Plugin Submission: JSON Schema (v1.0.0)

[ztistic]

Plugin Submission

Plugin information

• Author: eft (https://github.com/ztistic)
• Plugin name: JSON Schema (jsonschema)
• Version: 1.0.0
• Source repository: https://github.com/ztistic/dify-plugin-json-schema
• Contact: ztistic@outlook.com

Submission type

• New plugin
• Version update

What changed

New tool-type plugin providing two tools for Dify workflows:

• JSON Extract — locates the first parseable JSON string in a text, typically raw LLM output. Whole-text JSON and json-tagged or untagged fenced code blocks are recognized by default; a JSON object or array embedded in surrounding prose is scanned only when scan_embedded is true. Every candidate is decoded before acceptance and returned as a verbatim slice of the input; decoding is strict, so the non-standard constants NaN and Infinity are rejected.
• JSON Validate — validates a JSON string against a JSON Schema and classifies every failure into a typed error_type. Drafts 2020-12 / 2019-09 / 07 / 06 / 04 are selected from the schema's $schema (default 2020-12); boolean schemas are accepted, and only inline $ref pointers are resolved.

Both tools declare an output_schema, so downstream nodes can reference their fields as typed variables, and both return every classified failure as a structured payload instead of raising. The plugin runs fully offline: no network access, no credentials, no model calls. Requires Dify ≥ 1.14.2.

Risk level

• Low risk
• Medium risk
• High risk

Pure in-process text processing. No command or code execution, no network requests, no filesystem access, no credentials.

Required checks

• I have read and followed the https://github.com/langgenius/dify-plugins/blob/main/docs/plugin-submission-requirements.md.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the https://docs.dify.ai/en/develop-plugin/features-and-specs/plugin-types/multilingual-readme.

Security and privacy notes

None. The plugin does not execute commands or code, does not run SQL, does not use SSH/SFTP, does not automate a browser, does not read or write files, and does not fetch arbitrary URLs. It processes whatever text, JSON, and JSON Schema the workflow passes in, entirely in memory within the request, and stores, logs, and transmits nothing. Remote $ref references are intentionally not resolved, so validating a schema never triggers an outbound request. It requires no credentials and no network access.

Local validation

Github Actions: https://github.com/ztistic/dify-plugin-json-schema/actions/runs/38774206774

## Local DIFYPKG Validation Summary

- Report directory: /home/runner/work/dify-plugin-json-schema/dify-plugin-json-schema/validation-report
- Blocking failures: 0
- Warning categories: 1
- Environment/check execution failures: 0

| Check | Type | Status | Findings |
|---|---|---|---|
| `package_contents` | blocking | PASS | No findings. |
| `package_secrets` | blocking | PASS | No findings. |
| `package_binaries` | blocking | PASS | No findings. |
| `manifest_metadata` | blocking | PASS | No findings. |
| `readme_metadata` | blocking | PASS | No findings. |
| `package_dependencies` | blocking | PASS | No findings. |
| `python_compile` | blocking | PASS | No findings. |
| `python_safety` | warning | PASS | No findings. |
| `prohibited_financial_activity` | warning | PASS | No findings. |
| `access_domains` | warning | PASS | No findings. |
| `dependency_vulnerabilities` | warning | PASS | dependency source: requirements.txt (3 pinned, 0 unpinned) |

### Skipped checks
- sensitive capability disclosure blocking check requires --pr-body-file
- PR title/body language and template checks require GitHub PR metadata
- Marketplace duplicate-version check requires Marketplace/PR workflow context
- plugin install and upload-package tests are not run by this local validator

### Warnings for review
- dependency_vulnerabilities:
  - dependency source: requirements.txt (3 pinned, 0 unpinned)
  - no known vulnerabilities in the pinned dependency set

Reviewer notes

Known limitations:

• Only inline $ref pointers are resolved; remote references are never fetched, since the plugin does not touch the network.
• Nesting depth is bounded by the interpreter's recursion limit. Measured on CPython 3.12 with the default limit: schemas up to ~95 levels and data up to ~100–200 levels are handled; deeper input returns a structured internal_error rather than an exception.
• The validator deliberately does not preprocess input: json_input must already be valid JSON, and undeclared object properties are rejected only where the schema sets additionalProperties: false.

[crazywoola]

Verified publication eligibility for 2573547: Pre Check Plugin and PR Risk Label both passed for this revision, and this PR is open and ready for review. Inspected the submitted manifest, README, and relevant tool/provider source: the plugin provides offline JSON extraction and schema validation, with no Web3 functionality found. This approval covers publication eligibility.