[External Plugin]: armorcopilot

[Harihara04sudhan]

Plugin name

armorcopilot

Short description

Intent-based security enforcement for GitHub Copilot CLI and VS Code agent mode. Hooks every tool call against a declared intent plan and natural-language policy rules; blocks intent drift; ships signed audit logs to the ArmorIQ backend.

GitHub repository

armoriq/armorCopilot

Plugin path inside the repository

plugins/armorcopilot

Ref to review

v0.1.0

Commit SHA to review

1ea972464670e7fce497c4c99dafcab60cc4b123

Version

0.1.0

License identifier

MIT

Author name

ArmorIQ

Author URL

https://armoriq.ai

Homepage URL

https://docs.armoriq.ai/armorcopilot

Keywords

security
policy
audit
intent
armoriq
mcp
hooks
github-copilot

Additional notes for reviewers

Plugin hooks fire on sessionStart, userPromptSubmitted, preToolUse, postToolUse, permissionRequest, postToolUseFailure, agentStop, sessionEnd. MCP server exposes three tools: register_intent_plan, policy_update, policy_read. Auto-discovered by VS Code Copilot Chat agent mode from ~/.copilot/installed-plugins/.

Curl-pipe installer (live): curl -fsSL https://armoriq.ai/install_armorcopilot.sh | bash — aborts and rolls back if the user declines to connect their ArmorIQ account (no offline mode by design).

Full docs: https://docs.armoriq.ai/armorcopilot

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

⚠️ External plugin intake requires submitter fixes

This submission passed metadata validation, but quality gates found issues that must be fixed before it can move to maintainer review. Update the issue details or source plugin and then comment /rerun-intake.

• Plugin: armorcopilot
• Repository: https://github.com/armoriq/armorCopilot
• Ref: v0.1.0
• SHA: 1ea972464670e7fce497c4c99dafcab60cc4b123

Quality gate summary

Gate	Status
skill-validator	fail
install smoke test	fail

• skill-validator: fail
• install smoke test: fail
• overall: fail

skill-validator output

❌ No plugin.json found in '/tmp/external-plugin-quality-9F66U8/submission/plugins/armorcopilot'

Install smoke test output

Plugin installed but no plugin.json was found in any recognized location under /tmp/external-plugin-quality-9F66U8/copilot-home/.copilot/installed-plugins/external-plugin-intake/armorcopilot

### Canonical external.json payload ```json { "name": "armorcopilot", "description": "Intent-based security enforcement for GitHub Copilot CLI and VS Code agent mode. Hooks every tool call against a declared intent plan and natural-language policy rules; blocks intent drift; ships signed audit logs to the ArmorIQ backend.", "version": "0.1.0", "author": { "name": "ArmorIQ", "url": "https://armoriq.ai" }, "repository": "https://github.com/armoriq/armorCopilot", "homepage": "https://docs.armoriq.ai/armorcopilot", "license": "MIT", "keywords": [ "security", "policy", "audit", "intent", "armoriq", "mcp", "hooks", "github-copilot" ], "source": { "source": "github", "repo": "armoriq/armorCopilot", "path": "plugins/armorcopilot", "ref": "v0.1.0", "sha": "1ea972464670e7fce497c4c99dafcab60cc4b123" } } ```

View workflow run

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Harihara04sudhan]

/rerun-intake

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[aaronpowell]

/rerun-intake

[aaronpowell]

/reject We won't be accepting this plugin at this time as it is tightly coupled to a third-party service that it's unclear if it is paid or not (or what pricing would be), and leverages external node packages which can be opaque to users thus risking supply-chain issues.