The morning after updating the app, I opened the Marketplace and found a row of names I use every day: Figma, Linear, Notion, Stripe. My finger was on "Install" before I had really decided anything.
What stopped me came afterward. I couldn't say which account the plugin I had just added was connected to.
So here is the order I'd suggest up front: look at the developer before you install, and look at the connection after. Keeping those two steps apart has cut a lot of hesitation for me.
What changed in 2.28.2
The official changelog entry for v2.28.2 (October 29, 2026) says:
- The Marketplace now carries partner plugins (Figma, Linear, Notion, Stripe and others), with a Featured spotlight
- Plugins that connect to an account get an Accounts tab, where you can add, reconnect or disconnect accounts
- The agent may suggest relevant Marketplace plugins during a conversation
- The standalone Conversation History page is gone
The changelog also notes that the Accounts tab and the plugin suggestions are not yet available for business and enterprise accounts. If you don't see them on an organization account, that is the stated state of the rollout rather than a fault.
The day before, v2.28.1 (October 28) added a notice about third-party developer tools to the Marketplace and to third-party plugin pages. Those pages also show the developer, the version, and links to the website and the repository.
The missing history page is covered separately. See the three ways to find past chats after 2.28.2.
Three checks before installing
I keep the check to three items.
| What to confirm | Where to look | If it snags |
|---|---|---|
| Who the developer is | The developer field and website on the plugin page | If you can't reach the name from an official site, skip it |
| Whether you can read the source | The repository link | If it's missing or won't open, put it off |
| Whether it is maintained | The version, and the repository's last update | If it has stalled for a long time, look for an alternative first |
The third one is hard to judge by eye. When the repository is on GitHub, I pull its state in one go:
# Read OWNER/REPO from the repository link on the plugin page
gh api repos/OWNER/REPO \
--jq '{pushed_at, archived, license: .license.spdx_id, open_issues: .open_issues_count}'pushed_at is the time of the last push, and archived: true means maintenance has ended. If the license comes back null, you need to confirm the terms of use some other way.
This does not prove a plugin is safe. All it tells you is whether someone is still looking after it — but on a night when I'm unsure whether to install, that is a useful first yardstick.
After installing, open the Accounts tab
For plugins that connect to an account, the Accounts tab lists the connections and lets you add, reconnect or disconnect them. On the day I install something, I check two things once:
- Which account it connected with (work and personal shouldn't be mixed)
- Where I would disconnect it when I stop using it
If a sign-in seems to stall midway, this tab is where I'd look first to see the state of the connection. The presence of a reconnect button suggests to me that connections are expected to drop now and then.
An early mistake, and the line I draw now
When I first started adding editor extensions, I judged by name and rating alone. Later I realized I couldn't explain which extension could read which folder, and I spent half a day reinstalling. It did not go well.
My rule now is simple. Before installing, look at the people and the source; after installing, look at the connection. A disabled plugin gets an Enable button (v2.27.0), so when I'm unsure, leaving it disabled is also an option rather than installing and removing.
I keep the same order when the agent suggests a plugin. A suggestion is only a doorway; the decision happens on the plugin's page. For thinking about permissions, my notes on MCP tools are in designing least-privilege allowlists for MCP tools, if that's useful.
Writing it down for the person I'll be in six months
Working on wallpaper-app store copy and release drafts, I use one yardstick for any service I connect: could I explain, months later, what it can reach and under which account? On install day I feel sure. Six months on, I remember nothing.
That is why a one-line note is worth keeping. Mine looks like this:
2026-11-02 / Notion / developer: confirmed via official site / pushed_at: checked / connection: personal account onlyWith that line, when behavior changes after an update I know what to suspect first. And while the Accounts tab is unavailable on business and enterprise accounts, connection management sits with the organization — so I treat the decision to install with a little extra caution in the meantime.
What to do next
Pick one plugin you already have, open its page, and follow the developer and repository links. Then run the gh api command above once and save the result as a single line in your notes. The next time an update lands, that line gives you something to compare against.
It's a small chore. Still, being able to say in words what is connected to my accounts is something I'd rather not give up.