leadmagic-claude-pluginSAFE
LeadMagic Claude Code plugin for B2B research, contact enrichment, company search, and credit-aware workflows through hosted MCP with OAuth.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Official LeadMagic plugin for Claude Code: skills, agents, an approval-policy hook, and the hosted MCP connector (available tools depend on your workspace; Sheets tools appear when your workspace has Sheets) at https://mcp.leadmagic.io/mcp.
Published by LeadMagic Corporation.
LeadMagic B2B enrichment · MCP setup guide · Pricing and credits
Search cost, rate limits, and fair-use caps depend on your plan. Check current pricing before a large run; themarket-searchskill covers pagination and plan-dependent search cost. Prefer raw REST + API-level skills? See LeadMagic/leadmagic-skills (npx skills add LeadMagic/leadmagic-skills).
What this plugin connects to
- One network endpoint. The plugin's only server is
https://mcp.leadmagic.io/mcp, over HTTP with OAuth sign-in in your browser. No API key goes into any config file. - Nothing sent elsewhere. The plugin's skills, agents, commands, and hook send nothing to any other host. The hook is a local shell script that makes no network calls.
- Custom HTTP sheet columns are configured in the LeadMagic app, not through this plugin. If you set one up there, LeadMagic's servers call the host you chose, wi
5f9eb0d80445OBSERVED · 2026-10-14Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| cursor | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: account-research description: Research one company with LeadMagic MCP and summarize its GTM signals. Use when the user wants an account brief, ICP fit check, firmographics, funding, tech stack, hiring, or sales-call prep for a named company. --- # Account research ## Trigger Use when the user wants company research, ICP qualification, or a target-account brief for one company (or a handful). For a list of companies, use the `bulk-enrichment` or `sheets` skill instead. ## Workflow 1. Resolve the company with the cleanest identifier: `company_domain` (e.g. `acme.com`) first, else `company_name`. A company is the employer, never a person or a UI label. 2. Pick the narrowest tool that answers the question: - Full brief (firmographics, funding, tech, open jobs in one call) → `account_intel`. Call free `preview_cost` first, and switch off sections the user does not need (`include_jobs`, `include_technographics`, `include_research`). - Firmographics only (industry, size, HQ, founded year, description) → `enrich_company`. - Funding only (total raised, last round, investors) → `find_company_funding`. 3. Expand only when asked, and only for sections `account_intel` did not already return: - Tech stack → `get_company_technographics` - Open roles → `find_jobs`; hiring velocity → `get_company_hiring_signals` - Buyers → the `decision-makers` skill 4. More than 5 companies → do **not** loop single-account tools. Use `submit_detected_bulk_job` (`company_firmographics`, `company_funding`, ...) or a sheet. 5. Do not repeat a lookup already made for the same inputs in this session. ## Output Short GTM brief: - What the company is - Firmographics, funding, and signals the tools returned - Tech stack if requested - Unknowns (empty sections) and the recommended next LeadMagic step Never fill gaps from memory — report only tool results.
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
If a real credential was exposed, revoke or rotate it with the issuing service. Current-file cleanup does not erase Git history, forks, downloaded releases, or third-party caches. Report suspected exp
Report suspected vulnerabilities privately to [[email protected]](mailto:[email protected]). Share a minimal, sanitized reproduction and affected version. Do not post credentials, access token
An integration with a third-party service does not imply ownership of that service or endorsement by its provider. Repository licensing does not grant access to hosted services, API credentials, or cu
Gates applied: no_behavioural_pass.
5f9eb0d80445full audit observations/trust-audit/skill/leadmagic__leadmagic-claude-plugin.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 5f9eb0d80445 | SAFE | B | 89 | first audit |
Questions
What does the leadmagic-claude-plugin skill do?
LeadMagic Claude Code plugin for B2B research, contact enrichment, company search, and credit-aware workflows through hosted MCP with OAuth.
Is leadmagic-claude-plugin safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can leadmagic-claude-plugin access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
What do I need installed to use leadmagic-claude-plugin?
Its own instructions reference include_jobs and include_research. Dependencies are pinned to exact versions.
Which assistants does leadmagic-claude-plugin work with?
Its documentation mentions claude-code and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (5f9eb0d80445), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.