To list every Jenkins plugin with its version, open Manage Jenkins, then Plugins, then the Installed tab, or run a short script in the Script Console that prints each plugin's short name and version. Save the output with a date, so you can match it against advisories.
Three ways to get the list
| Method | Good for |
|---|---|
| Installed tab in the plugin manager | A quick look, shows whether a plugin is enabled and has warnings |
| Script Console | A text list you can copy into a file or ticket |
| Files in Jenkins home | Checking what is on disk, for example .jpi files in the plugins folder |
The Jenkins plugin documentation notes the Script Console route directly: a short script prints each plugin's short name and version. The Script Console runs with full controller privileges, so only administrators should have access, and you should not paste scripts from untrusted sources.
What to record
- Jenkins core version and Java version.
- Each plugin short name and version.
- Enabled or disabled state.
- Whether any warning is shown in the plugin manager.
- The Health Score, if you use it. The score reflects the latest available data, not the installed version.
- The date and who captured it.
Details on health scores are on the plugins site, at an address of the form plugin-health.jenkins.io/scores/ followed by the plugin name.
Add context for each plugin
A bare list is not enough. Add three columns:
- Used by. Which jobs, folders or settings need it.
- Owner. Who in your team decides about it.
- Maintained. Whether the plugin still receives releases.
A plugin with no user and no owner is a candidate for removal. See the post on removing an unused plugin safely at this link.
Keep it current
Jenkins checks for updates every 24 hours, and Check now triggers a manual check. Capture a fresh list after every upgrade and store it with the change record. When an advisory arrives, search the list rather than clicking through the interface.
Mind the transitive part
Plugins depend on other plugins. The installed list shows these too, so a vulnerable library may arrive through something you never chose directly. Implied dependencies, where an older plugin relies on a feature that moved out of core, can be seen by hovering over the uninstall button.
Try it yourself
The demo shows a dependency inventory, the same idea applied to code instead of plugins.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard generates SBOMs and scans dependencies, giving you a dated inventory of your own code. Start with the free scan.
Quick check
Who should be able to use the Script Console?
Only administrators, since scripts run with full controller privileges.
How often does Jenkins check for plugin updates?
Every 24 hours, and you can trigger a check manually with Check now.
Sources
Last reviewed: 19 October 2026.
