plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "datagrail",
  "version": "1.0.0",
  "description": "Privacy & data management",
  "author": {
    "name": "DataGrail",
    "url": "https://www.datagrail.io/"
  },
  "homepage": "https://www.datagrail.io/",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "DataGrail",
        "shortDescription": "Privacy & data management",
        "longDescription": "Connect ChatGPT to your DataGrail privacy platform. Ask about DSAR/privacy requests and opt-outs, integrations and their errors, your data map and system inventory, risk assessments and ROPA, consent banners and cookies, and data broker (DROP) compliance — and take action on the items you have permission to change. All access is scoped to your authenticated DataGrail account (multi-tenant, per-user permissions). Read tools are always available; write actions are additionally gated behind your organization's write-tools setting and a per-user grant, so ChatGPT can only modify data when an admin has explicitly enabled it.",
        "developerName": "DataGrail",
        "category": "Business & Operations",
        "logo": "./icon.png",
        "websiteURL": "https://www.datagrail.io/",
        "supportURL": "https://docs.datagrail.io/",
        "privacyPolicyURL": "https://www.datagrail.io/privacy-policy/",
        "termsOfServiceURL": "https://www.datagrail.io/terms-conditions/",
        "defaultPrompt": [
          "Show me all deletion requests that are past their due date this month, grouped by assignee.",
          "Which cookies on my site still haven't been categorized, and what's the current status of my consent banner?",
          "Add a new system called 'Amplitude Analytics' to our data map with a note that it processes behavioral analytics data"
        ],
        "capabilities": []
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "User asks for privacy requests approaching or past their deadline; the assistant should query tickets filtered by deadline status.",
              "prompt": "Which deletion requests are past their due date?",
              "tools_triggered": "search_tickets",
              "expected_behavior": "Found 5 deletion requests that are past their due date, all currently in 'Pending Action' status:\n\n1. george.hudson@example.com — due 2026-09-15 (16 days overdue)\n2. amelia.wong@example.com — due 2026-09-18 (13 days overdue)\n3. toni.morrison@example.com — due 2026-09-25 (6 days overdue)\n4. amelia.wong@example.com — due 2026-09-25 (6 days overdue, separate request)\n5. aliah.harris@example.com — due 2026-09-25 (6 days overdue)\n\nAll 5 are awaiting a manual action step before they can proceed. You may want to reassign or escalate these to unblock them."
            },
            {
              "description": "User asks which integrations have been failing recently; the assistant should fetch integration errors over a recent window.",
              "prompt": "Have any of my integrations had errors in the last 7 days?",
              "tools_triggered": "fetch_integration_errors",
              "expected_behavior": "Yes — 5 integrations had connection failures in the last 7 days (all on Oct 1):\n\n- Zendesk — 404 Not Found (resource may have been removed or misconfigured)\n- Twilio — 401 Unauthorized (credentials may be expired or revoked)\n- Stripe — 401 Unauthorized\n- Slack — 403 Forbidden (app may have lost workspace permissions)\n- Shopify — 401 Unauthorized\n\nThe 401s on Twilio, Stripe, and Shopify suggest API keys or OAuth tokens need to be refreshed. The Slack 403 may indicate the app was removed from the workspace."
            },
            {
              "description": "User asks which cookies still need attention on their consent banner; the assistant should list unmanaged/uncategorized cookies.",
              "prompt": "List the cookies on my site that haven't been categorized yet.",
              "tools_triggered": "fetch_cookies",
              "expected_behavior": "No uncategorized cookies were found for your account. This could mean all detected cookies have already been categorized, or that cookie scanning hasn't been set up yet for your consent container. To start scanning, connect a consent container in your Consent Management settings."
            },
            {
              "description": "User asks a how-to/product question that should be answered from documentation; the assistant should search the knowledge base.",
              "prompt": "How do I set up SSO for my privacy portal?",
              "tools_triggered": "search_knowledgebase_docs",
              "expected_behavior": "DataGrail supports SAML 2.0 (Okta, Entra ID, OneLogin, PingOne, VMware, JumpCloud, Cisco Duo) and OIDC (Google SSO, Microsoft SSO, Generic OIDC). To set up SSO: start from the invitation email, choose your provider type, configure your IdP, then supply your SAML metadata (XML upload or HTTPS metadata URL) on the DataGrail SSO setup page and select Configure to validate."
            },
            {
              "description": "User explicitly asks to create a new processing activity; a write action gated behind the org write-tools setting and a per-user grant.",
              "prompt": "Create a new processing activity called 'Marketing Analytics'.",
              "tools_triggered": "create_processing_activity",
              "expected_behavior": "Done! Processing activity 'Marketing Analytics' has been created. You can view and edit it in your Data Mapping settings. Next steps: link it to the relevant systems in your inventory and fill in the legal basis, data categories, and retention period to keep your ROPA complete."
            }
          ],
          "negative": [
            {
              "description": "General-knowledge question unrelated to privacy/data management; no tool should be triggered.",
              "prompt": "What's the weather in San Francisco today?"
            },
            {
              "description": "Dangerous bulk-destructive request with no corresponding tool; the assistant should decline rather than attempt any deletion.",
              "prompt": "Delete every privacy request in my account right now."
            },
            {
              "description": "Request for another company's data; out of scope because all access is scoped to the authenticated tenant.",
              "prompt": "Show me the open DSARs for Acme Corp, a different company than mine."
            }
          ]
        }
      }
    }
  }
}