Community registry
Static registry schema, trust labels, and validation for third-party adapters and plugins.
The registry lives at apps/fumadocs/content/community/plugins.json and is rendered on the community extensions page.
Entry fields
| Field | Required | Contract |
|---|---|---|
name | Yes | Unique display name |
package | Yes | Unique valid npm package name |
kind | Yes | adapter, plugin, or hybrid |
status | Yes | community, verified, or official |
description | Yes | One-line summary |
href | Yes | HTTPS package or docs URL |
repo | Yes | HTTPS public source repository |
maintainer | Yes | Maintainer handle |
pluginId | When applicable | Unique plugin id |
adapter | Adapter/hybrid | Literal routing name |
importName | When applicable | Public factory export |
verifiedVersion | Verified/official | Exact audited version |
verification | Verified/official | Review metadata |
Verification metadata requires reviewedAt, reviewedBy, provenance: true, noInstallScripts: true, and runtimeDependencies; notes are optional.
Status labels
communitymeans listed by pull request without endorsement or audit.verifiedmeans the exactverifiedVersionpassed the configured static and npm checks.officialmeans maintained by OpenCore or in this repository.
Verification does not carry forward automatically to a new package version.
Validate locally
bun run community:checkCI checks the schema, duplicates, required adapter names, and verification blocks. Network validation for verified and official entries downloads the declared package version and checks repository metadata, install scripts, runtime dependency count, Email SDK peer dependency, binary exports, and suspicious shipped JavaScript tokens.
Static checks reduce obvious supply-chain risk but do not prove third-party code or provider behavior is safe.
Publish a plugin
Prepare a package and registry change.