Add ContrastAPI security intelligence plugin#2254
Add ContrastAPI security intelligence plugin#2254crazywoola merged 4 commits intolanggenius:mainfrom
Conversation
|
This is one of the clearer security-intel submissions I’ve seen because it already exposes the tool surface, free-tier/rate limit, repo/API links, and a concrete privacy stance. I’m trying to understand what single proof artifact actually closes the trust gap for a buyer deciding whether to wire a security plugin into a real workflow. If a marketplace listing could only add one more artifact, which would matter most to your users?
My guess for security workflows is data-handling boundary first, quality proof second, but I’d love to hear what serious users ask about first in practice. |
|
Thanks for the thoughtful review. To answer directly — data-handling boundary is what users ask about first in practice. Here's ours:
For the plugin specifically: it makes read-only GET/POST calls to Self-hosted deployment (local MCP server + local API) is on the roadmap for enterprise users who need full network isolation. Happy to add a |
…ts, add DATA_HANDLING.md Adds 4 new tools: audit_domain, threat_report, bulk_cve_lookup, bulk_ioc_lookup. Fixes 11 tools that called the wrong API path/method/body and would have 404'd or 422'd in production: domain_report, email_mx, email_disposable, exploit_lookup, wayback_lookup, phishing_check, scan_headers, check_secrets, check_injection, check_headers, cve_search. password_check: SHA-1 hashes the password locally before any network call, so the plain-text password no longer leaves the user's host. Matches the HIBP k-anonymity threat model. Updates manifest/provider/README/version to 0.2.0, rate limit 60→100/hr, tool count 25→29. Adds DATA_HANDLING.md responding to the data-handling boundary review, including a verifiable transparency endpoint reference (GET https://api.contrastcyber.com/v1/privacy/my-data).
|
@xtaq Following up on your data-handling boundary question — thanks again, it pushed us to write this down properly instead of leaving it implicit. The plugin package now ships with a The headline answer to "what does the buyer need?": you can now verify the privacy claims in real time rather than trust them. We added a transparency endpoint: It returns every row the database has about the caller — hashed IP, last 24h of endpoint activity (aggregated by category, no query parameters), rate-limit window state, and a Other things in this push:
Plugin version bumped to 0.2.0. Happy to keep iterating if there's anything in |
crazywoola
left a comment
crazywoola
left a comment
There was a problem hiding this comment.
❌ Request Changes
Decision: Request changes
Review Status
| Check | Status | Required action |
|---|---|---|
PR language |
✅ Pass | — |
Project structure |
✅ Pass | — |
README.md |
✅ Pass | — |
PRIVACY.md |
❌ Fail | Add a non-empty top-level PRIVACY.md file. Detail: PRIVACY.md not found or empty. Please include a non-empty PRIVACY.md file. |
Manifest author |
✅ Pass | — |
Icon validation |
✅ Pass | — |
Version check |
✅ Pass | — |
README language |
✅ Pass | — |
dify_plugin version |
❌ Fail | Pin or bump dify_plugin to >= 0.5.0 in requirements.txt or pyproject.toml. Detail: Could not find a pinned dify_plugin dependency in requirements.txt or pyproject.toml. |
Next steps
- PRIVACY.md: Add a non-empty top-level PRIVACY.md file.
- dify_plugin version: Pin or bump
dify_pluginto>= 0.5.0inrequirements.txtorpyproject.toml.
Please address the issues above and push an updated submission.
- Add top-level PRIVACY.md (data handling summary, transparency endpoint, privacy controls) - Fix dify_plugin dependency: hyphen → underscore for checker compatibility (>=0.5.1)
|
@crazywoola Thanks for the review! Both issues are fixed: PRIVACY.md — Added a top-level dify_plugin version — Fixed dependency name to Ready for re-review. |
Replace unsupported manifest tags (security, threat-intelligence, osint) with Dify allowlist values: search, agent, utilities. CI pre-check plugin validation enforces a fixed tag enum; the previous values caused PluginDeclaration.Tags[*] validation failures.
|
Pushed a fix for the Root cause: The previous manifest used Fix: Replaced with The workflow is currently in |
3 participants
What
Adds ContrastAPI — a free security intelligence plugin with 29 tools.
Tools (29)
Domain Intelligence (10):
whois_lookup,dns_lookup,ssl_check,subdomain_enum,domain_report,audit_domain(orchestrated full audit),tech_fingerprint,scan_headers,wayback_lookup,threat_intelCVE Intelligence (4):
cve_lookup,cve_search,exploit_lookup,bulk_cve_lookup(up to 50 CVEs in one call)Threat Intelligence / IOC (5):
ioc_lookup,bulk_ioc_lookup(up to 50 indicators in one call),hash_lookup,phishing_check,threat_report(orchestrated IP threat report — Shodan + AbuseIPDB + ASN)Network / OSINT (6):
ip_lookup,asn_lookup,email_mx,email_disposable,phone_lookup,username_lookupCode Security (3):
check_secrets,check_injection,check_headersAuthentication (1):
password_check— HIBP-style breach check. The plain-text password is SHA-1 hashed inside the plugin process before any network call. The raw password never leaves the user's host.Details
Privacy & Data Handling
ContrastAPI does not store the values you submit (domains, IPs, CVE IDs, hashes, code, etc.). Only the endpoint category and a salted HMAC hash of the caller's IP are logged for rate limiting. Verify in real time:
This transparency endpoint returns every row the database has about the caller, with deep links back to the source code that enforces the privacy guarantees.
Full data-handling details, including the trust model for
password_check, are inDATA_HANDLING.mdinside the plugin package (added in response to review feedback).Plugin Privacy Policy
Full policy: https://contrastcyber.com/privacy