---
title: "Verified plugins"
description: "The plugins Orchestrator Zero publishes itself, under ai.oz0, with names nobody else may take."
canonical_url: "https://docs.oz0.ai/build/plugins/verified"
---
# Verified plugins

> The plugins Orchestrator Zero publishes itself, under ai.oz0, with names nobody else may take.

For: tenant administrators and plugin users.

Choose a verified plugin when its tools and agents fit your task. The project publishes these plugins under the `ai.oz0` namespace using the same interfaces available to other authors.

The hub reserves their names: tool IDs start with `oz0_` and agent names with `oz0-`. Other publishers cannot use those prefixes.

Their agents ask for the tenant's [standard model aliases](https://docs.oz0.ai/spend/models-and-keys/aliases#the-standard-aliases) (`default`,
`fast`, `smart`) with what they need, never a vendor's model, so each runs on whichever provider a tenant set up: an
OpenAI-only or Mistral-only tenant runs them as an Anthropic one does. A verified agent names a vendor's model only
with `model.vendor_reason`, the vendor's own feature it needs.

<table>
<thead>
  <tr>
    <th>
      Plugin
    </th>
    
    <th>
      For
    </th>
    
    <th>
      Tool
    </th>
    
    <th>
      Agent
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/github">
        ai.oz0/github
      </a>
    </td>
    
    <td>
      Repositories, issues and pull requests on GitHub, connected as a GitHub App
    </td>
    
    <td>
      <code>
        oz0_github
      </code>
    </td>
    
    <td>
      <code>
        oz0-github
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/servicenow">
        ai.oz0/servicenow
      </a>
    </td>
    
    <td>
      IT service management: a ServiceNow instance's incidents, requested items and tasks on its Table API, on an OAuth app of your own, with ServiceNow's own MCP server as an option where you have Now Assist
    </td>
    
    <td>
      <code>
        servicenow
      </code>
    </td>
    
    <td>
      <code>
        servicenow
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/web">
        ai.oz0/web
      </a>
    </td>
    
    <td>
      Web search with your backend, and pages fetched inside the egress allowlist
    </td>
    
    <td>
      <code>
        oz0_web
      </code>
    </td>
    
    <td>
      <code>
        oz0-web-research
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/net-diag">
        ai.oz0/net-diag
      </a>
    </td>
    
    <td>
      Networking: DNS, TCP, HTTP, TLS and the route from a node
    </td>
    
    <td>
      <code>
        oz0_net_diag
      </code>
    </td>
    
    <td>
      <code>
        oz0-net-diag
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/cve-triage">
        ai.oz0/cve-triage
      </a>
    </td>
    
    <td>
      Security: known vulnerabilities in a checkout's dependencies
    </td>
    
    <td>
      <code>
        oz0_cve_triage
      </code>
    </td>
    
    <td>
      <code>
        oz0-cve-triage
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/host-health">
        ai.oz0/host-health
      </a>
    </td>
    
    <td>
      IT operations: a node's health for the person on call
    </td>
    
    <td>
      <code>
        oz0_host_health
      </code>
    </td>
    
    <td>
      <code>
        oz0-host-health
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/pr-reviewer">
        ai.oz0/pr-reviewer
      </a>
    </td>
    
    <td>
      Software engineering: pull request reviews with the tests run in a sandbox
    </td>
    
    <td>
      <code>
        oz0_pr_reviewer
      </code>
    </td>
    
    <td>
      <code>
        oz0-pr-reviewer
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      ai.oz0/merge-when-green (<a href="https://docs.oz0.ai/build/plugins/github#the-merge-when-green-flow">
        GitHub
      </a>
      
      )
    </td>
    
    <td>
      Software engineering: a pull request merged once its checks are green, through ai.oz0/github
    </td>
    
    <td>
      none
    </td>
    
    <td>
      none (a flow)
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/ai-spend">
        ai.oz0/ai-spend
      </a>
    </td>
    
    <td>
      Finance and security: what the company spends at Anthropic and OpenAI directly, by team, from their admin APIs
    </td>
    
    <td>
      <code>
        oz0_ai_spend
      </code>
    </td>
    
    <td>
      none (a flow and a daily routine)
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/guardrails">
        ai.oz0/guardrails
      </a>
    </td>
    
    <td>
      Personal data and secrets redacted from results and outputs, an injection check, a check of each call's fit to the job and a guard for harness shell commands, both of which may only ask a person, on every tool call of the tenant once installed
    </td>
    
    <td>
      <code>
        oz0_guardrails
      </code>
    </td>
    
    <td>
      <code>
        oz0-guardrails-check
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/memory">
        ai.oz0/memory
      </a>
    </td>
    
    <td>
      Notes, decisions and definitions agents keep beyond a job, the accepted ones in their start-up context
    </td>
    
    <td>
      <code>
        oz0_memory
      </code>
    </td>
    
    <td>
      <code>
        oz0-decision-log
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/setup-assistant">
        ai.oz0/setup-assistant
      </a>
    </td>
    
    <td>
      Getting started and governance: explains your tenant, plans changes you approve, drafts tool rules from plain English
    </td>
    
    <td>
      <code>
        oz0_setup
      </code>
    </td>
    
    <td>
      <code>
        oz0-setup-assistant
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/public-access">
        ai.oz0/public-access
      </a>
    </td>
    
    <td>
      Public authorities: a public-access copy of records with masking a person decides, and an E-ARK archive package, from a signed export
    </td>
    
    <td>
      <code>
        oz0_public_access
      </code>
    </td>
    
    <td>
      none (a command a registrar runs)
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/atlassian">
        ai.oz0/atlassian
      </a>
    </td>
    
    <td>
      Jira, Confluence and JSM Operations on Atlassian Cloud, through Atlassian's own Rovo MCP server on your own OAuth client
    </td>
    
    <td>
      <code>
        atlassian
      </code>
      
      , <code>
        atlassian_jsm
      </code>
    </td>
    
    <td>
      <code>
        atlassian
      </code>
      
       (a delegate)
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/atlassian-dc">
        ai.oz0/atlassian-dc
      </a>
    </td>
    
    <td>
      Jira and Confluence Data Center, imported from Atlassian's own OpenAPI documents, with Jira's webhooks as events
    </td>
    
    <td>
      <code>
        atlassian_dc_jira
      </code>
      
      , <code>
        atlassian_dc_confluence
      </code>
      
      , <code>
        atlassian_dc_events
      </code>
    </td>
    
    <td>
      none
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/email">
        ai.oz0/email
      </a>
    </td>
    
    <td>
      Mail agents send to the tenant's own domains, with the AI label and approval by default, through the operator's relay or Microsoft Graph
    </td>
    
    <td>
      <code>
        oz0_email
      </code>
    </td>
    
    <td>
      <code>
        email
      </code>
      
       (a delegate)
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/gitlab">
        ai.oz0/gitlab
      </a>
    </td>
    
    <td>
      Software engineering: GitLab's issues, merge requests, pipelines and repositories through GitLab's own MCP server, on GitLab.com or your own instance, and its webhooks as events
    </td>
    
    <td>
      <code>
        gitlab
      </code>
      
       (and <code>
        gitlab_events
      </code>
      
      )
    </td>
    
    <td>
      <code>
        gitlab
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/support-triage">
        ai.oz0/support-triage
      </a>
    </td>
    
    <td>
      IT and customer support: new tickets in Jira Service Management or ServiceNow triaged, routed, noted and acknowledged by mail, on whichever ticket system the tenant has
    </td>
    
    <td>
      <code>
        support_triage
      </code>
    </td>
    
    <td>
      <code>
        support-triage-agent
      </code>
      
       (and the flow <code>
        support-triage
      </code>
      
      )
    </td>
  </tr>
  
  <tr>
    <td>
      <a href="https://docs.oz0.ai/build/plugins/verified/plugin-improver">
        ai.oz0/plugin-improver
      </a>
    </td>
    
    <td>
      Improve: an agent that proposes reviewed, evidence-backed changes to your plugins, each approved by a person before a draft pull request opens
    </td>
    
    <td>
      <code>
        oz0_plugin_improver
      </code>
    </td>
    
    <td>
      <code>
        improver
      </code>
      
       (and the flow <code>
        improve-plugin
      </code>
      
      )
    </td>
  </tr>
</tbody>
</table>

[Essentials](https://docs.oz0.ai/build/plugins/verified/essentials) (`ai.oz0/essentials`) is a verified [set](https://docs.oz0.ai/build/plugins/sets): github, email,
atlassian, servicenow, web, memory, pr-reviewer, merge-when-green and support-triage, at versions chosen to run
together, installed as one decision.

Slack and Discord (`ai.oz0/slack`, `ai.oz0/discord`) are verified too: see [chat channels](https://docs.oz0.ai/build/apps/chat-channels).
Microsoft Teams (`ai.oz0/teams`) is verified too: see [Microsoft Teams](https://docs.oz0.ai/build/plugins/verified/teams).
Outside A2A agents run on `ai.oz0/a2a-remote`, which has no tool or agent of its own, with the presets
`ai.oz0/a2a-agentcore` and `ai.oz0/a2a-foundry` (agents `oz0-agentcore` and `oz0-foundry`): see
[ai.oz0/a2a-remote](https://docs.oz0.ai/build/plugins/verified/a2a-remote).

`ai.oz0/sandbox-e2b` is not on this list because it is not a plugin a tenant installs: it is the backend a node's
operator runs for [remote sandboxes](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#remote-sandboxes) on E2B-compatible services.

## What verified means

"Verified" means the project tested, pinned and secured the plugin, never that a system's vendor endorses it. Every
verified plugin keeps the house rules of [How to structure plugins](https://docs.oz0.ai/build/plugins/structure), which the project's
tests check with `oz0 plugin lint --verified` (every rule an error), and holds to these, which its tests check too:

- Every function says what it does. Each carries `readOnlyHint`, `destructiveHint` and `openWorldHint`, so your
[tool policy](https://docs.oz0.ai/govern/tool-policy) can retry, approve or refuse it by kind, and a [shadow run](https://docs.oz0.ai/build/plugins/install)
knows what it may call.
- Every agent has a contract: its input and output, as text or a JSON Schema ([contracts](https://docs.oz0.ai/build/parts/contracts-and-limits)).

### Every plugin has evals that replay without a model

The evals use recorded model answers or flow steps, so CI runs them offline; `oz0 plugin test plugins/<name>` runs them. Their expectations are what each prompt makes a model write, not a tool's JSON, and their cases need nothing a tenant must set or allow, so the [quality gate](https://docs.oz0.ai/improve/evals) of a first install runs them with your models and passes on a fresh tenant. `make starter-results MODEL=<provider>/<model>` runs the four starters' cases live on a model, with harder ones (`evals/measured/`) that no gate runs, and records the pass rate, tokens and cost ([measured results](https://docs.oz0.ai/improve/measured-results)).

- What reaches hosts stays inside the egress allowlist. A function that reaches hosts for a model (a fetch, a
probe, an advisory lookup) checks each target against the tenant's list and its plugin's own, on every node, not
only in the sandbox; it connects to the address it checked and never to the node itself, its link or a metadata
service by name. A refusal names the host and the command that allows it.
- Settings are settings, keys are secrets. Addresses, backends and switches are tenant settings
(`requires.settings`), shown and never scanned for as secrets; an API key a backend may need is an optional secret
(`requires.optional_secrets`). Both carry the plugin's prefix (`WEB_`, `CVE_TRIAGE_`): a verified plugin installs and
starts with none set, says which to set when a function needs one, and never reads another plugin's this way.
Installs and listings name them ([Secrets](https://docs.oz0.ai/admin/secrets/settings#settings-are-not-secrets)).
- Untrusted code runs only in sandbox tier 1. pr-reviewer runs a pull request's tests in a sandbox of their own,
with no secret and no network but the tenant's allowlist, and refuses on a node without one. It holds no token
either: it downloads the code through ai.oz0/github, so a webhook's review runs its tests too.

### Verified; model changed by the tenant

A tenant may send a verified plugin's agents to other models with a [mapping rule](https://docs.oz0.ai/spend/models-and-keys/mapping#map-a-plugins-models).
The plugin stays verified: the rule lives outside it, so its signature, its pins and its updates are untouched. Its
evals ran on its author's model, so the plugin's page, `oz0 plugin show` and its agents' capability cards say
verified; model changed by the tenant, and offer its evals on the new model and a paired comparison of the old and
the new one.

## Install one

```bash [Terminal]
oz0 plugin install hub:ai.oz0/net-diag
```

The hub is not public yet; until it is, install from a checkout of the repository:
`oz0 plugin install plugins/net-diag`. Each page below says what to set and allow first. Most verified plugins name
hosts in their `egress`, so their install waits as a change request until a tenant admin approves it (`oz0 change approve`), or installs at once with `--approve-egress` when you may approve: see
[Reviewed changes](https://docs.oz0.ai/govern/reviewed-changes).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.