download full quality gate logs

    Reviewer signals

    These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

    Signal Result
    Repository owner Organization-owned (third party)
    Repository age 0 day(s)
    Repository activity repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
    Repository counts 0 stars · 0 watchers · 0 forks · 0 open issues/PRs
    Homepage heuristics ⚠️ pricing

    Quality gate summary

    Legend: ✅ pass · ⚠️ warning · 🛑 fail

    Gate Status
    spec compliance ✅ pass
    vally lint ✅ pass
    install smoke test ✅ pass
    version match ✅ pass
    ref/sha consistency ✅ pass
    canvas structure ⚪ not_run
    • spec compliance: pass
    • vally lint: pass
    • install smoke test: pass
    • version match: pass
    • ref/sha consistency: pass
    • canvas structure: not_run
    • overall: pass
    spec compliance output (✅ pass)
    Agent Plugins v1.0.0 manifest checks passed for plugin.json.
    
    vally lint output (✅ pass)
    ✅ fix-odin-finding (2/2 checks passed)
        ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
            ✓ spec-compliance: All spec checks passed.
        ✓ [valid-refs] All file references across 1 skill(s) are valid.
            ✓ valid-refs: All file references resolve to existing files within the skill directory.
    ✅ set-up-odin (2/2 checks passed)
        ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
            ✓ spec-compliance: All spec checks passed.
        ✓ [valid-refs] All file references across 1 skill(s) are valid.
            ✓ valid-refs: All file references resolve to existing files within the skill directory.
    
    2 skill(s) linted, 2 passed
    
    install smoke test output (✅ pass)
    Install smoke test succeeded. Verified /tmp/external-plugin-quality-6ydOyj/copilot-home/.copilot/installed-plugins/external-plugin-intake/odin/plugin.json.
    
    Version match output
    - v0.3.3: matched version "0.3.3" at "plugin.json".
    - 3aad62cc7a5bf657b65fbd2185a6cbe9d46d9a4c: matched version "0.3.3" at "plugin.json".
    
    Ref/SHA consistency output
    source.ref "v0.3.3" resolves to the same commit as source.sha "3aad62cc7a5bf657b65fbd2185a6cbe9d46d9a4c".
    
    Canvas structure output
    Canvas structure gate skipped because plugin is not tagged with "canvas".
    

    Canonical external.json payload

    {
      "name": "odin",
      "description": "Bring your Odin security findings into your agent: read the remediation, fix the code, link the pull request and follow the retest.",
      "version": "0.3.3",
      "author": {
        "name": "Borg Research",
        "url": "https://borghq.io"
      },
      "repository": "https://github.com/BorgDevelopment/odin-plugin",
      "homepage": "https://docs.borghq.io/platform/odin-mcp",
      "license": "MIT",
      "keywords": [
        "security",
        "vulnerabilities",
        "pentest",
        "remediation",
        "mcp"
      ],
      "source": {
        "source": "github",
        "repo": "BorgDevelopment/odin-plugin",
        "ref": "v0.3.3",
        "sha": "3aad62cc7a5bf657b65fbd2185a6cbe9d46d9a4c"
      }
    }
  3. aaronpowell commented on Nov 4, 2026

    @aaronpowell
    Contributor

    /reject The useful remediation guidance is tied to findings and retests in Borg's hosted platform, while the other skill primarily guides users through onboarding that service. The package does not provide an independent findings workflow or demonstrate enough standalone Copilot value beyond operating the vendor connector. This is not a fit for this marketplace in its current form.

  4. added
    rejectedSubmission was rejected by a maintainer
    and removed
    ready-for-reviewSubmission passed intake validation and is ready for maintainer review
    on Nov 4, 2026
  5. github-actions commented on Nov 4, 2026

    @github-actions
    Contributor

    ❌ External plugin rejected

    A maintainer rejected odin, and the submission issue has been closed.

    Reason

    The useful remediation guidance is tied to findings and retests in Borg's hosted platform, while the other skill primarily guides users through onboarding that service. The package does not provide an independent findings workflow or demonstrate enough standalone Copilot value beyond operating the vendor connector. This is not a fit for this marketplace in its current form.

    This issue is now closed and /rerun-intake will no longer reopen it. If you address the feedback, please open a new external plugin submission issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    external-pluginPublic external plugin submissionrejectedSubmission was rejected by a maintainerthird party

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions