Update Thordata SERP plugin to v0.1.1 (README rewrite)

[ThorData2026]

Plugin Submission

Plugin information

• Author: thordata
• Plugin name: thordata_serp
• Version: 0.1.1
• Source repository: https://github.com/Thordata/dify-plugin-thordata-serp
• Contact: cianna@thordata.com

Submission type

• New plugin
• Version update

What changed

Documentation-only release. README.md was rewritten so the Marketplace page carries the setup path and the value of the plugin: what the 34 generated engine tools cover, how to create a Thordata account and paste the API Token, the credential-validation behavior, the two declared network endpoints, and where to get support.

No runtime behavior changed. The tool set, the provider code, the bundled schema snapshot, and the declared network domains are identical to 0.1.0. manifest.yaml and pyproject.toml were bumped to 0.1.1, and the unit test that pins the manifest version was updated to match. There are no breaking changes and nothing to migrate.

Risk level

• Low risk
• Medium risk
• High risk

Unchanged from 0.1.0. The plugin sends user-provided search queries and engine parameters to a third-party service.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Unchanged from 0.1.0; this release only changes documentation.

Network egress is limited to two fixed, documented HTTPS endpoints, both declared in manifest.yaml under network.domains:

• https://api.thordata.com/serp/playground/schema?lang=en retrieves the public engine schema and sends no API key.
• https://scraperapi.thordata.com/request performs the authenticated search.

The endpoints are hard-coded in the provider. The plugin exposes no endpoint override, does not accept user-supplied URLs, does not follow redirects, and does not proxy or crawl arbitrary destinations, so it cannot be used as an open proxy or SSRF primitive. Outbound request targets are therefore not user-controlled.

The provider credential is a Thordata SERP API key supplied by Dify. It is read from the provider credentials, held in memory for the duration of a request, and redacted from expected error messages before they cross the tool boundary. The plugin does not write the key, the query, or the results to disk or to logs, and does not persist any of them.

User-provided data is limited to the search query and engine-specific search parameters (for example language, country, and location targeting). These are transmitted over HTTPS to Thordata solely to perform the requested search, and the structured response is returned to the Dify runtime.

The plugin performs no command execution, no code execution, no SQL or database access, no SSH/SFTP, no filesystem operations, and no browser automation. It processes no uploaded files and handles no health, financial, biometric, children, or authentication data. A PRIVACY.md is included in the package and referenced from manifest.yaml.

Local validation

The submitted package was unpacked and checked offline with the Marketplace validator suite (langgenius/dify-marketplace-toolkit), running the same scripts the Pre Check Plugin workflow runs:

• check-package-contents.py - passed
• check-package-secrets.py - passed (warnings only: two generic "review possible secret field" notes, on the string tiktoken inside the pinned requirements.txt and on the constant name _API_KEY_ERROR)
• check-package-binaries.py - passed (the only output is a per-file "has executable permission" note, which is an artifact of checking a Windows-extracted tree where every file reports as executable; there are no executables or native binaries in the archive)
• check-manifest-metadata.py - passed (single warning: meta.minimum_dify_version is intentionally not declared)
• check-readme-metadata.py - passed
• check-package-dependencies.py - passed
• check-sensitive-capabilities.py - passed
• check-python-safety-warnings.py - passed (warnings only; they flag the functions that exist to redact the credential)
• check-prohibited-financial-activity.py - passed
• check-pr-body.py, check-pr-review-notes.py - passed
• check-version-update.py - passed; 0.1.1 sorts above the 0.1.0 package already in this directory

The Marketplace API has no thordata/thordata_serp/0.1.1 release (404), and every file in the archive was verified byte-for-byte against the tagged source revision except the generated requirements.txt.

The plugin's own offline unit test suite was run against this source revision: 737 passed, 2 skipped, 1 failed. The one failure is tests/test_project_layout.py::test_plugin_is_nested_under_dify_workspace, which asserts that a sibling tutorial/ directory exists next to the plugin checkout in the author's local workspace. It is an environment layout assertion unrelated to plugin behavior, and tests/ is not part of the package.

Reviewer notes

This is a documentation-only update on top of the merged 0.1.0. The only intended user-visible difference is the Marketplace page text and the README shipped inside the package.

The submitter has still not exercised this package end to end inside a live Dify Community Edition or Dify Cloud instance; please treat in-Dify behavior as unverified pending reviewer testing.