stallari-plugins is the public catalog metadata repository for the Stallari Marketplace. It describes the artifacts the registry and app can list, validate, install, and present: MCP plugins, packs, add-ons, and bundles.
The schemas and vocabulary in this repo are synchronized from stallari-pack-spec; treat that sibling repo as the source of truth for schema evolution.
| Artifact | Directory | Purpose |
|---|---|---|
| MCP plugins | plugins/tools/*.json |
Tool/provider catalog entries, install instructions, contracts, tools, trust/readiness metadata |
| Packs | plugins/packs/ |
Marketplace metadata for workflow packs; first-party pack content lives in stallari-packs |
| Add-ons | plugins/add-ons/ |
UI reveal and scoped credential provisioning artifacts |
| Bundles | plugins/bundles/ |
Install/remove/version units that couple related packs, plugins, and add-ons |
| Scan exceptions | plugins/scan-exceptions/ |
Reviewed catalog scanner exceptions |
| Schemas | schemas/ |
Synced schema and vocabulary artifacts consumed by catalog build tooling |
Current catalog state includes dozens of MCP provider manifests across email, calendar, tasks, vault, DNS, storage, billing, home, travel, gaming, network, infrastructure, and other service domains.
Plugins may implement versioned service contracts such as email-v1, calendar-v1, vault-v1, billing-v1, home-v1, gpu-inference-v1, or dns-authoritative-v1. Contracts let packs ask for an abstract service operation while the runtime resolves an installed provider.
Catalog metadata also carries:
- trust tier:
certified,verified, orcommunity - readiness/certification signals for marketplace presentation
- per-tool risk class and granularity declarations
- domain-scope and non-conformance rationale where applicable
- install runtime/package metadata
- vendor/repository/setup links
npm ci
make validate-all
make build-api
make test
make contractsRun validation before opening catalog PRs. Validation covers JSON/YAML parsing, schema conformance, contract metadata, catalog build scripts, and scanner checks where configured.
Catalog entries and examples must never include real API keys, tokens, account IDs, email addresses, customer names, hostnames, vault paths, diagnostic payloads, or user data. Use placeholders and setup guidance instead. If a provider requires credentials, document the credential label and minimum scope, not the credential value.
| Repo | Role |
|---|---|
stallari-pack-spec |
Schema, vocabulary, service contracts, add-on/bundle definitions |
stallari-packs |
First-party pack content and tarball publish source |
stallari-registry-infra |
Registry API, marketplace site, sealed pack verification, and public catalog deploy |
stallari-harness |
Runtime consumer of catalog, pack install API, local tool and add-on behaviour |
Apache 2.0 - use freely with attribution.