RagLeapOn 2026-10-10, pull request #664 was merged into hashgraph-online/awesome-ai-plugins, a curated catalog of plugins for AI assistants. RagLeap now has an entry under "Development & Workflow", and the catalog's bot confirmed that it is listed in the HOL Registry. This post explains what the review involved, with the numbers as they appeared in the pull request, and what the listing does and does not mean.
What happened, in order
| Date | Step |
|---|---|
| Oct 8 | We opened the pull request with a one-line entry for RagLeap, using a description suggested by Michael Kantor on LinkedIn. The catalog's required checks passed, but its centralized scan scored the repository 62 out of 100, below the 80-point minimum. |
| Oct 9 | A later centralized scan gave 71. Reviewers asked us to reproduce the score with the catalog's pinned scanner, fix or document each finding, and request a rescan. |
| Oct 9 | After the fixes described below, a run with the catalog's scanner settings gave 94 out of 100, and the fresh centralized score was also 94. |
| Oct 9 | A reviewer pointed out that the repository's default branch had no plugin manifest the catalog could use, so the entry would have a missing install link, and asked us to identify the installable plugin. |
| Oct 10 | We added the manifest and a small plugin on the default branch. A scan on main with the manifest counted gave 93 out of 100. The pull request was approved and merged. |
Why the first score was low
RagLeap is a self-hosted AI employee platform, not a Codex, Claude or MCP plugin. We said so in the pull request: the plugin-specific checks do not apply to a platform like ours. That includes the whole 25-point manifest block, the skill and marketplace checks, the ignore-file check, and the MCP and skill scans, which are skipped when there is no plugin manifest. The first score has to be read with that in mind. It also contained real findings in our own repository.
What the findings were
The scanner reported 25 high-severity findings: 23 matches for hardcoded-secret patterns and 2 for dynamic code execution. As described in the pull request, all of them were harmless text rather than live problems: fake credentials in test fixtures and documentation, one installer variable name, a docstring that mentioned eval, and a list of forbidden strings used by a test. We renamed or reworded them. No application behaviour changed, and the calculator code is identical apart from its docstring.
We chose not to add a scanner configuration, a baseline or an ignore file, so the scanner sees the repository as it is. One medium finding remains: the root requirements.txt has no dependency lockfile. It does not block the catalog's gate, and we are looking at it separately.
The installable plugin
To give the catalog something to install, the default branch of ragleap-core now contains a plugin manifest at .codex-plugin/plugin.json and a plugin at skills/ragleap. According to the pull request discussion, it is a read-only skill for coding agents with three commands (health, employees and ask) that talks to a RagLeap server you already run. It uses only the Python standard library, and the API key is read from the environment only. It arrived through ragleap-core pull request #657.
One honest detail: this plugin is on the main branch only. As of 2026-10-10 the latest tagged release is v0.9.0, which was published before the plugin was merged. RagLeap itself is still the self-hosted platform, and the plugin is a thin client for it.
What the listing means, and what it does not
- It means RagLeap passed the catalog's automated checks at a score above its minimum, and a human reviewer approved the entry.
- It is not a security audit of RagLeap and not an endorsement. The score belongs to the catalog's scanner, measured on our repository on a given day.
- The catalog reviewers also asked us to be precise about what is installable. That is why this post separates the platform from the plugin.
What we would tell the next project that submits
- Reproduce the score with the catalog's own pinned scanner. Our source repository already ran a scanner workflow, but with an older pin and a lower threshold, so its passing run did not establish the catalog score.
- Fix findings by renaming or rewording, and document the rest. Adding an ignore file hides the problem from the scanner, not from the next reader.
- Make the installable target obvious in the default branch, because the catalog's generator looks for a manifest there.
Links
The pull request is hashgraph-online/awesome-ai-plugins #664. Our listing is at hol.org/registry/plugins/antonyrag/ragleap, and it carries the registry's owner-verified badge. The catalog is run by Hashgraph Online, and its plugin pages are at hol.org/plugins. Our repository is on GitHub, and the community write-ups are on the homepage. To run RagLeap yourself, start with the install guide.