Developer submission wizard
After each package change, start with upload and complete structure checks, private loading, and automated security review in order.
1Package structure
2Contract loading
3Security review
1
Upload and check ZIP
Up to 200 files and 5 MB unpacked; plugin.json must be at the ZIP root. A failure will not replace the previous sandbox version.
2
Private loading and contract validation
Reuse the production plugin loader to validate the manifest, callable entry point, ports, pricing, and credential contract without adding it to the public registry.
3
Automated review and submission
Run contract validation, AST capability scanning, and the Bandit high-risk scan in order. Passing all checks enters manual review.