arechen/EapilSkillMarket
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expose only public MCP support in marketplace

Browse Source 
Constraint: The public marketplace must not contain internal MCP endpoints, shared keys, project keys, or user-token workflows.

Rejected: Publishing every configured KeyInfo MCP server | internal knowledge, Firecrawl, and Outline servers are not public distribution targets.

Confidence: high

Scope-risk: moderate

Directive: Keep MCP publication behind an explicit allowlist and verify hidden plugin metadata before pushing.

Tested: python scripts/validate_marketplace.py; temporary CODEX_HOME marketplace list/add/remove for mcp-playwright; hidden rg scan for internal MCP URLs and key markers.

Not-tested: Live Playwright MCP browser tool invocation inside a fresh Codex session.
This commit is contained in:
KeyInfo Bot
2026-06-12 17:42:38 +08:00
parent 9d6c8cded3
commit fca5c80516
9 changed files with 237 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/codex/README.md
+9 -6
View File
@@ -1,24 +1,27 @@
# Codex Marketplace Sparse Entry
# Codex 插件入口
This directory is the sparse checkout entry for the EAPIL Codex Plugin Marketplace. AI agents should normally install the marketplace from the repository root URL:
这个目录是 EAPIL Codex 插件市场的 sparse checkout 入口。AI agent 通常应从仓库根 URL 安装市场：
```bash
codex plugin marketplace add https://git.playones.com/arechen/EapilSkillMarket.git --ref main
codex plugin marketplace upgrade eapil-skill-market
codex plugin list --marketplace eapil-skill-market
codex plugin add <plugin-name>@eapil-skill-market
codex plugin add <plugin-id>@eapil-skill-market
```
Use sparse checkout only when the environment needs a smaller checkout:
只有在受限环境需要更小 checkout 时才使用 sparse 参数：
```bash
codex plugin marketplace add https://git.playones.com/arechen/EapilSkillMarket.git --ref main --sparse .agents --sparse plugins/codex
```
Local debug from the repository root:
从仓库根目录本地调试：
```bash
codex plugin marketplace add .
codex plugin add docx@eapil-skill-market
```
Each `plugins/<plugin-name>` directory is an installable Codex plugin. Plugins can include plain skills plus official Codex plugin components such as `hooks`, `.mcp.json`, and `.app.json`. See the root `README.md` for the full plugin table and maintenance rules.
每个 `plugins/<plugin-id>` 目录都是一个可安装 Codex plugin。插件可以包含官方支持的 `skills`、`mcpServers`、`apps`、`hooks`、`interface` 和 `assets`。当前公开 MCP 只包含 `mcp-playwright`；KeyInfo 内部 MCP 不发布到公开仓库。
完整插件清单、MCP 说明和维护规则见根目录 `README.md`。