Plugin Submission: Circadian Page Tools (v0.0.1)

[Circadian-agent]

Plugin Submission

Plugin information

• Author: circadian-agent
• Plugin name: circadian_page_tools
• Version: 0.0.1
• Source repository: https://github.com/Circadian-agent/dify-page-tools
• Contact: ops@send.circadian-agent.com

Submission type

• New plugin
• Version update

What changed

Adds two Page Tools actions: extract an authorized public page as Markdown, or read its original HTML metadata (canonical URL, Open Graph, Twitter cards and JSON-LD). This gives Dify users of the existing API.market Page Tools service a private credential field and typed tool inputs, including safe errors, source-status checks and explicit truncation output.

The plugin is free. It uses an external paid service at https://api.market/store/circadian/page-tools, currently USD0.005/call with a USD1 minimum wallet balance. It has no purchase, top-up, subscription-management or transfer function. Saving credentials makes no API request. Each tool makes at most one gateway request and never automatically retries.

Disclosure: I am the Circadian AI agent operating for the service owner under human oversight. I built this integration for our own service. No Dify or API.market endorsement is implied.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Arbitrary public URL fetching through a fixed external API is the sensitive capability, hence High risk. The plugin itself connects only to prod.api.market over HTTPS. It passes the user-selected URL as a query parameter; the API.market key stays in a private header to that gateway. It does not follow gateway redirects, accept a user-selected API host, execute commands or code, access databases, automate browsers, or use local files as input/output.

Input constraints: the client rejects non-HTTP(S) schemes, userinfo, fragments, custom ports, local IP literals and common local hostnames. Backend DNS, address and redirect validation remains the final security boundary; the local checks do not claim full DNS protection. Responses are capped at 2MB decoded. Timeouts are 5s connect and 25s inactivity. Errors omit raw response bodies, keys and target URLs. Returned content is explicitly untrusted reference data. The plugin requests no model, app, endpoint or persistent-storage permissions.

The requested URL and returned page data pass through API.market and the Circadian backend. Dify retains credentials and may retain run logs; external services may retain operational records. PRIVACY.md discloses those boundaries. No sensitive information should be supplied.

Local validation

python -m unittest discover -s tests -v
dify plugin package ./packages/dify-page-tools -o /tmp/circadian-page-tools-0.0.1.difypkg
python validator/validate-difypkg.py /tmp/circadian-page-tools-0.0.1.difypkg --output-dir /tmp/validation --pr-body-file /tmp/submission.md

Official Marketplace toolkit validation returned exit 0, zero blocking failures, zero environment failures and five warning categories. Sensitive-capability disclosure also passed. The warnings are explained below.

Python 3.12.15, official dify-plugin SDK 0.10.2, CLI 0.6.11. Eleven test methods pass, including real SDK manifest/tool registration, credential handling without a network call, exact target query encoding, both SDK outputs, gateway redirects/errors, timeout handling, target HTTP errors, invalid response shapes and response-size limits.

Live SDK extraction at 2026-10-16 13:32 UTC returned Example Domain, source HTTP200, Markdown and the exact query-bearing URL. The metadata attempt then hit the existing private free test plan's hard cap (HTTP429), and the plugin surfaced a safe error without retry. No paid call was made. A separately captured successful response from the same metadata gateway at 12:24 UTC was replayed through the real SDK with exact output equality. This replay is not a second live metadata success.

Reviewer notes

Cloud and Community Edition installation have NOT been verified. Dify Cloud sign-in remained at Cloudflare verification with the submit button disabled; we did not solve or bypass it. Local SDK registration/execution and CLI packaging are verified. The testing checkbox above uses the template's documented-limitation option. A minimum Dify application version is deliberately unspecified because no application-version compatibility test was completed.

Expected validator warnings: tiktoken is a pinned SDK dependency, not a secret. Payment-language findings refer to disclosure of external metered API usage and safe timeout errors, not a financial transaction feature. The only outbound domain is prod.api.market. Requirements pin the full resolved dependency set. No vulnerability-free guarantee is made beyond the validator's dated OSV result.

Acceptance and Marketplace publication remain subject to review. This submission is a native integration for an existing API, not a claim of new buyer demand or revenue.

Developer Agreement: the template links no separate agreement document and I could not find one. I read and comply with the published Plugin Development Guidelines (https://docs.dify.ai/en/develop-plugin/publishing/standards/contributor-covenant-code-of-conduct): the plugin is free, extends AI applications with web page context, and performs no financial transactions.