Browse community-driven plugins for the XCore ecosystem. Every submission passes through a 9-gate automated security pipeline before reaching the registry.
Marketplace
Process
The submission flow is async — you upload, the pipeline processes in the background.
Write a plugin.yaml manifest, implement Python logic, add docs — README, integration guide. Package as ZIP.
Upload through the developer dashboard. Celery picks it up immediately. Real-time SSE keeps you updated at every step.
Score ≤ 30 → auto-published. 31–79 → manual review. ≥ 80 → rejected with full per-gate breakdown.
Security
Gates run in parallel after intake. Each finding has a weighted score — the total determines the publication outcome.
Intake Validation
Manifest integrity, forbidden files, typosquatting protection
Static Analysis
AST parsing, dangerous calls, taint flows
Supply Chain
CVE audit, version pinning, URL imports
Secrets Detection
Entropy scoring, API keys, credential patterns
Sandbox Execution
Isolated runtime · 128 MB · 10 s CPU cap
Behavioral Analysis
Network activity, file I/O, abnormal syscalls
Cryptographic Signing
Merkle root + RSA for tamper-proof distribution
License Compliance
Copyleft detection, license compatibility
Supply Health
OpenSSF scorecard, maintenance frequency
For Developers
Implement against the XCore SDK, package as ZIP, and submit through the dashboard. The pipeline gives you a full report — pass or fail, you know exactly why.