Check D11 · agent-provenance family · browser-side · one of the 11 Docker Desktop checks
The question this check asks: was this extension put in front of you by an AI assistant or an MCP/tool directory? Not whether the extension has anything to do with AI — how you arrived at it. RepoGates cannot answer that for a Docker Desktop extension today, and on this platform the obstacle is structural, not a matter of shipping order. This page says both.
D11 is the Docker Desktop entry in a family with one live member. On GitHub, C22 AI-agent provenance runs: the browser extension notices when a person lands on a repository from an AI chat or an MCP directory, and the verdict carries that fact, because an assistant's suggestion is not a review and is easily mistaken for one. Island's AgentBaiting research, on the intelligence page, showed assistants steering people to attacker-seeded GitHub repositories; the mechanism does not care which platform the recommended thing lives on. Ask an assistant for a Docker Desktop extension and it will name one. What it names then runs, in Docker's own words, "with the same permissions as the Docker Desktop user", and Docker's SDK security page puts the burden exactly where a recommendation removes it: "Make sure you trust the publisher or author of the extension when you install it, as the extension has the same access rights as the user running Docker Desktop." An assistant's confidence is not that trust. No malicious Docker Desktop extension has been publicly reported as of 18 September 2026, and this page claims no incident; the point is that a recommendation, on any platform, is not evidence.
The signal is a property of a navigation, not of the extension: the tab that opened this one, the tab you came from, a referrer when one survives. It exists for a moment in a browser and nowhere else — not in the Hub record, not in the image's labels or layers, not in anything a backend can fetch afterwards. On GitHub the mechanism is concrete: the extension is granted the eleven hosts it watches — six AI chats, claude.ai, chatgpt.com, chat.openai.com, gemini.google.com, copilot.microsoft.com and perplexity.ai, and five MCP directories, lobehub.com, glama.ai, mcp.so, mcpmarket.com and smithery.ai — and reads tab lineage as a github.com page opens. On this platform a person can land in two places, and neither is watched. Docker Desktop's Extensions Marketplace tab is a native window inside the app, so no browser extension sees it and no board can be built for it. The Hub's extension page, hub.docker.com/extensions/owner/name, is a browser page, and the board does not yet run on it. For a Docker Desktop extension, then, nobody observes the signal.
Nothing is scored, because nothing arrives; what follows is the plumbing around the gap. In the roster D11 is the only check whose single input is the browser. The API path — /v1/dde/score and /v1/dde/verdict, the MCP server's check_repo with platform="dde", the preflight — never has that input, so every response carries D11 as not checked and gives the reason as "decided in the browser at navigation time": not PASS, not a finding, a row whose evidence could not exist. Hand to an AI agent is built from D6, D7 and D11; a dimension reads PASS only when every check in it ran, but the browser is on the roster's short list of inputs whose absence is not evidence withheld — the same list the GitHub roster keeps for Scorecard, and the Hub's and the Marketplace's rosters keep for H18 and V17. So the dimension reads PASS when D6 and D7 ran and found nothing, and it withholds PASS when metadata.json failed to arrive, which is a fetch that should have worked. The score and verdict routes for a dde/ key do accept prov=agent, the flag the extension sends for a GitHub repository, and the scoring table matches agent-provenance by finding name rather than platform: CRITICAL at 25 points on a REVIEW report, which becomes a BLOCK; INFO at 5 on a PASS, which stays a PASS, because being recommended is suspicion rather than evidence. The three shipped profiles carry the rule as an escalation setting — warn-to-block on the personal and balanced profiles, always-block on the strict one. The row's evidence note:
"C22: AgentBaiting channel; INFO row (recorded on PASS) costs a little, CRIT (escalated) a lot"
Nothing sends that flag for a dde/ key. There is no board on the Hub's extension page, and there cannot be one on the marketplace tab inside Docker Desktop. Until the first ships, no Docker Desktop verdict carries this finding, and neither this page, the extension nor the MCP server says otherwise.
None — nothing has run to produce one. The 18 September 2026 measurement of all 50 listed extensions went through the API path, and D11 was listed as not checked on every one of the 50: not fifty passes, and not a measured false-positive rate of zero, which a check earns only by running against real navigations. A row that cannot fire cannot misfire, and this page does not count that as a result.
Today, everything: an inactive check has no coverage to describe. Were a board ever to run on the Hub's extension page, its edges would be C22's — a browser navigation from one of the hosts the extension is told to watch, and nothing more: not the question you put to an assistant, not its answer, and not the image, which a recommendation says nothing about; an extension an assistant named that trips nothing else would not be held for the naming. Two ways onto this platform would remain outside even that. The Extensions Marketplace tab inside Docker Desktop is a native window and the app's own fetch — no browser extension will ever see it. And an install command an assistant writes for you is a shell line: with the plugin installed in Claude Code, docker extension install owner/name goes to the preflight before it runs, and the preflight weighs the publisher, the index and the declared surface without ever learning who suggested the line.
RepoGates assesses a Docker Desktop extension on request — through the API, the MCP server (platform="dde") and the preflight for docker extension install. It does not see an extension installed from Docker Desktop's own Extensions Marketplace tab, which is the app's own fetch; the board inside Docker Desktop is not built, and cannot be — its marketplace is a native window no browser extension sees. The image is never pulled and its code is not read: a PASS means the provenance and the declared install surface are clean, never that the backend or the host binaries were inspected.
There is nothing to run for D11: it fires only inside the browser extension, on a page the board runs on, and no such page exists for this platform. The manual version is the only version: read an extension an assistant names as a candidate from a stranger's list, not a referral, and check the three things the roster reads first. Is it in Docker's index at all — since Docker paused new submissions on 16 June 2026 the list is frozen, and an image not in it is sideloaded or private (D5):
curl -s https://desktop.docker.com/extensions/marketplace.json \
| jq -r '.extensions[]' | grep -i 'tailscale/docker-extension'Who publishes it, and since when (D1) — an organisation answers at /v2/orgs/, a user at /v2/users/:
curl -s https://hub.docker.com/v2/orgs/tailscale/ | jq '{badge, date_joined}'And what installing it puts on your machine — the host binaries and the VM backend its metadata.json declares, read from the registry without a pull on the D6 and D7 pages. If you install from the command line, the CLI's own confirmation says the rest: "Extensions can install binaries, invoke commands and access files on your machine. Are you sure you want to continue? [y/N]" — and afterwards docker extension ls shows a HOST column for what it deployed. Then confirm the publisher somewhere the assistant did not choose — the project's own site, a source repository with a history. From an agent, check_repo("tailscale", "docker-extension", platform="dde") on the MCP server returns the roster, and a pasted Hub extension page or Docker Desktop marketplace deep link is recognised as the same extension.
Can RepoGates tell me today that an assistant pointed me at this extension? No. D11 is on the 11-check roster, but the only observer it could ever have — a browser extension watching the moment you arrive on a page — has no page to watch here. Docker Desktop's Extensions Marketplace is a native window inside the app, out of reach of any browser extension, and the Hub's extension page at hub.docker.com/extensions/owner/name is a browser page the board does not yet run on. Every Docker Desktop verdict lists the row as not checked — not a PASS, not a finding, a gap named as a gap.
If D11 never runs, why is the agent dimension not stuck at NOT_ASSESSED? Because the browser is an input the API path can never have, and the roster does not treat an impossible fetch as missing evidence — the same allowance the GitHub roster makes for Scorecard, and the Hub's and the Marketplace's rosters make for H18 and V17. Hand to an AI agent is built from D6, D7 and D11 and reads PASS when D6 and D7 ran and found nothing. A fetch that should have worked and did not is different: on the 18 September 2026 measurement one extension's metadata.json was not readable, its D6 and D7 were listed as not checked, and every dimension containing them withheld PASS.
Could a browser extension ever see this on Docker Desktop? Only on the Hub's extension page, for a person who arrives there in a browser tab — and no board runs there yet. The marketplace tab inside Docker Desktop is the app's own window and the app's own fetch; nothing in a browser can observe it, so no board can be built for it. A docker extension install line an assistant writes is weighed by the preflight on the publisher, the index and the declared surface, never on who suggested it. Even a shipped D11 would see one thing only: a person following a recommendation into a browser tab.
C22 AI-agent provenance — the live version, on GitHub, where the extension already watches the eleven hosts · H18 AI-agent provenance — the Hugging Face row, defined and not running · V17 AI-agent provenance — the VS Code Marketplace row, in the same state · D7 VM backend — the check in the same dimension that does run: the backend an agent driving the engine would inherit.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of all 50 listed Docker Desktop extensions (50 PASS / 0 REVIEW / 0 BLOCK, run through the API path; one extension's metadata not readable); Docker's Extensions SDK security page as rewritten on 10 October 2025; the marketplace pause callout of 16 June 2026 on docs.docker.com; Island's AgentBaiting as published on the AgentBaiting intelligence page. D11's own status — not checked, no board on the Hub's extension page, none possible for the marketplace tab — describes the product as it stands, not a measurement.