Plume

Shared contracts. Consistent permissions.

The extension platform is part of Standard. Its foundation is implemented; the full third-party runtime and developer toolchain are still being built.

What exists today

The commercial source package @plume/plugins exports schemas, result types, action registration, the trusted invocation kernel and signed release/entitlement verification. Current first-party messaging capabilities use registered actions and the shared authorization boundary.

import { PluginManifestSchema,
  defineAction, createKernel } from '@plume/plugins';

The host authenticates the actor before invoking the kernel. Each action still requires current organization policy, user or bot authority, granted capabilities and a compatible runtime. A paid edition never grants permission to read a private channel.

Where the current boundary stops

Only trusted bundled implementations execute in the current instance. A valid manifest or signature does not grant database, secret or kernel access. General sandboxed apps, remote application execution, the full SDK/CLI, webhooks, MCP and declarative third-party UI surfaces are not delivered yet.

The required Standard edition includes the full APIs, bots, commands, webhooks, MCP and private/official Standard integration platform. That edition commitment should not be mistaken for the availability of those unfinished interfaces.

Marketplace discovery

A public package catalog and marketplace installation service are not available in the current development release. There are no third-party listings or reviews to display. Future discovery must use the distribution catalog; installation remains an operator-controlled action against the customer instance.

Marketplace browsing is not available from this site yet.

Provider integrations

Google Drive is the planned first reference integration. WorkOS, Auth0, directory synchronization and Cloudflare Realtime belong to the required Extended scope. They are not implemented integrations or verified providers in this release.

Customer-owned provider configuration and usage costs remain customer responsibilities. No provider credentials or customer content belong in this public site.