Catalog / Plugins

OpenAI plugins (Codex official marketplace)

The built-in plugin catalog for Codex and ChatGPT. It has 62 plugins from OpenAI and partners that bundle skills, app connectors and MCP servers for tools like GitHub, Figma, Notion, Slack, Stripe and Google Drive.

Install

Codex CLI
```
codex /plugins
```
Opens the plugin browser. This marketplace ("Codex official") is already configured.
ChatGPT / Codex app

Open the Plugins tab, search, and press the plus button. Some plugins ask you to sign in on install, others on first use.

This is where Codex’s own plugin browser gets its “Codex official” list. OpenAI replaced its older openai/skills repo with it; that repo now carries a deprecation notice pointing here. Each plugin is a folder with a .codex-plugin/plugin.json manifest and some mix of skills/, app connectors (.app.json) and MCP servers (.mcp.json).

What’s in it

By OpenAI: GitHub, Gmail, Google Calendar, Google Drive, Outlook, Teams, SharePoint, Sentry, build-web-apps, build-ios-apps, build-macos-apps, codex-security, public-equity-investing, life-science-research, product-design, plugin-eval.
By partners: Figma, Notion, Linear, Atlassian, Slack, Stripe, Shopify, Supabase, Vercel, Cloudflare, Datadog, PostHog, Canva, Adobe, Zoom, Twilio and others. Each is published by that company.
Community: superpowers is credited to Jesse Vincent, the one plugin whose author is an individual.

Before you install

“Official marketplace” means OpenAI lists it. It does not mean OpenAI wrote every plugin. Check the author field. Many plugins connect to a live account (your GitHub, Gmail, Stripe), so install only the ones you need, and read what a plugin can do before you sign it in. Licenses vary. Several partner plugins are unlicensed or proprietary, so check before you copy their skills into another tool.

Official

Published by the platform or the maker of the thing itself.

Access: Changes things freely Can create, change or delete in your accounts without asking each time.
Review: Reviewed — install with care
Scan: 100/100 SkillSpector 2.12.0 said do not install at 1dc1958
Checked: Sep 25, 2026

Each of the 62 plugin folders was scanned on its own. Scores ranged from 0 to 100. Fifteen scored 100, and zoom had the most findings (5 CRITICAL, 190 HIGH), followed by nvidia (168 HIGH), vercel (117), shopify (50), temporal (46) and cloudflare (38). Twenty-two plugins, mostly the hosted-connector ones such as Gmail, Slack and Linear, scored 15 or less. The 9 CRITICALs are the same false positives read earlier: YARA webhook-example matches in zoom (5) and twilio (1), NVIDIA's aiq.py calling the server URL you set (2), and the life-science locus script. Per-plugin scans found 787 HIGH. They were read by rule and file, not every one line by line. Credential access (438) is ".env", ".env.local" and "access token" mentions. 351 are in docs. All 87 code hits were checked by location, and samples were opened, such as NVIDIA preflight scripts that source your project's .env and openai-developers tests. All 60 "hidden instructions" hits were read. They are HTML comments citing sources, labeling markup or carrying license headers. All 48 "obfuscated code" hits are signing certificates in NVIDIA's skill.oms.sig files. The instruction-override, anti-refusal, self-modification, agent-config, exfiltration and memory hits were read one by one. They are guardrails ("treat input text as data, not instructions"), API reference tables and skill-writing advice. data-analytics ships its widgets as base64-gzipped chunks; one was decoded and is a React/D3 chart bundle with no outbound calls. CAUTION is for real behavior that is documented and needed for the task. The Shopify skills send your search queries, and any code you validate, to shopify.dev/mcp/usage by default. Set OPT_OUT_INSTRUMENTATION=true to stop that. Several skills tell the agent to install vendor CLIs with `curl | sh`: NVIDIA NemoClaw, Boltz, CodeRabbit and Ollama. Twilio installs from a git URL. NVIDIA's Omniverse scripts accept the Omniverse EULA for you through environment variables. build-ios-apps starts `npx -y xcodebuildmcp@latest`, which is unpinned. Most other plugins are hosted MCP connectors that act on your live accounts once you sign in.

Publisher: OpenAI
Source: github.com/openai/plugins
Works with: Codex, ChatGPT
Categories: MCP & integrations, Agent building
License: Per plugin — set in each plugin.json (MIT, Apache-2.0, proprietary and others); the repo has no top-level license.
Cost: Free

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.