[charifield]

Plugin Submission

Plugin information

• Author: apiverve
• Plugin name: apiverve
• Version: 0.1.0
• Source repository: https://github.com/apiverve/dify-plugin
• Contact: hello@apiverve.com

Submission type

• New plugin
• Version update

What changed

Adds APIVerve as one Dify tool provider with eight tools. Six cover common lookups directly: Validate Email, Validate Phone Number, Look Up IP Address, Look Up DNS Records, Check SSL Certificate and Get Exchange Rate. Find APIs searches the public APIVerve catalog (several hundred APIs) and returns each API's id and parameters without calling it. Run API calls any catalog API by id with its parameters as a JSON object, so an agent can search and then call. Users bring their own APIVerve API key; the plugin is free.

Risk level

• Low risk
• Medium risk
• High risk

The six named tools call fixed endpoints. Run API can reach any catalog API, and a few of those fetch a user-supplied URL server-side (for example website screenshot or website-to-text) or process user-supplied text and personal data such as email addresses and phone numbers.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

• Fixed hosts: API calls go only to https://api.apiverve.com, and Find APIs reads the public catalog from https://assets.apiverve.com/cli-manifest.json. Run API resolves the path from the catalog; the user cannot supply a host or path.
• Credentials: the API key is a secret-input provider credential, sent only in the x-api-key header to the fixed host. Redirects are refused so it cannot be forwarded elsewhere, it is redacted from any returned body or error, and it is never logged.
• Credential validation calls a read-only account endpoint that uses no credits.
• Requests use a 60 s timeout. Dependencies: dify_plugin only; HTTP uses the standard library.

Local validation

• dify plugin package with dify-plugin-daemon CLI 0.6.12: packaged successfully (27 files, no tests or caches).
• Unit tests: python -m unittest discover test, 8 passed (fixed host and header, path validation, key redaction, query/body placement, required parameters, unknown API id, search ranking).
• Live against the production API: catalog load (387 APIs) and search, invalid-key handling on credential validation and Run API, invalid JSON parameters.
• Dify Community Edition and Dify Cloud: not yet installed in a running Dify instance. The plugin uses only standard tool-provider features available since Dify 1.6.0.

Reviewer notes

A free APIVerve account includes a monthly credit allowance, enough to exercise every tool. No payment is handled by the plugin.