Plugins
Plugins extend the Gateway with trusted code. They can add channel runtimes, model-provider auth flows, Agent tools, slash commands, skills, hooks, and Gateway RPC methods. Use plugins when a feature needs runtime code that is not part of the core Gateway. Use Agent > Skills when you only need instructions. Use Agent > Services when you only need credentials for an existing service.Where Plugin Setup Lives
| Need | Use |
|---|---|
| Install, enable, disable, update, inspect | Extensions or fased plugins ... |
| Channel account setup | Agent > Channels |
| Agent tool allow/deny | Agent > Tools |
| Skill access and dependency setup | Agent > Skills |
| Provider sign-in/API key | Agent > Models |
| Raw plugin config | Advanced > Config when no focused UI exists |
Install And Enable
List plugins:What A Plugin Can Provide
| Capability | Example | User setup surface |
|---|---|---|
| Channel runtime | Zalo Personal, external chat adapters | Agent > Channels |
| Agent tool | workflow helper, voice-call tool | Agent > Tools |
| Skill pack | plugin-owned skills/<name>/SKILL.md | Agent > Skills |
| Provider auth | OAuth or token setup for a model provider | Agent > Models |
| Gateway method | pluginId.status, pluginId.action | Plugin-specific docs / CLI |
| Slash command | /plugin-command ... without a model turn | Chat/channel command surface |
| Hook | lifecycle/event hook registered by plugin | Plugin lifecycle, not Hooks UI |
channels.<id>, not
plugins.entries.<id>.config, because Channels owns account setup and routing.
Agent tools registered by plugins still require Agent tool policy. Skills
shipped by plugins still require Agent skill access. Wallet, mining,
marketplace, and node actions keep their own approval gates.
Manifest Requirement
Every plugin must shipfased.plugin.json in the plugin root. The manifest lets
Fased validate plugin config without executing plugin code.
Minimal manifest:
Built-In Examples
OpenProse
Markdown-first workflow programs and an optional skill pack.
Voice Call
Outbound and inbound call workflows through a trusted plugin.
Zalo Personal
Personal Zalo channel runtime backed by the bundled extension.
Community Plugins
Listing requirements and third-party plugin quality bar.
Safety
Plugins run in the Gateway process. Treat them as trusted code.- Install plugins only from sources you trust.
- Prefer
plugins.allowallowlists for non-bundled plugins. - Keep plugin dependency installs pinned and reviewed.
- Do not use a plugin to bypass Agent tool policy, wallet approvals, mining controls, marketplace authority, or channel access policy.
- Missing or invalid manifests should block config validation.