Install a plugin you can inspect.

After the quickstart, choose a plugin in the registry. Open its source and documentation before running the install command.

Install, approve, enable.

With permissions you approve, plugins can inspect or change requests and responses, block a request, or call another endpoint such as a local model. That lets a focused local model handle one job while your coding agent continues using its hosted model.

Maintained plugins have prebuilt releases: install by name without Git or Go. The CLI discovers your running instance and installs into its configured plugin directory; you do not need a checkout or to repeat its port. Use --dir only when deliberately targeting another plugin directory. To pin a release, use torana plugin install [email protected].

Already have a local model running?

Register it before installing pii: run torana open, open Settings → Add provider, name it local-scanner, enter your local model server's URL, select format openai and No authentication for an unauthenticated server. Under Plugin model defaults, enter its model ID if required, then choose Save settings. The quickstart includes example URLs and all setup fields.

torana plugin install pii

The command downloads and verifies the release bundle. It does not approve its permissions or enable it.

Don’t have a local model running?

Try usage_logger for content-free usage records, or pii_guard for deterministic checks without a model or network resource:

torana plugin install usage_logger
torana plugin install pii_guard

Enable the plugin

Run torana open and select the plugin you installed. For pii, choose the OpenAI-compatible local provider you already configured for its required scanner service. Review the plugin digest, requested permissions and resource limits, then choose Approve and enable.

The quickstart walks through the decision and a safe synthetic-credential check. You may use either guard, or place pii_guard before pii so obvious matches avoid a model call. For terminal or agent automation, use the model-backed PII guide or the deterministic guard guide.

Install from any plugin repository.

You do not need a registry listing to install a plugin. You can pass an HTTPS release archive URL. A direct URL verifies the archive’s companion checksums and declared bundle digest, but has no independent catalogue anchor: verify its publisher and provenance yourself.

For a Go source build, use its repository URL and plugin path. Install Git and the plugin’s required Go toolchain first; maintained source builds currently require Go 1.26.6+. Prefer a tag or commit you have reviewed over a moving branch. Rust source builds require a local Rust toolchain and a cloned, reviewed project.

For a local Go or Rust project, pass its directory instead. This example assumes you have already cloned and reviewed a plugin in ../my-plugin:

torana plugin install ../my-plugin

The same build, approval, and enablement steps apply to plugins from your own repository and someone else’s. A catalogue entry is not an automatic permission grant. Want to share a plugin you made? →

Source builds happen outside the sandbox.

WASM isolates the running guest. That does not make building arbitrary source code safe. In particular, Cargo build scripts can execute native code before there is a WASM artifact to approve. Torana refuses remote Rust source builds; clone and review a Rust project before building it locally.

Verify the bundle, then choose its permissions.

Name-based installs verify file checksums, bundle contents and identity, then compare the computed bundle digest against the release digest published independently in the site catalogue. Published bundles also carry GitHub build attestations. Verification identifies the artifact; it is not a security review or a permission grant.

Approval is bound to that exact bundle digest. An artifact or permission change requires approval again. Source builds use their own computed digest; your local toolchain may produce different bytes.

Official Go plugin builds are checked for path independence. That is narrower than reproducibility across every toolchain version. Torana uses GOTOOLCHAIN=local when compiling plugin source, so the source cannot silently select and download another Go toolchain.

The digest identifies what you approved. It is not an independent security review or a reason to skip reading source and permissions.

Turn it off when you’re done.

torana plugin disable pii --yes

Disabling retains settings, approval and private files. You can also disable it in the UI. Inspect the active pipeline before continuing. To stop using the proxy entirely, restore your coding agent’s previous provider configuration as described in the quickstart.

For settings, pipeline order, revisions and agent operations, use the full CLI reference.