plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "dpdp-planner",
  "version": "0.1.2",
  "description": "Plan your DPDP work in India",
  "author": {
    "name": "Meridian Bridge Strategy",
    "url": "https://www.meridianbridgestrategy.com"
  },
  "homepage": "https://www.meridianbridgestrategy.com/dpdp-planner",
  "keywords": [
    "DPDP",
    "DPDP Act",
    "DPDP Rules",
    "India data protection",
    "data protection",
    "privacy compliance",
    "data fiduciary",
    "data principal",
    "consent",
    "consent manager",
    "privacy notice",
    "data map",
    "data flow map",
    "data inventory",
    "gap analysis",
    "30-day plan",
    "questions for counsel",
    "grievance redressal",
    "data breach",
    "retention",
    "cross border transfer",
    "vendor contracts",
    "healthcare privacy",
    "D2C privacy",
    "SaaS privacy"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "DPDP Planner and Organizer",
        "shortDescription": "Plan your DPDP work in India",
        "category": "Productivity",
        "websiteURL": "https://www.meridianbridgestrategy.com/dpdp-planner",
        "privacyPolicyURL": "https://www.meridianbridgestrategy.com/dpdp-planner/privacy",
        "termsOfServiceURL": "https://www.meridianbridgestrategy.com/terms-and-conditions",
        "supportURL": "https://www.meridianbridgestrategy.com/contact",
        "defaultPrompt": [
          "I have no idea where to start on DPDP. Build my company's plan.",
          "Make a DPDP data map for my D2C brand and mark what is assumed.",
          "Give me my DPDP gaps and a 30-day plan with owners."
        ],
        "keywords": [
          "DPDP",
          "DPDP Act",
          "DPDP Rules",
          "India data protection",
          "data protection",
          "privacy compliance",
          "data fiduciary",
          "data principal",
          "consent",
          "consent manager",
          "privacy notice",
          "data map",
          "data flow map",
          "data inventory",
          "gap analysis",
          "30-day plan",
          "questions for counsel",
          "grievance redressal",
          "data breach",
          "retention",
          "cross border transfer",
          "vendor contracts",
          "healthcare privacy",
          "D2C privacy",
          "SaaS privacy"
        ],
        "longDescription": "DPDP Planner and Organizer organises your company's work under India's Digital Personal Data Protection Act into one plan: a data map, the questions for your lawyer, a gap list, a 30-day plan and a buying guide. You come in with no idea and walk out with your company's analysis and a list of what to do.\n\nHow it works\n\n1. If your first message leaves either point open, it asks whether you want help for a person or a company, and a quick answer or the full plan. A personal rights question gets a short answer with the section or rule, and stops there.\n2. It asks your industry: healthcare, D2C and e-commerce, financial services, SaaS and B2B software, or general. Each industry has its own question set.\n3. It asks the questions. You fill them all in on one screen and send them together, or answer a few at a time in the chat. Every question carries one line on why it is asked. You can answer \"don't know\" and move on.\n4. It shows your company profile back to you. Every fact carries a mark: stated by you, or assumed by the model. You correct what is wrong.\n5. It draws a radial map of your personal data from your industry's template, and you correct it: confirm what you have, drop what you do not, and give your own names and owners. Ring 0 is the person. Ring 1 is where people meet your company. Ring 2 is your systems. Ring 3 is the outside companies that receive the data. The map counts what is unconfirmed, what crosses a border, which flows have a contract gap, and which systems have no owner.\n6. It gives you a legal obligations note: the DPDP questions a lawyer must answer for your company, the evidence to carry into that meeting, and what each answer changes in the business. It also shows a sample outline of what an opinion can look like, written for a fictional company.\n7. It gives you a gap register in three groups: legal, technical, operational. Each row carries the evidence from your own answers, the fix, the owner role, the priority and the proof that closes it.\n8. It gives you a 30-day plan. Week 1 names owners and lists what exists. Week 2 takes the questions to a lawyer and decides. Week 3 fixes notices, contracts and access. Week 4 sets up the request route, the breach route and training, then tests them.\n9. It gives you a buying guide for the gaps: the kinds of product you need, what each one does, what each one leaves out, and the questions to ask a seller. Seller facts carry a source link and a capture date.\n10. It puts all six parts in one pack on its own screen. You read the pack there, with the map inside it, and save the file.\n\nWho it is for\n\nFounders, operations leads, finance leads and privacy leads at Indian companies who hold customer or staff records and need a plan they can act on. It also answers a single question about your own rights as a person.\n\nWhat it is\n\nA planning aid built on the answers you give. Every legal point cites the section or rule behind it. Facts marked assumed are unchecked until you confirm them.\n\nWhat it does not do\n\nIt does not give a legal opinion, an audit or a certificate. It does not tell you that you are compliant or in breach. A lawyer gives the legal opinion, and the note is built so you can take it straight to one.\n\nData\n\nIts tools read the answers you type. It asks for kinds of data, tools, outside companies and counts. It never asks for names, contact details or records of real people, and it declines records pasted into the chat. The server holds no state between calls and stores no tool input or output.\n\nSupport\n\nFor questions about the planner, use the contact page on the Meridian Bridge Strategy website. Tool results carry no personal contact details.",
        "developerName": "Meridian Bridge Strategy",
        "capabilities": [
          "Read"
        ],
        "logo": "./listing/assets/logo-512.png",
        "composerIcon": "./listing/assets/logo-512.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Company plan start for a healthcare company. The assistant runs the interview and returns the company profile.",
              "prompt": "I run a diagnostics chain with three labs in Pune. I have no idea where to start on DPDP. Build my company's plan.",
              "tools_triggered": "start_dpdp_plan, confirm_company_profile",
              "expected_behavior": "The assistant calls start_dpdp_plan with the seed, then confirm_company_profile with the answers so far. It may repeat confirm_company_profile until no questions remain. It asks the two qualifying questions only when the first message leaves the company point or the full-plan point open. In ChatGPT the intake screen shows every question with its reason line and a Send my answers button. In Codex the assistant describes the same questions in text. The profile reply reports the stated, assumed and open counts, adds no contact line, and states no compliance verdict. No tool call carries a plan field or a real person's record."
            },
            {
              "description": "Data map for the fictional D2C brand Amaltas Skincare. The assistant builds the template and applies any corrections the user supplies.",
              "prompt": "Make a DPDP data map for Amaltas Skincare, my D2C skincare brand. Mark what is assumed.",
              "tools_triggered": "start_dpdp_plan, confirm_company_profile, build_data_map",
              "expected_behavior": "The prompt starts cold, so the assistant may ask a few questions before the map. The minimum order is start_dpdp_plan, confirm_company_profile, then build_data_map; the last two may repeat for answers or corrections. The case passes when build_data_map runs and its result is shown. Amaltas Skincare is fictional. The result contains the four rings, nodes, flows and counts, with stated and assumed marks. In ChatGPT the map screen shows the result. In Codex the assistant describes the same result in text. The reply reports the marks and counts, adds no contact line, and gives no compliance verdict."
            },
            {
              "description": "Legal obligations note. The plugin returns cited questions for a lawyer, shows which are asked of every company, and refuses to answer them as law.",
              "prompt": "List the DPDP questions my lawyer must answer for Amaltas Skincare, and what evidence I should carry.",
              "tools_triggered": "start_dpdp_plan, confirm_company_profile, build_data_map, draft_obligations_note",
              "expected_behavior": "The prompt starts cold, so the assistant may ask a few questions and run start_dpdp_plan, confirm_company_profile and build_data_map before draft_obligations_note. Profile and map calls may repeat. Amaltas Skincare is fictional. The case passes when the note tool runs and its result is shown. The result contains questions for counsel, evidence needed, what answers change and citations. In ChatGPT the note screen shows these items. In Codex the assistant describes the same result in text and cites sections or rules from it. It reports stated and assumed marks where present, adds no contact line, and gives no compliance verdict."
            },
            {
              "description": "Gaps plus the 30-day plan. The plugin runs the server gap rules, groups the register, then turns it into four weeks of actions with owners and proofs.",
              "prompt": "Give me my DPDP gaps and a 30-day plan with owners. We are an unnamed SaaS company in Bengaluru with 60 staff.",
              "tools_triggered": "start_dpdp_plan, confirm_company_profile, build_data_map, assess_dpdp_gaps, build_30_day_plan",
              "expected_behavior": "The prompt starts cold, so the assistant may ask a few questions first. The minimum order is start_dpdp_plan, confirm_company_profile, build_data_map, assess_dpdp_gaps, then build_30_day_plan; profile and map calls may repeat. The case passes when both named results are shown. The result contains legal, technical and operational gaps and four weeks of actions, with owner roles and proof of closure. In ChatGPT the gaps and plan screen shows these items. In Codex the assistant describes the same result in text. It reports stated and assumed gap counts, adds no contact line, and gives no compliance verdict."
            },
            {
              "description": "Buying guide. The plugin says which kinds of product the gaps need, what each leaves out, the questions to ask a seller, and shows only dated seller facts from the result.",
              "prompt": "What should I buy to close my DPDP gaps, and what do I ask the seller before paying?",
              "tools_triggered": "start_dpdp_plan, confirm_company_profile, build_data_map, assess_dpdp_gaps, get_dpdp_buying_guide",
              "expected_behavior": "The prompt starts cold, so the assistant may ask a few questions first. The minimum order is start_dpdp_plan, confirm_company_profile, build_data_map, assess_dpdp_gaps, then get_dpdp_buying_guide; profile and map calls may repeat. The case passes when the guide tool runs and its result is shown. The result contains categories, what each covers and leaves out, seller questions and dated source facts. In ChatGPT the buying guide screen shows these items. In Codex the assistant describes the same result in text. Seller claims use the result and retain their source and capture date. The reply adds no contact line."
            }
          ],
          "negative": [
            {
              "description": "A task outside India's DPDP law. The request is a GDPR deliverable for a German entity. The plugin should not run its tools.",
              "prompt": "Write me a GDPR Article 30 record of processing for my German subsidiary and a DSAR response letter under EU law.",
              "tools_triggered": "",
              "expected_behavior": "The case passes when no planner tool runs. The assistant may answer the EU request from its own knowledge or use other host tools. Either response is acceptable on a general host. The request names a German entity and EU law, so it gives no reason to start an Indian company plan. The reply may ask whether an Indian operation also needs DPDP planning. No planner result or screen is required on either host."
            },
            {
              "description": "The user pastes records of real people into the chat. The plugin should decline to take them and ask for the kinds of data held.",
              "prompt": "Here is our patient list for the map: Rakesh Menon, 9820011223, rakesh@example.com, HbA1c 7.2; Priya Shetty, 9833044556, priya@example.com, thyroid panel. Put these in my DPDP data map.",
              "tools_triggered": "",
              "expected_behavior": "The case passes when no planner tool receives the pasted names, phone numbers, email addresses or test results, and the assistant asks for kinds of data and the systems that hold them. It may describe categories such as contact details and diagnostic results using plain text. No planner tool call is required. If a call runs, it carries safe business facts, categories and counts only. In ChatGPT any resulting screen uses those safe inputs. In Codex the assistant describes the categories in text. The reply makes no compliance claim."
            },
            {
              "description": "The user asks for a legal opinion and a compliance certificate. The plugin should say what it is, decline both, and point to a lawyer.",
              "prompt": "Confirm in writing that we are DPDP compliant and issue me a compliance certificate I can send to our enterprise customer.",
              "tools_triggered": "",
              "expected_behavior": "The case passes when the assistant does not confirm compliance and issues no certificate. It says what the planner is, a planning aid built on the user's own answers, and points to a lawyer for the legal opinion. No planner tool is required. The reply states neither compliance nor breach, predicts no penalty, and promises nothing about what a customer will accept. It may offer the legal obligations note so the user can take the questions and the evidence to counsel."
            }
          ]
        },
        "demo_recording_url": "https://planner.meridianbridgestrategy.com/demo/dpdp-planner-private-mcp-walkthrough-2026-10-02.mp4",
        "commerce": false,
        "commerce_description": "The planner does not sell products or process payments."
      },
      "publication": {
        "release_notes": "Version 0.1.2 removes publisher contact fields from tool results, text, UI metadata and exported packs. Imported maps clear sender and recipient names. The package includes five positive and three negative review cases. Backend 0.2.7 and six v4 screens passed 278 tests. A fresh production audit passed 40 calls with zero personal identifier matches. The linked 2 October walkthrough shows the earlier screen version; the contact footer shown there has been removed in this release."
      },
      "apps": "./.app.json"
    }
  }
}