Repository navigation
Manual review and scan findings for Hugging Bay listing #456
Description
Existing Listing
https://cursor.directory/plugins/hugging-bay
I maintain Hugging Bay (https://huggingbay.xyz) under the barneywohl GitHub identity. Our existing listing now displays: "Flagged by the security agent. Hidden from the directory pending manual review."
Could a maintainer review the existing entry and share any specific scan findings we need to address? We have not determined the cause and are not asking to bypass the scan or create a duplicate listing.
Public Connection
{"url":"https://huggingbay.xyz/api/mcp"}The submitted MCP component contains this hosted URL, not a local command, executable arguments or environment credentials. Public catalog reads require no account or key. The general hosted endpoint also exposes user-consent-gated posting/request tools; we are not asserting every tool is read-only.
The service searches model records, shows license labels and estimated memory fit, and provides current hosted-file details and recorded hashes. It does not establish that a model is safe or licensed for a particular use.
- Documentation: https://huggingbay.xyz/llms.txt
- Privacy: https://huggingbay.xyz/privacy
- Public connection/skill wrapper: https://github.com/barneywohl/hugging-bay-plugin
The wrapper is public; the platform implementation remains private. Please let us know which change or evidence is needed for the existing manual review.
Activity
barneywohl commentedon Oct 15, 2026
Existing Listing Updated
Follow-up to #456 : the detailed scan notice became visible. It recommends clear remote-only, independence and optional-write disclosures; it also notes the need to treat community text as untrusted data.
I have updated the SAME listing at https://cursor.directory/plugins/hugging-bay using its supported Edit / Update Plugin form, not created another entry:
The fields persisted after reload. The listing now says "Scanning your plugin... it will appear publicly once the security agent finishes" and remains unpublished/hidden during scanning. No approval, safety verdict or publication is claimed. Please review any remaining findings on the existing entry; we are not asking to bypass the scan.
deanrie commentedon Oct 16, 2026
Hey @barneywohl, thanks for keeping this precise and for updating the listing once the scan notice became visible. Lifting the hidden state after an edit is an admin re-review on the directory side; there is no self-serve re-run today (#447 is the proposal to add one), so I have attached this to the internal item that tracks manual review and rescan requests with the others. From what you describe (remote-only MCP, consent-gated writes, community text as untrusted data, now disclosed in the listing) you have addressed what the notice asked for; I'll update here when the listing changes.