Plugin Index Data API
One request returns a lightweight summary of every collected plugin — verification level, security status, risk level, and counts. Built for agents and tooling (dsh-plugin-finder and friends).
| URL | Description | Update |
|---|---|---|
/plugins-index.json | Registry summary — every plugin's status / risk level / counts (no per-finding detail). Single request, whole registry. | rebuilt on each deploy (the registry index is rebuilt with the site) |
/plugins-index.slim.json | Selection subset of the same registry — enough to filter by verification level, sort by stars, watch risk level and follow repoHealth.renamedTo. Drops description, evidence URLs, security counts, capability and install badge, so it is roughly a third of the transfer size. | rebuilt on each deploy |
JSON endpoints allow cross-origin reads: Access-Control-Allow-Origin: *. No API key or registration is required.
Pick /plugins-index.slim.json when you only need to select plugins (level, stars, risk, health) and then fetch per-plugin detail; pick /plugins-index.json when you also need descriptions, capability samples, per-rule scan counts or the evidence links. Both carry the same id/alias/generatedAt, so a cached copy of either stays addressable against the other.
| Field | Type | Semantics |
|---|---|---|
generated | string (YYYY-MM-DD) | Build date of this index |
generatedAt | string (ISO) | Build timestamp — preserve it alongside any cached copy |
source | string | The registry page this index is derived from |
count | number | Number of plugin entries |
plugins[] | array | One entry per collected plugin (fields below) |
plugins[].id | string | Plugin id (matches plugins.json ids and artifact slugs) |
plugins[].alias | string | null | The plugin's @author/plugin address — the only addressing accepted by the single-plugin endpoints (/artifact/, /data/install/, /plugin/); also embedded in each entry's evidence links |
plugins[].name | string | Display name |
plugins[].description | string | Repository description, truncated to 300 characters |
plugins[].stars | number | GitHub star count (0 when unknown) |
plugins[].topics | string[] | Matched use-case / capability topic tags |
plugins[].install | string | null | Copy-paste install command (dsh plugin --profile web add …). null = not installable via dsh plugin add (ecosystem app — see kind); ecosystem plugins do carry a command (they install, but mount no plugin capability) |
plugins[].kind | string (optional) | Present only on non-plugin entries: ecosystem-app = desktop / web shell or L4-unknown, no install command; ecosystem-plugin = installs via dsh plugin add but declares no dsh.bundle and mounts no capability |
plugins[].source | string (optional) | Source repository URL — present on non-plugin entries, where the install slot falls back to the repo page |
plugins[].download | string (optional) | Latest GitHub release URL for the entry, when one exists (non-plugin entries) |
plugins[].url | string | Absolute plugin detail page URL |
plugins[].verification | object | level (1–5), label (human-readable), lastVerifiedAt — derived by the same shared artifact layer as the registry UI, so the index always matches what the site shows |
plugins[].security | object | status, riskLevel, scannedAt, plus counts and filesScanned when present. No findings detail — use /artifact/@author/plugin.json for the full scan record |
plugins[].repoHealth | object (optional) | Repository health markers: status (renamed / deleted / topic-removed) and renamedTo when applicable — so machine consumers can react to moved plugins |
license | object | Provenance and reuse terms — aggregated from public sources, attribution required |
Honesty rule: verification and security values are computed by the same shared derivation layer as the registry UI (src/data/artifacts.ts) — the index can never disagree with the site. Entries the UI hides (repoHealth-flagged) stay in the index with their marker attached.
Fetch the whole index (or open /plugins-index.json in a browser):
Consumers: filter by verification.level, sort by stars, watch security.riskLevel, and honor repoHealth.renamedTo redirects.
Fields in plugins[] above describe /plugins-index.json; /plugins-index.slim.json carries the subset id, alias, name, stars, topics, install, kind, source, download, url, verification{level,label,lastVerifiedAt}, security{status,riskLevel,scannedAt}, repoHealth — the same values, projected (never recomputed). The index is rebuilt on every deploy from the append-only verification records and public registry data. Fields are add-only: existing fields will not be removed or renamed. Free to reference with attribution to dsh.so; new fields are announced in the changelog.