pincushion — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pincushion (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Teammates and clients pin feedback on your live app in Pincushion. Each pin is a work packet for your coding agent: page URL, CSS selector, screenshot, DOM snippet, viewport and the comment thread. The Pincushion MCP server (pincushion-mcp on npm) lets your agent read the pins, implement the approved ones in your repository and record the commit on each pin.
This repository is the install source for the Claude Code and Codex plugin marketplaces and the Cursor plugin.
claude plugin marketplace add jcooley8/pincushion-plugin
claude plugin install pincushion@pincushioncodex plugin marketplace add jcooley8/pincushion-pluginThen enable Pincushion from the Plugins list.
Add Pincushion MCP to Cursor in one click, or add the server below to .cursor/mcp.json in your repository.
Install Pincushion Feedback from the Visual Studio Marketplace, or add the server below with MCP: Add Server from the Command Palette.
Add this server to the client's MCP settings, with your repository's path:
{
"mcpServers": {
"pincushion": {
"command": "npx",
"args": ["-y", "pincushion-mcp", "--project-dir", "/path/to/your/repo"]
}
}
}In your app's repository, run:
npx -y pincushion-mcp setupIt signs you in, links the repository to a Pincushion project and prepares the editor you choose. Then ask your agent: "show my open Pincushion pins".
The Pincushion browser extension is optional. Pins can come from shared review links, Pincushion AI critiques, other agents and the REST API.
Requires Node.js 22.22 or newer.
The plugin files in this repository are MIT licensed. The pincushion-mcp package they install carries its own license, published with the package on npm.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.