{
  "markdown": "# Trent agent plugin\n\nTrent, an AI security engineer. Review code, plans and configs for security problems, run threat models over a repo or website, and track remediation without leaving the editor.\n\n## Installing\n\nAdd the marketplace by repository name. `trnt-ai/trent-agent-plugin` is the only public\nmarketplace that carries Trent, and adding it by name is what ties the install\nto us. (A plugin manifest carries no signature, so the name is what you are\ntrusting; never add a marketplace from a URL to a file.)\n\nClaude Code:\n\n```\n/plugin marketplace add trnt-ai/trent-agent-plugin\n/plugin install trent@trent\n```\n\nCodex CLI:\n\n```\ncodex plugin marketplace add trnt-ai/trent-agent-plugin\ncodex plugin add trent@trent\n```\n\nCheck what you installed with `claude plugin details trent`. It prints\n`Source: trent@trent` and the manifest's identity fields.\n\n## Signing in\n\nThe plugin declares a remote MCP server and no credentials. Authentication\nhappens in the browser the first time a tool runs; there is no API key to paste\nand none is shipped here.\n\n## Verifying where a release came from\n\nEach release is one commit, and its message carries the revision it was built\nfrom:\n\n```\nPublished from source revision <sha>\n```\n\nRun `git log -1` in a clone of this repository to read it. The `<sha>` is an\nidentifier, not a link; there is nowhere to follow it to. What it gives you is\nan exact name for the build you are running: quote it to support and they can\nsay which release you have. If a copy of this plugin does not carry a message in\nthat form, it was not published by us.\n\nThe plugin manifest names `https://github.com/trnt-ai/trent-agent-plugin`, this repository, as\nits `repository`, and `trent.ai` as its `homepage`. A plugin claiming to be Trent\nfrom anywhere else is not ours.\n\n## Pinning a release\n\nEvery release is tagged `plugin-v<version>`, on the commit that release\npublished. `git tag -l` in a clone lists them. A tag here never moves: the\nrepository's rules refuse it, so a pin keeps resolving to the same files.\n\nOn a Team or Enterprise plan an admin can register this marketplace for everyone\nin `managed-settings.json`, pinned to a release. `ref` is the tag and `sha` is\nthe commit it names; with both set the `sha` is the pin and the `ref` says which\nrelease it came from:\n\n```json\n{\n  \"extraKnownMarketplaces\": {\n    \"trent\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"trnt-ai/trent-agent-plugin\",\n        \"ref\": \"plugin-v0.1.0\",\n        \"sha\": \"<the 40-character commit plugin-v0.1.0 names>\"\n      }\n    }\n  },\n  \"enabledPlugins\": { \"trent@trent\": true }\n}\n```\n\nRead the `sha` off the tag rather than copying one from anywhere else:\n\n```\ngit ls-remote https://github.com/trnt-ai/trent-agent-plugin refs/tags/plugin-v0.1.0 'refs/tags/plugin-v0.1.0^{}'\n```\n\nOne line back means the tag names that commit: pin it. Two lines back means\nthe tag is annotated: the line ending `^{}` names the commit, and that is the\none to pin.\n\nUpgrading is then a deliberate edit of those two fields, not something that\nhappens when someone reinstalls.\n\n## Getting help\n\nQuestions, bugs and feature requests reach us at <https://trent.ai> or through\nyour usual support channel; that is where they get answered.\n\nThis repository is published from Trent's build on each release; every file in\nit is generated, so it is not the place to file or fix anything.\n\n## Licence\n\nCopyright Trent AI. See [LICENSE](LICENSE) for the terms, and\n<https://trent.ai> for anything the terms do not answer.\n",
  "bytes": 3513,
  "sha": "503ddb4bfaeb5b9d4f549cc8fb2dd64276fed35efa38da4a6d49e79b0ddd21ad",
  "repo_slug": "trnt-ai/trent-agent-plugin",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_trent_trent_80eb1024/readme"
}