plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "agentmart-site-check",
  "version": "1.0.1",
  "description": "Checks a website's public setup from the outside (HTTPS and security headers, certificate dates, SPF and DMARC, privacy, terms and contact pages, llms.txt, robots.txt and MCP) through a remote MCP server that changes nothing on the sites it checks, with no sign-in, and returns plain steps to fix each item.",
  "author": {
    "name": "Ciphyr Tech O\u00dc",
    "email": "mustafaakmese@ciphyr.ai",
    "url": "https://agentmart.ciphyr.ai"
  },
  "homepage": "https://agentmart.ciphyr.ai/c",
  "repository": "https://github.com/mustafaakmese/agentmart-site-check",
  "license": "MIT",
  "keywords": [
    "website-check",
    "security-headers",
    "https",
    "spf",
    "dmarc",
    "llms-txt",
    "mcp"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "AgentMart Site Check",
        "shortDescription": "Check a website's public setup",
        "longDescription": "AgentMart Site Check reads the public setup of a website, the way any visitor or AI agent sees it from the outside. Give it a domain such as example.com. It checks HTTPS and security headers, certificate dates, email sender records (SPF and DMARC), whether privacy, terms and contact pages can be found, and files for AI agents (llms.txt, robots.txt and MCP). Each item comes back as pass, warn, fail or not checked, with plain steps to fix it.\n\nHow it reads: at most 24 requests to the site per check, one of them over plain http to see whether the site moves visitors to HTTPS, plus public DNS questions. If the site names an MCP server, the check sends it the standard MCP opening messages, asks for its list of tools and ends the session. It follows the site's robots.txt rules for AgentMart-Check. It never logs in, fills in forms or changes anything on the site.\n\nWhat it returns: our own fixed wording and numbers. No text from the checked site is copied into a result. A result is kept for 7 days and can be shown again by its check_id. A repeat for the same domain within 15 minutes gives the same result, unless you ask for a fresh check.\n\nLimits: a result describes that moment only. It is not a security audit, and it says nothing about the company's servers, code, staff or how it handles data.\n\nNo account and no sign-in. Site owners can stop checks of their domain with a DNS TXT record agentmart-check=no on _agentmart-check.<their domain>, or by writing to us.\n\nMade by Ciphyr Tech O\u00dc (Estonia), the company that runs AgentMart.",
        "developerName": "Ciphyr Tech O\u00dc",
        "category": "Developer Tools",
        "capabilities": [
          "Check HTTPS, headers and certificate dates",
          "Check SPF and DMARC records",
          "Find privacy, terms and contact pages",
          "Check llms.txt, robots.txt and MCP",
          "Show an earlier result by its check_id"
        ],
        "websiteURL": "https://agentmart.ciphyr.ai/c",
        "supportURL": "https://agentmart.ciphyr.ai/support",
        "privacyPolicyURL": "https://agentmart.ciphyr.ai/privacy",
        "termsOfServiceURL": "https://agentmart.ciphyr.ai/terms",
        "defaultPrompt": [
          "Check example.com with AgentMart Site Check.",
          "Does my domain have SPF and DMARC records?",
          "When does the HTTPS certificate of my website expire?"
        ],
        "composerIcon": "./assets/logo.svg",
        "logo": "./assets/logo.svg"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Check a website's public setup",
              "prompt": "Check agentmart.ciphyr.ai with AgentMart Site Check.",
              "tools_triggered": "run_check",
              "expected_behavior": "Lists each item with its status (pass, warn, fail, not checked or info), plain steps to fix each warn and fail, the check_id, and the note that the result is not a security audit."
            },
            {
              "description": "Check email sender records",
              "prompt": "Does agentmart.ciphyr.ai have SPF and DMARC records? Use AgentMart Site Check.",
              "tools_triggered": "run_check",
              "expected_behavior": "Shows the SPF and DMARC items with the status the check finds, and steps to fix any item that does not pass."
            },
            {
              "description": "Check when the HTTPS certificate ends",
              "prompt": "When does the HTTPS certificate of agentmart.ciphyr.ai expire? Use AgentMart Site Check.",
              "tools_triggered": "run_check",
              "expected_behavior": "Shows the HTTPS certificate item with its end date."
            },
            {
              "description": "Check the files for AI agents and an MCP server",
              "prompt": "Does agentmart.ciphyr.ai publish llms.txt, and does its MCP server at https://agentmart.ciphyr.ai/mcp answer? Use AgentMart Site Check.",
              "tools_triggered": "run_check",
              "expected_behavior": "Calls run_check with mcp_url set to https://agentmart.ciphyr.ai/mcp and shows the llms.txt and robots.txt items and the MCP items for that address."
            },
            {
              "description": "Open an earlier check again, after the first test case in the same chat",
              "prompt": "Use Show an earlier website check to open that check again by its check ID.",
              "tools_triggered": "get_check_result",
              "expected_behavior": "Shows the same stored result with the same check_id, and runs no new check."
            }
          ],
          "negative": [
            {
              "description": "Changing a website: the plugin only reads public setup and never logs in or changes anything. Expected: no tool call, and an answer that it cannot log in or change settings.",
              "prompt": "Log in to my website's admin panel and turn on HSTS."
            },
            {
              "description": "A security test: the plugin is not a security audit and does not test logins or look for weaknesses. Expected: no security test; best no tool call, at most one normal public check whose result says it is not a security audit.",
              "prompt": "Find security holes in the login page of agentmart.ciphyr.ai."
            },
            {
              "description": "A general question with no website to check. Expected: no tool call; ChatGPT answers from its own knowledge.",
              "prompt": "What is the capital of Estonia?"
            }
          ]
        },
        "demo_recording_url": "https://github.com/mustafaakmese/agentmart-site-check/releases/download/v1.0.1/agentmart-site-check-demo.mp4",
        "commerce": false,
        "commerce_description": "AgentMart Site Check sells nothing. It reads a website's public setup and returns the result. It has no purchases, prices, upgrades or links to buy."
      },
      "publication": {
        "countries": [],
        "release_notes": "First version: check a website's public setup (HTTPS, headers, certificates, SPF and DMARC, privacy, terms and contact pages, llms.txt, robots.txt and MCP) with no sign-in."
      },
      "apps": "./.app.json"
    }
  }
}