Plugin Record Data API
One canonical fact sheet per plugin for agents and tooling: registry identity, L1–L5 verification with the per-dsh-version install verdicts, security summary (counts + categories, not per-finding detail), install command, health and evidence pointers. Consumes the same shared derivation layer as the website — nothing is invented for the feed.
| URL | Description |
|---|---|
/plugin/<id>.json | Aggregate record for one plugin (replace <id> with the plugin id, e.g. dsh-codebase-memory-mcp) |
/data/plugin-record.schema.json | JSON Schema for the aggregate record format |
/artifact/<id>.json | Full per-finding security scan detail (referenced from this record) |
| Field | Semantics |
|---|---|
schemaVersion / generatedAt | Contract version; build-time as-of marker (static feed — preserve it when you cache) |
registry | Name, description, repository, license, install source, status, indexing dates, category/use-case tags |
verification | Highest L1–L5 level + per-dsh-version install verdicts (L5 wins; L4 fallback), each with checkedAt and source record id |
security | Status / risk level / scan time / counts / categories — no per-finding detail here; follow links.security for the full scan record |
install | Install command and install source — command is null for out-of-scope entries (no install command advertised) |
capability | Structured capabilities — declared[] entries carry source (llm-labels = AI-inferred category/use-case; readme = rule-extracted keyword from a controlled vocabulary, limited to plugins with a passed L5 record) and note; same label keeps the llm-labels entry first. verified stays empty until an evidence pipeline exists (empty = not yet verified, never "no capabilities") |
health | Stars, forks, last commit, repo-health mark (renamed / deleted / topic removed) |
evidence | Ids of the verification records behind the verdicts for audit trail |
links | Human detail page, security JSON, install JSON and badge URLs |
curl -s https://www.dsh.so/plugin/dsh-codebase-memory-mcp.json | jq {level: .verification.level, byDshVersion: .verification.byDshVersion, risk: .security.riskLevel, evidence: .evidence}For an agent deciding between plugins: filter /plugins-index.json to candidates, then fetch this record per candidate to compare install verification, risk and health without pulling per-finding scan details.
Honesty note: verdicts quote the underlying append-only verification records verbatim (never invented); a plugin without runtime tests shows an empty byDshVersion, not a made-up pass. License and attribution conventions are the same as the other data feeds.