Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Capability ¶
type Capability string
Capability declares a contract a plugin satisfies.
const ( // CapabilityTools indicates the plugin exposes MCP tools to the LLM. CapabilityTools Capability = "tools" )
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager loads plugin configs, validates them, and registers their capabilities with the appropriate subsystem (currently only MCP tool servers via ToolRegistrar).
func NewManager ¶
NewManager creates a plugin Manager with no plugins loaded. Pass nil for verifyOpts to skip signature verification. Pass nil for runtime to use the legacy inline Docker args path (a DockerRuntime will be created lazily if Docker plugins are loaded).
func (*Manager) Load ¶
func (m *Manager) Load(plugins map[string]config.PluginConfig, existingToolNames map[string]bool) error
Load validates all plugin configs and populates the internal plugin list. existingToolNames is used to detect name collisions with registered [tools.*] entries. Keys are processed in sorted order for deterministic error reporting. Returns an error on the first invalid plugin; does not continue past errors.
func (*Manager) Start ¶
func (m *Manager) Start(ctx context.Context, tools ToolRegistrar) error
Start registers each loaded plugin's capabilities with the appropriate subsystem. Plugins with the "tools" capability are registered as MCP servers via tools.RegisterServer.
Subprocess plugins pass their command directly. Sandboxed plugins (Docker, Kubernetes) are spawned via the sandbox.Runtime, which returns the command to connect to their stdio.
A failure to register a plugin is logged as an error but does not halt other plugins. Returns the first error encountered, or nil if all plugins started successfully.
type Plugin ¶
type Plugin struct {
Name string
Type PluginType
Command string
Args []string
Env map[string]string
Capabilities []Capability
// Image is the Docker/OCI image to run.
Image string
// MemoryLimit is the container memory limit (e.g. "256m", "1g").
MemoryLimit string
// CPULimit is the container CPU limit (e.g. "0.5", "2").
CPULimit string
// Network is the Docker network mode. Defaults to "none".
Network string
// Volumes is a list of bind mounts ("host:container[:ro]").
Volumes []string
}
Plugin is the validated, normalised representation of a single plugin entry.
type PluginType ¶
type PluginType string
PluginType is the execution strategy for a plugin.
const ( // TypeSubprocess runs the plugin as a trusted subprocess with direct MCP stdio communication. TypeSubprocess PluginType = "subprocess" // TypeDocker runs the plugin in a Docker/Podman container with resource limits and network isolation. TypeDocker PluginType = "docker" )
type ToolRegistrar ¶
type ToolRegistrar interface {
RegisterServer(ctx context.Context, name, command string, args []string, env map[string]string) error
}
ToolRegistrar is the interface Manager uses to register MCP tool servers. *tool.Manager satisfies this interface; inject a mock in tests.
type VerifyOpts ¶ added in v0.1.0
type VerifyOpts struct {
// TrustedKeys is the set of Ed25519 public keys that can sign plugins.
TrustedKeys []ed25519.PublicKey
// AllowUnsigned controls whether unsigned plugins are accepted.
// When false, all subprocess plugins must have a valid .sig file.
AllowUnsigned bool
}
VerifyOpts configures plugin signature verification.
Source Files