plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "sammy",
  "version": "1.0.0",
  "description": "Read-only access to your organization's SAMMY data: OWASP SAMM and other security maturity assessments, scores, frameworks, projects, products and threat models, suppliers and control implementations.",
  "author": {
    "name": "Codific",
    "email": "info@codific.com",
    "url": "https://codific.com"
  },
  "homepage": "https://codific.com/sammy/",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "SAMMY",
        "shortDescription": "Security maturity insights",
        "longDescription": "SAMMY is Codific's platform for software security maturity assessments, threat modeling, supplier security and control management, built around OWASP SAMM and other frameworks such as ISO 27001, NIST SSDF and DSOMM.\n\nConnect your SAMMY account to ask questions about your organization's security program in plain language:\n- List your assessments and see overall and detailed maturity scores per business function, security practice and maturity level.\n- Review the answers, remarks and status of each assessment stream.\n- Look up framework guidance: what a practice, stream or activity expects at each maturity level.\n- Explore your projects, products, their risk scenarios, threats and threat modeling events.\n- Review your suppliers and their assessment progress, and your control implementations with owners and linked framework elements.\n\nThe connection is strictly read-only: nothing in SAMMY can be created, changed or deleted from ChatGPT. You sign in with your own SAMMY account and approve the connection on SAMMY's consent screen; ChatGPT then sees only what your account is allowed to see. Requires a SAMMY organization whose plan includes the MCP integration, with the API and MCP integrations switched on by a platform manager.",
        "developerName": "Codific",
        "category": "Productivity",
        "capabilities": [
          "List security maturity assessments and their scores",
          "Explain OWASP SAMM and other framework requirements",
          "Review products, threats and threat modeling events",
          "Review suppliers and control implementations"
        ],
        "websiteURL": "https://codific.com/sammy/",
        "supportURL": "https://codific.com/contact/",
        "privacyPolicyURL": "https://codific.com/privacy-statement-eu/",
        "termsOfServiceURL": "https://codific.com/terms-conditions/",
        "defaultPrompt": [
          "Which security maturity assessments does my organization have in SAMMY?",
          "Show the overall SAMM scores of my latest assessment by business function.",
          "Which security practices have the lowest maturity in my assessments?"
        ],
        "brandColor": "#E74C42",
        "logo": "./assets/logo.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "List the organization's assessments",
              "prompt": "Which security maturity assessments does my organization have in SAMMY?",
              "tools_triggered": "list_assessments",
              "expected_behavior": "Lists the demo organization's 7 assessments across its 4 scopes: SAMM for Business Unit 1, Customer Portal, Mobile App and Payments API, plus NIST SSDF (Customer Portal), DSOMM (Mobile App) and ISO 27001:2022 CMMI (Payments API), with their progress. Nothing outside the demo organization is shown."
            },
            {
              "description": "Find the weakest practices and explain them",
              "prompt": "In the SAMM assessment of the Customer Portal, which security practices have the lowest maturity, and what does SAMM expect for them at the next level?",
              "tools_triggered": "list_assessments, get_assessment_detailed_scores, search_framework_elements",
              "expected_behavior": "Picks the SAMM assessment of the Customer Portal scope (not its NIST SSDF one), names its lowest-scoring practices with their scores, then summarises the SAMM guidance for reaching the next maturity level of each."
            },
            {
              "description": "Risks and threats of a product",
              "prompt": "What are the risk scenarios of our Payment Gateway product, and which threats were identified in its latest threat modeling event?",
              "tools_triggered": "list_products, get_product, get_threat_model_event",
              "expected_behavior": "Finds the Payment Gateway product and lists its risk scenarios (card data exposure, fraudulent refunds, checkout outage) and the threats of its latest threat modeling event: IDOR on the refund endpoint, stolen merchant API key, card data written to application logs and an unthrottled authorization endpoint, with severity and owner."
            },
            {
              "description": "Supplier overview",
              "prompt": "List our suppliers in SAMMY with their status, and tell me who our contact at the payment processor is.",
              "tools_triggered": "list_suppliers",
              "expected_behavior": "Lists Demo Cloud Hosting (Active) and Demo Payment Processor (In review) and names Alex Novak as the contact at the payment processor."
            },
            {
              "description": "Control implementation gaps",
              "prompt": "Which of our security controls are not fully implemented yet, and which SAMM activities do they relate to?",
              "tools_triggered": "list_controls, get_control, get_framework_element",
              "expected_behavior": "Names the controls that are not fully implemented (ORG-2 Quarterly dependency scanning, partially implemented; PGW-2 Object-level authorization checks, in progress) with their owner where set and the SAMM framework elements linked to each."
            }
          ],
          "negative": [
            {
              "description": "Write request: the app is read-only and must not claim to change data",
              "prompt": "Set every answer in the Payments API SAMM assessment to the highest maturity level."
            },
            {
              "description": "Delete request: no tool can delete anything",
              "prompt": "Delete the Demo Payment Processor supplier from SAMMY."
            },
            {
              "description": "Unrelated request: SAMMY tools should not be triggered",
              "prompt": "Write a Python function that reverses a string."
            }
          ]
        },
        "demo_recording_url": "https://drive.google.com/file/d/1vJc0AL-OmbKGYUDSgM2VCxzaI4J57-q_/view",
        "commerce": false
      },
      "publication": {
        "release_notes": "Initial release: read-only access to SAMMY assessments, scores, frameworks, projects, products, threat models, suppliers and controls."
      },
      "apps": "./.app.json"
    }
  }
}