Skip to content

Plugin and Marketplace Authoring

A plugin extends Wayland Core with new providers or tools without changing the engine. This page is an overview of the authoring surface. The authoritative reference is docs/plugin-authors.md and docs/marketplace-format.md in the engine repository.

A plugin runs in one of a few ways, picked in the manifest:

  • Subprocess: the engine launches your binary and talks to it. Point [runtime.subprocess] at the binary path.
  • WASM: a sandboxed WebAssembly module with explicit host capability flags (each defaults to off).
  • mcp-bridge: set the kind to mcp-bridge and use [runtime.subprocess] to point at an MCP server binary, so an existing MCP server becomes a plugin.

Each plugin ships a manifest that declares its identity, runtime, the capabilities it provides (providers, tools), and its permission needs. Manifests are designed to stay byte-compatible across engine versions, so a manifest written for an older engine keeps loading.

The model separates capability (what the plugin can offer) from ownership (what it is allowed to touch). A plugin requests the capabilities it needs; the engine grants only those. WASM plugins additionally gate host access behind per-capability flags that default to closed.

Distribution is signed:

  1. Generate a keypair once, as the author.
  2. Place your public key (signing.pub) in the trust anchor directory so the engine recognizes you.
  3. Sign the plugin payload (the binary or .wasm).

The engine verifies the signature before it loads a plugin.

Install by plugin name from the local registry (the default) or a GitHub org, and manage the set from the CLI:

Terminal window
wayland-core plugin available # list installable plugins
wayland-core plugin install <name> # default source: local registry
wayland-core plugin install <name> --source github://<org> # GitHub Releases on that org
wayland-core plugin list # list installed plugins
wayland-core plugin remove <name> # remove a plugin

install takes a positional plugin name plus an optional --source flag (default local). The GitHub form is github://<org> (org only, no repo path).

The marketplace is an allowlist index (a versioned envelope of entries, each describing a plugin and where to fetch it). The engine caches it and uses it to resolve installable plugins. See docs/marketplace-format.md for the entry schema.