ZCode Plugin Hub: 18 plugins, real use cases and the checks behind the claims
The interesting part of this collection is the work between writing code and trusting it: keeping context, finding unfinished edges, testing a visual change and preparing a release. I mapped every hub entry to a practical job, inspected17 public repositories and ran small helper checks. There is useful machinery here, alongside limits worth knowing before installation.
The interesting part of this collection is the work between writing code and trusting it: keeping context, finding unfinished edges, testing a visual change and preparing a release. I mapped every hub entry to a practical job, inspected 17 public repositories and ran small helper checks. There is useful machinery here, alongside limits worth knowing before installation.
What the inventory actually contains
Checked October 29, 2026: hub revision 2e683933589f9a7f98074b9d97a7e727b65ea052 lists 18 entries: 6 productivity, 9 vibe-coding, 2 extras and 1 recommended integration. The 15 core repositories each contain a marketplace manifest and plugin manifest; 14 include a Python helper, while Beginner Pilot is instructions only. Their checked manifests show 11 at 0.1.0 and 4 at 0.1.1. Each of those 15 LICENSE files contains MIT. MIT permits reuse under its terms; it is not a quality warranty. The owner submitted the hub for review. No ZCode session, model comparison, private account or paid service was used. Local fixtures are tiny functional checks, not performance measurements.
1. Last Mile
Use it before showing a nearly finished web app. edge_scan.py flags markers, placeholder content, debug debris and missing web basics, then the skill proposes one commit per accepted item. My two-line JavaScript fixture produced 4 findings: 1 high TODO and 3 medium items (console, missing robots, missing favicon). Exit 0 means the scan ran, not that the app passed. Triage false positives before allowing edits.
Last Mile · GitHub 4ce0e5cbb59d
2. Context Forge
Use HANDOFF before changing sessions on a checkout rewrite. The brief records decisions with evidence, invariants, file map and next steps; CONVENTIONS extracts code-backed rules for AGENTS.md. The Python helper only scaffolds the document. It created a dated empty-cart brief in my fixture, then refused a second write with exit 3. Filling that brief accurately remains agent work.
Context Forge · GitHub c8dd4b1cb690
3. Beginner Pilot
What changes, and why?
After the stepWhat happened?
Use it while building a first CSV-cleaning script. This is a narration skill, not another execution engine: explain each action before it, recap the result and append exact commands to pilot-notes.md. The skill requires confirmation for destructive steps and a short learning recap. There is no Python helper in this core plugin; the value depends on whether the coding agent follows those instructions.
Beginner Pilot · GitHub 09baf777a0dc
4. Skill Curator
Use it after collecting several overlapping skill packs. skill_catalog.py builds a local catalog, searches capability descriptions and audits duplicate names, missing frontmatter and stale script references. Removal has a backup path and an explicit --yes gate; installation starts with a file-list dry run. An audit of packaging is not a review of whether the imported instructions are safe or correct.
Skill Curator · GitHub a7a0481d0a61
5. Phone Bridge
Summary + selected log tail
Use it for a build-finished ping when away from the desk. tg_notify.py sends text and optional log-tail lines to Telegram with your own bot. The inspected helper calls sendMessage, not a polling or remote-shell endpoint. It is outbound notification, not phone approval. Review log tails for secrets before sending; no live Telegram message was sent in this review.
Phone Bridge · GitHub 648ee3ed1c45
6. Launchpad
Use it after tagging a release, not as a source of invented traction. The documented workflow combines commits, diffs and an audience/voice interview into 6 drafts: changelog, blog, X, LinkedIn, Reddit and Product Hunt, plus a fact manifest. Its helper groups git history; the agent still writes the prose. Drafting does not authorize publishing to any social account.
Launchpad · GitHub 560adbfaad8a
7. MCP Doctor
Use a read-only config check when a tool disappears. The Python helper discovers 5 client families and can probe initialize over stdio or HTTP; probes execute configured local commands. Start with --no-probe on unfamiliar configs. A synthetic nested mcpServers rewrite left the requested broken entry unchanged, because rewrite_config deletes at the top level. Do not rely on --fix without inspecting the backup and result; a handshake is not a successful business operation.
MCP Doctor · GitHub e40039a77c42
8. Usage Dashboard
Use it to compare where a week's tokens went across sessions and models. It parses local rollout JSONL and estimates money only with a supplied --prices file. My synthetic single turn with 1,000,000 input and 200,000 output tokens appeared correctly; without prices it explicitly declined a cost estimate. The README warns zero output-token proxy reports can make totals lower bounds. No account bill was read.
Usage Dashboard · GitHub 26fa49ad4e59
9. UI Polish
Use it to bring an inconsistent settings page toward an authorized reference design. design_tokens.py extracts colors, type, spacing, radii and shadows from CSS; the skill asks for small presentation-only edit batches and new screenshots. The extractor is regex-based, not a browser layout engine. My repeated-red fixture returned color count 1 despite 2 occurrences, so those counts are not frequency evidence. Check the rendered result, including behavior.
UI Polish · GitHub 27b3ce9b8e4a
10. Pixel Review
Use a stable screenshot pair to locate unintended UI changes by region. png_diff.py reports changed-pixel percentages and writes a red diff, with a configurable threshold. But identical-looking 4x2 RGB and opaque RGBA fixtures produced 75% difference locally: the RGBA branch advances 3 bytes per pixel where 4 are needed. Normalize to supported RGB and verify the decoder before treating a BLOCK as a real regression. Common-area cropping also needs a separate dimension check.
Pixel Review · GitHub 0e5d80d04de1
11. Root Cause
Use it for a checkout failure that has already survived several guesses. The documented loop demands a falsifiable symptom, runnable repro, a hypothesis and a confirming experiment before a patch, with at most 3 fix attempts. bisect_helper.py wraps git bisect and resets afterward. Run bisection in a clean disposable checkout: its supplied test command executes across historical code, not in a risk-free abstract simulation.
Root Cause · GitHub f5a41425cb5b
12. Ship Audit
Use it before exposing a service to real users. audit_scan.py reads source for secret patterns, debug flags, environment gaps and deployment markers; the wider skill separates static findings from dynamic/manual verification. A marker for authentication or rate limiting does not prove enforcement. Keep untested live flows marked unverified, and treat SHIP:GO as a checklist result, not a security certification.
Ship Audit · GitHub e38156c6f5b0
13. Dep Pin
Use it when an agent proposes an unfamiliar package/version. The helper reads npm/PyPI manifests and queries registries for existence and exact versions. It is not a lockfile solver or vulnerability audit. Its simplified evaluator accepted ^0.2.3 with latest 0.9.0 in my isolated check, which is not npm's intended caret range for that 0.x version. Keep your package manager's resolver authoritative.
Dep Pin · GitHub 706979ea1aa6
14. Git Story
Use it to draft a commit or PR from a real diff. The helper parses staged changes and supplies conventional-commit options, PR structure and weekly digest material. My staged two-line new file yielded generic subject options and an explicit note that intent was unknown. That honesty is useful: the helper cannot infer the business reason just because it counted changed lines. Review the draft before committing.
Git Story · GitHub 07c10c5359a2
15. Prompt Lab
Use its shared fixtures and declared rubric to design a prompt comparison, then inspect raw outputs. Our separate review of the same revision found run1 reuse, cumulative fixture scores and a verdict with pending manual judgments. Semantic properties are literal checks, not truth checks. It is a promising comparison protocol, but current scorer totals need regression fixes before selecting a winner.
Prompt Lab · GitHub e7e5027c6e65
Prompt Lab: full scorer review
16. Memecoin Kill Relay
The extra project documents 5 stages: scout, filter, analyst, paper-plan executor and final risk veto. Its README says it is based on an X post and was not verified or personally tested by the author. A useful research exercise would be rejecting an unverifiable claim and recording why, not trading. No wallet integration is shipped in the inspected files; that does not validate a coin or predict returns.
Memecoin Kill Relay · GitHub 0e1b7de5f055
17. Discord Research Agent
Discord Research Agent was privately developed for a company at its request and is therefore not public. The hub describes research through the user's logged-in Firefox and approval-gated replies. A possible use case is summarizing an authorized project channel. I did not inspect its private implementation or test its operation for this review.
18. ChatGPT Headless
The recommended integration ships a Node MCP server, Codex-token reuse, ask/panel tools and pre/post-edit hooks. A plausible use case is an independent review of a small, non-sensitive diff under your account's permissions and plan limits. Code sends selected material to OpenAI and stores redacted, truncated local transcripts; regex redaction is not a secrecy guarantee. The hub claims an official listing, but the fetched official marketplace file had no matching entry. Codex account sign-in documentation does not establish approval of this third-party token reuse. No login or backend call was tested.
ChatGPT Headless · GitHub af35c925321c
Build a small stack around a job
For a beginner's first app, pair Beginner Pilot with Context Forge: understandable steps plus a recoverable handoff. For an existing frontend, use UI Polish for deliberate styling, inspect screenshots yourself and validate Pixel Review's decoder before relying on it. For a release, combine a triaged Last Mile list, package-manager verification alongside Dep Pin, Ship Audit's explicit unknowns and Launchpad's fact sheet. These are proposed combinations, not an integration test. Add one plugin at a time to a disposable project, inspect its commands/hooks/MCP entries and keep commits, deletion, external messaging and account access under your own approval. The hub is an index, not a single install-all bundle. ZCode's current documentation uses Settings → Plugins and Personal/Create for added marketplaces; the README uses an older-looking Plugin Marketplace → Add path. Follow the labels in your installed client.