[External Plugin]: little-canary

Review the marketplace submission against the plugin at hermes-labs-ai/little-canary, path plugins/claude-code, ref v0.3.8 and commit 3851078663b49b751c2cd246ca57eb89d534dc37. Start with the root plugin.json and the marketplace entry in .claude-plugin/marketplace.json, then run the install smoke test and verify the version and manifests match.

Plugin name

little-canary

Short description

Blocks a Claude Code turn when a local Little Canary server rejects the submitted prompt.

GitHub repository

hermes-labs-ai/little-canary

Plugin path inside the repository

plugins/claude-code

Ref to review

v0.3.8

Commit SHA to review

3851078663b49b751c2cd246ca57eb89d534dc37

Version

0.3.8

License identifier

Apache-2.0

Author name

Hermes Labs

Author URL

https://github.com/hermes-labs-ai

Homepage URL

https://littlecanary.ai

Keywords

prompt-injection, llm-security, agent-security, canary, hooks, security

Additional notes for reviewers

Listed in the Hermes Labs Copilot marketplace manifest (https://github.com/hermes-labs-ai/copilot-plugins/blob/main/.claude-plugin/marketplace.json) as a git-subdir source at path plugins/claude-code, now pinned to release tag v0.3.8 rather than tracking the main branch, so the marketplace entry and this submission reference the same immutable locator. Both the ref and the commit SHA are supplied above.

Resubmitting after fixing the cause of the earlier intake failure. The previous review failed the install smoke test and version match because the repository shipped only plugins/claude-code/.claude-plugin/plugin.json, which is the Claude Code convention and is not one of the locations the Agent Plugins 1.0.0 specification resolves. v0.3.8 adds a spec-compliant manifest at the plugin root, plugins/claude-code/plugin.json, carrying the required $schema, name, version and description. The Claude Code manifest under .claude-plugin/ is retained unchanged so existing Claude Code behavior is preserved, and a repository test keeps the two manifests from drifting.

This hook calls a Little Canary server that the user runs and configures locally; no server endpoint is bundled or defaulted by the plugin.

Submitted by the plugin's own maintainer (Hermes Labs).

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.