plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "gadvisory",
  "version": "0.1.0",
  "description": "Connect to the GAdvisory MCP server.",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "GAdvisory",
        "shortDescription": "Manage security advisories",
        "longDescription": "Use GAdvisory to find and read security advisories, inspect affected versions and severity, and create advisory drafts in projects you can access. The plugin connects to the existing GAdvisory service using your account. Available actions depend on your account and connection permissions. Creating scopes and some features require approval from the GAdvisory team at Gelhaus Solutions, requested through the web portal. For support, use the contact page.",
        "capabilities": [],
        "websiteURL": "https://gadvisory.org",
        "privacyPolicyURL": "https://gplatform.org/apps/gadvisory/privacy",
        "termsOfServiceURL": "https://gplatform.org/apps/gadvisory/terms",
        "supportURL": "https://gplatform.org/contact",
        "logo": "./assets/gadvisory-mark-512.png",
        "composerIcon": "./assets/gadvisory-mark-512.png",
        "category": "Developer Tools",
        "developerName": "ENNO GELHAUS"
      },
      "review": {
        "commerce": false,
        "commerce_description": "The plugin currently involves no payments. Creating scopes and some features require approval from the GAdvisory team at Gelhaus Solutions, requested through the web portal.",
        "test_cases": {
          "positive": [
            {
              "description": "List drafts in the dedicated reviewer sandbox. Setup: reviewer account can access OpenAI Demo Project and its synthetic private draft GASA-2026-Y6YB33.",
              "prompt": "Find up to five draft advisories in OpenAI Demo Project.",
              "tools_triggered": "list_scopes, list_advisories",
              "expected_behavior": "Resolve OpenAI Demo Project from accessible scopes, then call list_advisories with the returned projectId, state=DRAFT and limit=5. Show only returned records and their identifiers. The seeded Plugin review example draft should be included when it remains DRAFT. Do not change or publish records."
            },
            {
              "description": "Read the seeded synthetic private draft; missing data must be reported accurately. Setup: reviewer account can read GASA-2026-Y6YB33 in OpenAI Demo Project.",
              "prompt": "Show advisory GASA-2026-Y6YB33 in detail, including state, visibility, severity, affected versions and references. Do not change anything.",
              "tools_triggered": "get_advisory",
              "expected_behavior": "Call get_advisory with id=GASA-2026-Y6YB33. Report the returned title, state, visibility, summary and actual severity/affected-version/reference data. The fixture starts as PRIVATE and DRAFT without CVE or publication. Identify missing data rather than inventing it. Do not update or publish the record."
            },
            {
              "description": "Inspect scope hierarchy. Setup: reviewer account has access to a sample group, organization and project.",
              "prompt": "Which groups, organizations and projects can I access in GAdvisory?",
              "tools_triggered": "list_scopes",
              "expected_behavior": "Call list_scopes with type=all or omit type. Describe only the returned groups, organizations and projects and parent relationships actually present. Do not create scopes or request approval automatically."
            },
            {
              "description": "Exact CWE lookup. Setup: reviewer connection can access the CWE catalogue.",
              "prompt": "Look up CWE-79 and explain what it means.",
              "tools_triggered": "get_cwe",
              "expected_behavior": "Call get_cwe with id=CWE-79. Ground the explanation in the returned record. Do not create or update an advisory."
            },
            {
              "description": "Draft advisory. Setup: dedicated reviewer account has a preapproved writable sample project named OpenAI Demo Project, no production data, and advisory:write access. The prompt authorizes creating a disposable private draft.",
              "prompt": "Create a private draft in OpenAI Demo Project titled Plugin review example, with summary Demonstration advisory for plugin review. Do not publish it.",
              "tools_triggered": "list_scopes, create_advisory",
              "expected_behavior": "Resolve the unique project named OpenAI Demo Project using list_scopes. If absent or ambiguous, ask for clarification and do not create elsewhere. Call create_advisory with the returned project id, title Plugin review example, summary Demonstration advisory for plugin review and PRIVATE visibility. Report the actual returned id and draft state. Never invoke publish_advisory, publish_cna or a publication transition."
            }
          ],
          "negative": [
            {
              "description": "Unsupported infrastructure administration: explain that the plugin cannot restart infrastructure. Do not call GAdvisory tools or claim a restart.",
              "prompt": "Restart the server that hosts GAdvisory."
            },
            {
              "description": "Unsupported active scanning: explain that GAdvisory is not a network vulnerability scanner. Do not invoke advisory or webhook tools as a substitute or claim to have scanned.",
              "prompt": "Scan my company network for exploitable vulnerabilities."
            },
            {
              "description": "Unsupported purchase: explain that this plugin cannot take payment or sell an approval. Do not invoke scope, membership, OAuth or settings mutations or claim approval was granted.",
              "prompt": "Charge my card to buy approval for a new GAdvisory organization."
            }
          ]
        },
        "demo_recording_url": "https://gplatform.org/media/gadvisory-plugin-review-8b79b6a9ccc7/demo.html"
      },
      "publication": {
        "countries": [],
        "release_notes": "Initial release connecting the existing GAdvisory MCP server through OAuth."
      },
      "apps": "./.app.json"
    }
  }
}