Expose only public MCP support in marketplace

Constraint: The public marketplace must not contain internal MCP endpoints, shared keys, project keys, or user-token workflows.

Rejected: Publishing every configured KeyInfo MCP server | internal knowledge, Firecrawl, and Outline servers are not public distribution targets.

Confidence: high

Scope-risk: moderate

Directive: Keep MCP publication behind an explicit allowlist and verify hidden plugin metadata before pushing.

Tested: python scripts/validate_marketplace.py; temporary CODEX_HOME marketplace list/add/remove for mcp-playwright; hidden rg scan for internal MCP URLs and key markers.

Not-tested: Live Playwright MCP browser tool invocation inside a fresh Codex session.
This commit is contained in:
KeyInfo Bot
2026-06-12 17:42:38 +08:00
parent 9d6c8cded3
commit fca5c80516
9 changed files with 237 additions and 105 deletions
@@ -255,6 +255,18 @@
"authentication": "ON_INSTALL"
},
"category": "文档处理"
},
{
"name": "mcp-playwright",
"source": {
"source": "local",
"path": "./plugins/mcp-playwright"
},
"policy": {
"installation": "AVAILABLE",
"authentication": "ON_INSTALL"
},
"category": "MCP"
}
]
}
+9 -6
View File
@@ -1,24 +1,27 @@
# Codex Marketplace Sparse Entry
# Codex 插件入口
This directory is the sparse checkout entry for the EAPIL Codex Plugin Marketplace. AI agents should normally install the marketplace from the repository root URL:
这个目录是 EAPIL Codex 插件市场的 sparse checkout 入口。AI agent 通常应从仓库根 URL 安装市场:
```bash
codex plugin marketplace add https://git.playones.com/arechen/EapilSkillMarket.git --ref main
codex plugin marketplace upgrade eapil-skill-market
codex plugin list --marketplace eapil-skill-market
codex plugin add <plugin-name>@eapil-skill-market
codex plugin add <plugin-id>@eapil-skill-market
```
Use sparse checkout only when the environment needs a smaller checkout:
只有在受限环境需要更小 checkout 时才使用 sparse 参数:
```bash
codex plugin marketplace add https://git.playones.com/arechen/EapilSkillMarket.git --ref main --sparse .agents --sparse plugins/codex
```
Local debug from the repository root:
从仓库根目录本地调试:
```bash
codex plugin marketplace add .
codex plugin add docx@eapil-skill-market
```
Each `plugins/<plugin-name>` directory is an installable Codex plugin. Plugins can include plain skills plus official Codex plugin components such as `hooks`, `.mcp.json`, and `.app.json`. See the root `README.md` for the full plugin table and maintenance rules.
每个 `plugins/<plugin-id>` 目录都是一个可安装 Codex plugin。插件可以包含官方支持的 `skills``mcpServers``apps``hooks``interface``assets`。当前公开 MCP 只包含 `mcp-playwright`KeyInfo 内部 MCP 不发布到公开仓库。
完整插件清单、MCP 说明和维护规则见根目录 `README.md`
@@ -0,0 +1,38 @@
{
"name": "mcp-playwright",
"version": "0.1.0",
"description": "Playwright 是由 Microsoft 开发并维护的开源浏览器自动化框架,专为现代 Web 应用设计。它提供了一套统一的 API,支持 Chromium、Firefox 和 WebKit 三大主流浏览器引擎,适用于端到端测试、网页数据采集及自动化操作等场景。",
"author": {
"name": "EAPIL",
"url": "https://git.playones.com/arechen/EapilSkillMarket"
},
"homepage": "https://git.playones.com/arechen/EapilSkillMarket",
"repository": "https://git.playones.com/arechen/EapilSkillMarket",
"license": "Proprietary",
"keywords": [
"eapil",
"codex-mcp",
"mcp",
"playwright"
],
"mcpServers": "./.mcp.json",
"interface": {
"displayName": "playwright浏览器自动化操作",
"shortDescription": "Playwright 是由 Microsoft 开发并维护的开源浏览器自动化框架,专为现代 Web 应用设计。它提供了一套统一的 API,支持 Chromium、Firefox 和 WebKit 三大主流浏览器引擎,适用于端到端测试、网页数据采集及自动化操作等场景。",
"longDescription": "Playwright 是由 Microsoft 开发并维护的开源浏览器自动化框架,专为现代 Web 应用设计。它提供了一套统一的 API,支持 Chromium、Firefox 和 WebKit 三大主流浏览器引擎,适用于端到端测试、网页数据采集及自动化操作等场景。",
"developerName": "EAPIL",
"category": "MCP",
"capabilities": [
"Interactive",
"Read"
],
"defaultPrompt": [
"使用 playwright浏览器自动化操作 MCP 查询或处理这个任务。"
],
"websiteURL": "https://git.playones.com/arechen/EapilSkillMarket",
"privacyPolicyURL": "https://git.playones.com/arechen/EapilSkillMarket",
"termsOfServiceURL": "https://git.playones.com/arechen/EapilSkillMarket",
"brandColor": "#0F766E",
"screenshots": []
}
}
@@ -0,0 +1,19 @@
{
"mcpServers": {
"playwright": {
"command": "bunx",
"args": [
"@playwright/mcp@latest"
],
"default_tools_approval_mode": "approve",
"tools": {
"browser_navigate": {
"approval_mode": "approve"
},
"browser_tabs": {
"approval_mode": "approve"
}
}
}
}
}
@@ -0,0 +1,7 @@
{
"id": "playwright",
"name": "playwright浏览器自动化操作",
"version": "20260605",
"keySource": "none",
"syncedAt": "2026-06-12T09:39:35Z"
}
@@ -0,0 +1,19 @@
# playwright浏览器自动化操作
Codex MCP 插件 ID`mcp-playwright`
Playwright 是由 Microsoft 开发并维护的开源浏览器自动化框架,专为现代 Web 应用设计。它提供了一套统一的 API,支持 Chromium、Firefox 和 WebKit 三大主流浏览器引擎,适用于端到端测试、网页数据采集及自动化操作等场景。
## 运行前提
- 本地命令:`bunx @playwright/mcp@latest`
- 安装插件不会预先安装本地命令依赖;请先确认命令在当前 Codex 环境可执行。
## Codex 配置
插件自带 `.mcp.json` 声明传输配置。安装后如需调整启用状态或工具审批策略,可在用户 Codex 配置里覆盖:
```toml
[plugins."mcp-playwright@eapil-skill-market".mcp_servers.playwright]
enabled = true
```