.codex-plugin/plugin.json

{
  "author": {
    "name": "GitHits"
  },
  "description": "GitHits connects ChatGPT and Codex to a version-aware index of open-source code, documentation, and package data across 13 registries (npm, PyPI, Maven, NuGet, crates.io, Go, RubyGems, Composer/Packagist, Hex, SwiftPM, vcpkg, Zig, Pub) and 30 languages. ChatGPT and Codex read the source code for the library version you use, not what they remember from training. No need to clone repositories or read GitHub one raw file at a time.\n\nUse GitHits to:\n\n\u00a0* Understand how a library works internally: how a function is implemented, what it does under the hood, and why it behaves the way it does\n\u00a0* Research technical questions about open-source projects, with answers grounded in source code and documentation\n\u00a0* Search, read, grep, and navigate source files in packages and repositories\n\u00a0* Search and read package documentation, APIs, and configuration options\n\u00a0* Check a package\u2019s latest version, license, dependencies, and known vulnerabilities\n\u00a0* Review changelogs and plan upgrades: what changed and what breaks\n\u00a0* Find implementation examples and prior art in open-source projects\n\nGitHits indexes the open-source ecosystem your app depends on, not your local workspace or private code.",
  "interface": {
    "capabilities": [
      "Search open source code by topic, symbol, exact text, or regular expression",
      "Find version-specific documentation, API references, and guides for open source libraries",
      "Browse package and repository files, then read focused source lines or individual symbols",
      "Understand how library functions work internally and why they behave the way they do",
      "Find API usage patterns and call sites in real open source projects",
      "Look up configuration options, defaults, and setup examples in source code and documentation",
      "Investigate unfamiliar errors using library implementations and examples from other projects",
      "Find real-world implementation examples and prior art across open source projects",
      "Compare how different projects solve similar problems and implement cross-library patterns",
      "Research technical questions about open source projects with answers grounded in code and documentation",
      "Look up package metadata across registries, including project links and release information",
      "Check the latest published package version and inspect source for the version you use",
      "Look up open source package licenses to inform dependency selection and review",
      "Assess package health using available adoption, maintenance, and project activity evidence",
      "Inspect direct dependencies and dependency graphs for public packages",
      "Explore transitive dependencies to understand a package version's dependency footprint",
      "Check known vulnerabilities affecting specific package versions and their transitive dependencies",
      "Read changelogs and release notes for individual versions or a range of releases",
      "Compare source code across package versions, repository branches, tags, or commits",
      "Review dependency upgrades for breaking changes, migration guidance, and compatibility risks"
    ],
    "category": "Developer Tools",
    "defaultPrompt": [
      "Find real-world open-source examples of implementing OAuth PKCE in TypeScript.",
      "Review the risks and breaking changes when upgrading Pydantic AI from version 1 to 2.",
      "Explain how Hono implements middleware, citing its documentation and source code."
    ],
    "developerName": "GitHits",
    "displayName": "GitHits",
    "longDescription": "GitHits connects ChatGPT and Codex to a version-aware index of open-source code, documentation, and package data across 13 registries (npm, PyPI, Maven, NuGet, crates.io, Go, RubyGems, Composer/Packagist, Hex, SwiftPM, vcpkg, Zig, Pub) and 30 languages. ChatGPT and Codex read the source code for the library version you use, not what they remember from training. No need to clone repositories or read GitHub one raw file at a time.\n\nUse GitHits to:\n\n\u00a0* Understand how a library works internally: how a function is implemented, what it does under the hood, and why it behaves the way it does\n\u00a0* Research technical questions about open-source projects, with answers grounded in source code and documentation\n\u00a0* Search, read, grep, and navigate source files in packages and repositories\n\u00a0* Search and read package documentation, APIs, and configuration options\n\u00a0* Check a package\u2019s latest version, license, dependencies, and known vulnerabilities\n\u00a0* Review changelogs and plan upgrades: what changed and what breaks\n\u00a0* Find implementation examples and prior art in open-source projects\n\nGitHits indexes the open-source ecosystem your app depends on, not your local workspace or private code.",
    "privacyPolicyURL": "https://githits.com/legal/privacy-policy/",
    "shortDescription": "Search open-source code & docs",
    "supportURL": "https://githits.com/support",
    "termsOfServiceURL": "https://githits.com/legal/terms-of-service/",
    "websiteURL": "https://githits.com",
    "logo": "./assets/githits-icon.png",
    "composerIcon": "./assets/githits-icon.png"
  },
  "name": "app-6a50ae4d69148191a8be900e47c6163b",
  "skills": "./skills",
  "version": "1.0.18",
  "mcpServers": "./.mcp.json",
  "extensions": {
    "com.openai": {
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "P1 - Package metadata and version-specific vulnerability evidence. Verify that current package metadata is distinguished from an assessment of a pinned older version.",
              "prompt": "Use GitHits to summarize the latest published npm:lodash package: version, license, source repository, and available maintenance signals. Separately check npm:lodash@4.17.20 for known vulnerabilities. Cite the evidence and distinguish unknown coverage from a clean result.",
              "tools_triggered": "pkg_info, pkg_vulns; quick_start first only when the GitHits MCP skill or guide has not already been loaded.",
              "expected_behavior": "Calls pkg_info for npm:lodash and pkg_vulns for npm:lodash@4.17.20. Reports the returned latest package version separately from the inspected vulnerability version. Summarizes returned advisories, affected ranges, and fixed versions when available, with package/advisory provenance. Does not invent advisory counts or interpret missing/unknown data as proof of safety. States that public package evidence does not establish the application's dependency reachability or overall security. Does not install or upgrade a dependency."
            },
            {
              "description": "P2 - Find and inspect public source and documentation. Verify that source paths and citations come from returned evidence and that documentation/version scope is preserved.",
              "prompt": "Use GitHits to find Express documentation and source code explaining how app.use mounts middleware, including middleware mounted on a path prefix. Read the relevant evidence and explain the relationship between the documented API and its implementation, with citations.",
              "tools_triggered": "search, read; list or grep if needed to locate source; quick_start first only when the GitHits MCP skill or guide has not already been loaded.",
              "expected_behavior": "Searches the public Express package or repository for relevant source and documentation. Uses returned target/path or documentation-page locators for focused reads instead of inventing paths. Explains the requested API behavior using fetched evidence and cites the actual files or documentation pages. Identifies the inspected version/ref when provided, and distinguishes current hosted documentation from pinned source if they differ. Follows explicit indexing/continuation guidance when necessary and reports unavailable evidence without fabricating an implementation."
            },
            {
              "description": "P3 - Cross-project code example generation. Exercise the credit-consuming tool that persists a generated result and returns source provenance.",
              "prompt": "Use GitHits to find real-world public open-source examples of implementing OAuth PKCE in TypeScript. Compare how the examples generate a code verifier and derive an S256 code challenge. Cite the source repositories and note any limitations in the examples you find.",
              "tools_triggered": "get_example; read only if additional source verification is needed; quick_start first only when the GitHits MCP skill or guide has not already been loaded.",
              "expected_behavior": "Calls get_example with the public cross-project request and an appropriate language constraint if useful. Summarizes only the returned examples and cites their source repositories/references. Does not present generated text as code from the user's workspace or claim that examples prove security or version compatibility. Preserves any returned solution_id/link as a follow-up locator without inventing one. Recognizes that the operation consumes Code Example Credits and saves a result; host-required authorization is respected. A credit/authentication failure is reported accurately rather than treated as a successful example search."
            },
            {
              "description": "P4 - Source-backed research with a persisted thread. Exercise research on a known public project and preserve its returned provenance and thread locator.",
              "prompt": "Use GitHits to research how Hono orders middleware execution before and after next(), and how that affects a middleware that measures request duration. Base the explanation on public source or documentation and cite the evidence.",
              "tools_triggered": "research; read only if a necessary detail is missing from the returned answer; quick_start first only when the GitHits MCP skill or guide has not already been loaded.",
              "expected_behavior": "Calls research for the public Hono package/repository, or uses targetless research and resolves any returned candidates before proceeding. Presents the returned answer with its actual sources and any coverage limitations. Retains the returned thread_id when supplied and does not invent a thread or claim a follow-up occurred. Recognizes that research consumes usage credits and creates or continues saved research state; host-required authorization is respected. Reports indexing, authentication, credit, or service failures as such instead of fabricating a completed research answer."
            },
            {
              "description": "P5 - Version-to-version upgrade assessment. Verify that an evidence request does not become an installation or a guarantee of application compatibility.",
              "prompt": "Use GitHits to review upgrading npm:lodash from 4.17.20 to 4.17.21. Summarize vulnerability changes, release notes, and any available dependency or compatibility evidence. Explain what I should verify in my application before upgrading. Do not modify files or install anything.",
              "tools_triggered": "pkg_upgrade_review; pkg_changelog, pkg_vulns, or code_diff only if needed to fill an evidence gap; quick_start first only when the GitHits MCP skill or guide has not already been loaded.",
              "expected_behavior": "Calls pkg_upgrade_review with lodash's requested current and target versions and preserves that comparison. Summarizes returned vulnerability changes and release evidence, citing their provenance. Separates documented facts from application-specific compatibility judgments, reports missing evidence, and recommends relevant local checks without claiming to have run them. Does not install packages, edit manifests/lockfiles, accept terms, or start unrelated configuration."
            }
          ],
          "negative": [
            {
              "description": "N1 - Private repository is outside GitHits coverage.",
              "prompt": "Use GitHits to explain how authentication works in our private repository github:example-private-org/billing-service.",
              "tools_triggered": "None.",
              "expected_behavior": "Explains that GitHits searches public open-source code and cannot inspect this private repository. Does not submit the private target to GitHits or claim to have read it."
            },
            {
              "description": "N2 - An unrelated writing request does not need GitHits.",
              "prompt": "Write a short out-of-office reply saying I will return on Monday.",
              "tools_triggered": "None.",
              "expected_behavior": "Writes the requested reply directly without calling GitHits, starting setup, or requesting account access."
            },
            {
              "description": "N3 - A dependency vulnerability check needs identified packages and versions.",
              "prompt": "I am using ChatGPT. Check my application dependencies for known vulnerabilities with GitHits. I have not provided a dependency list or package versions.",
              "tools_triggered": "None until the user supplies package names and versions.",
              "expected_behavior": "Asks for the public package names and installed versions needed for the check. Does not choose arbitrary dependencies, assume latest versions are installed, or claim that the application has been audited."
            }
          ]
        },
        "demo_recording_url": "https://accounts.githits.com/storage/v1/object/public/assets/githits-chatgpt-demo.mp4"
      }
    }
  },
  "apps": "./.app.json"
}