[prian3003]

Plugin Submission

Plugin information

• Author: proxmint
• Plugin name: proxmint
• Version: 0.1.0
• Source repository: https://github.com/proxmint/dify-proxmint
• Contact: [email protected]

Submission type

• New plugin
• Version update

What changed

Adds Proxmint as a tool provider with one tool, Fetch page. It reads a web page through the user's own Proxmint residential, datacenter or 4G/5G mobile proxy, from a chosen country and city, and returns the page as readable text (or raw HTML) plus a JSON object with the final URL, HTTP status, title and content type. Users bring their own Proxmint API key, and bandwidth comes out of their own Proxmint account. The plugin itself is free.

Risk level

• Low risk
• Medium risk
• High risk

The tool fetches user-supplied URLs through an HTTP proxy, which the submission requirements classify as high risk.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

• Arbitrary URL fetching and proxying. The user or the model supplies the target URL; only http and https URLs are accepted. The plugin never connects to the target host itself: every request is sent as a proxied request to the fixed gateway gw.proxmint.com:823 (an httpx client with an explicit proxy=, so environment proxy settings and NO_PROXY do not apply), and the site is reached from the proxy's exit IP. A URL that points at a private or internal address cannot reach the Dify host's network.
• Fixed hosts. proxmint.com over HTTPS (GET /api/v1/account, to read the proxy login) and gw.proxmint.com:823 (HTTP proxy). Both are declared under network.domains in manifest.yaml.
• Credentials. The Proxmint API key is a secret-input provider credential, sent only in the Authorization header to https://proxmint.com/api/v1/account. The key is read-only. The proxy login it returns is kept in process memory for up to 10 minutes and sent only to the gateway as proxy authentication. Neither is logged, written to disk, or included in tool output or error messages.
• Limits. 60 s timeout per request, at most 5 redirects (each one also goes through the proxy), and output capped by the Max characters parameter (default 50,000).
• Personal data. The plugin collects none. A fetched page contains whatever the target site publishes.

Local validation

• dify plugin package with dify-plugin-daemon CLI 0.6.11: packaged successfully (14 files, no tests or caches).
• Marketplace toolkit validators, run locally on the unpacked package: package contents, secrets, binaries, README metadata, dependencies, prohibited financial activity and access domains all pass. Python safety prints one warning, tools/_gateway.py:75 returning Credentials(username, password): that function hands the proxy login to the HTTP client, and the login is never returned to Dify or logged.
• Unit tests (pytest tests, offline, against a stand-in gateway and account API): 5 passed, covering targeting in the proxy username, text and JSON output, truncation, the login cache and its reset after a gateway refusal, and credential validation.
• Serverless runtime: started the unpacked package with INSTALL_METHOD=serverless and sent validate_tool_credentials and invoke_tool requests to /invoke. With an invalid key, both returned the expected "Proxmint rejected the API key" error from the live API.
• Dify Community Edition and Dify Cloud: not tested end to end (no Docker or Cloud workspace on this machine). The plugin uses only standard tool-provider features: a secret-input credential, string, select and number parameters, and text and JSON messages. Its gateway client is the same code as our published LangChain (langchain-proxmint) and Haystack (proxmint-haystack) packages, which run against the same gateway.

Reviewer notes

A self-hosted Dify behind a firewall needs outbound TCP to gw.proxmint.com:823; the README says so under Connection requirements.

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the submitted package, documentation, and relevant source; this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.