> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usegandalf.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent-native marketplace and source browsing

> Gandalf browses agent-native marketplace and source entries for Codex and Claude Code. It never owns or certifies catalogs; mutations require providers.

Agent-native marketplaces, registries, plugin repositories, and sources are surfaces that agent ecosystems expose to their users. Gandalf browses and inspects them through the Console **Marketplace** tab, but it never owns, certifies, or replaces the catalog itself.

## What Gandalf shows

* **Codex**: managed plugin skill inventory and source-backed entries where discovered.
* **Claude Code**: marketplace source metadata plus installed and source-backed entries where discovered.

The Console renders these as unified inventory rows next to your installed skills, hooks, MCP servers, and plugins.

## What actions are available

Browsing and inspection are always available. Mutating actions are gated by [providers](/concepts/providers):

| Action                       | Codex                                         | Claude Code                                                                   |
| ---------------------------- | --------------------------------------------- | ----------------------------------------------------------------------------- |
| Browse and inspect           | Available                                     | Available                                                                     |
| Non-mutating Review guidance | Available where source metadata is sufficient | Available where source metadata is sufficient                                 |
| Reviewed install             | Not available today                           | Available for eligible user-scope marketplace plugins, with verified rollback |
| Update, uninstall            | Not available today                           | Not available today                                                           |
| Add source, remove source    | Not available today                           | Not available today                                                           |

Any unavailable action shows a concrete reason in the TUI rather than pretending to run.

## Marketplace-originated Review Actions

A Marketplace-originated Review Action starts from an agent-native source entry. The first safe version does not mutate: it produces reviewed setup guidance or source-backed context. When a concrete provider exists (as with Claude Code plugin install), the same flow can preview and then execute a real change. Sources are treated as untrusted display data, so text is never executed at browse time.

## Trust boundaries

* Gandalf does not execute plugin, skill, hook, or MCP commands during scan or browse.
* Source data is revalidated before any Marketplace-originated Review Action completes.
* Install and rollback rely on the same content-backed [snapshot](/concepts/snapshots) safety path as restore.

See the [Support Matrix](/reference/support-matrix) for the exact current state per agent.