feat: prepare Claude and Codex plugins for the OpenAI directory - #668
Conversation
Add a real plugin.json next to the existing marketplace catalog, ship the pixel chevron as the listing mark, advertise MCP tool safety hints and OAuth security schemes, and serve the OpenAI domain-verification challenge.
🦋 Changeset detectedLatest commit: 939d4f7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Maintained by uploads.sh — re-uploading a file with the same name updates it everywhere it is embedded. |
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (2)
🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-web | 48f1176 | Commit Preview URL Branch Preview URL |
Aug 14 2026, 03:49 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-auth | 48f1176 | Commit Preview URL Branch Preview URL |
Aug 14 2026, 03:47 PM |
Short description is now 30 characters or fewer, support and category are set, skills and MCP use the root paths the portal validates, and reviewer test cases plus annotation justifications live next to the Codex plugin.
Put the MCP vs CLI decision at the top of github-screenshots and uploads-cli so hosts without a shell do not try to run uploads attach.
oxc/no-async-endpoint-handlers assumes Express 4, which does not await route handlers. This repo is Hono on Workers, so the diagnostic is a false positive on MCP auth middleware.
1 participant
In plain terms
The Claude and Codex plugins can now be packaged the way OpenAI's directory expects. The repo already had a marketplace catalog; it was missing a plugin manifest, listing mark, MCP tool safety/auth metadata, and the domain-verification endpoint. This PR adds those so we can submit once identity verification lands.
What it does / what it is not
.claude-plugin/plugin.jsonnext to the existingmarketplace.json(catalog vs plugin). Dropsstrict: falsenow that the manifest exists.https://agents.uploads.sh/mcpand fills in listing fields (privacy, terms, starter prompts, brand color).assets/logo.png(512×512) forlogo/composerIcon.readOnlyHint/destructiveHint/openWorldHintand OAuthsecuritySchemeson every MCP tool. A token missing the required scope now returns_meta["mcp/www_authenticate"]so ChatGPT can re-consent. Connection-level HTTP 401 is unchanged.GET /.well-known/openai-apps-challengefrom the MCP worker. Unset or blank secret → 404. SetOPENAI_APPS_CHALLENGEand deploy when the portal issues a token.github-screenshotsanduploads-cli. Hosts without a shell (ChatGPT) are told to call hostedputinstead ofuploads attach ./shot.png.How to try it
Claude:
Domain challenge (after the MCP worker is deployed with the secret):
Technical notes
Tool auth policy is declared as
_meta.securitySchemesbecause@modelcontextprotocol/serverhas no first-classsecuritySchemesfield; OpenAI's scanner reads that_metakey. Hostedcommentadvertisesfiles:read(it only reads workspace data and posts via the GitHub App). Stdiohealthisnoauth; hostedhealthis authenticated with no file scope.Test plan
pnpm --filter @buildinternet/uploads exec vitest run test/mcp.test.tspnpm --filter @uploads/mcp exec vitest runpnpm --filter @uploads/mcp typecheckskills/github-screenshotsandskills/uploads-clitext/plain