Harden and document the cross-host agent plugin

Author: erickkkyt

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "beatapi-agent-plugin",
   "version": "0.3.0",
-  "description": "Create and manage BeatAPI text, image, video, Effect, workflow, analysis, and realtime APIs from Codex.",
+  "description": "Create and manage BeatAPI text, image, video, Effect, workflow, and analysis APIs from Codex.",
   "author": {
     "name": "BeatAPI",
     "email": "support@beatapi.io",
@@ -26,8 +26,8 @@
   "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "BeatAPI",
-    "shortDescription": "Manage BeatAPI text, media, workflows, and realtime",
-    "longDescription": "Use one existing BeatAPI account and API key from Codex to discover models and Effects, create text responses, upload inputs, check USD balance and concurrency, create image, video, Effect, Video Analysis, Music Video, and Ecommerce Video tasks, manage short-lived Realtime Video sessions, monitor progress, retrieve hosted results, and configure webhooks.",
+    "shortDescription": "Manage BeatAPI text, media, and workflows",
+    "longDescription": "Use one existing BeatAPI account and API key from Codex to discover models and Effects, create text responses, upload explicitly approved inputs, check USD balance and concurrency, create image, video, Effect, Video Analysis, Music Video, and Ecommerce Video tasks, monitor progress, retrieve hosted results, and manage existing Realtime sessions and webhooks.",
     "developerName": "BeatAPI",
     "category": "Creativity",
     "capabilities": [
@@ -38,15 +38,9 @@
     "privacyPolicyURL": "https://beatapi.io/privacy-policy",
     "termsOfServiceURL": "https://beatapi.io/terms-of-service",
     "defaultPrompt": [
-      "Use $beatapi-video to create a music video from my images and audio.",
-      "Use $beatapi-video to turn my product images into a vertical ad.",
-      "Use $beatapi-video to generate an image with Nano Banana Pro.",
-      "Use $beatapi-video to create a Seedance 2.5 video.",
-      "Use $beatapi-video to list current Effects for this portrait.",
-      "Use $beatapi-video to create a 60-second realtime session for my web app.",
-      "Use $beatapi-video to check my USD balance and task status.",
-      "Use $beatapi-video to list BeatAPI text models and summarize this note.",
-      "Use $beatapi-video to analyze this product-demo video."
+      "Use $beatapi-video to turn these product images into a vertical ad.",
+      "Use $beatapi-video to list current models, then generate from this prompt.",
+      "Use $beatapi-video to check my balance and the status of task task_...."
     ],
     "brandColor": "#2563FF",
     "composerIcon": "./assets/icon.png",

.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "beatapi-agent-plugin",
   "version": "0.3.0",
-  "description": "Use BeatAPI text, image, video, Effects, workflows, analysis, and realtime APIs from Cursor and Grok Bot.",
+  "description": "Use BeatAPI text, image, video, Effects, workflows, and analysis APIs from Cursor and Grok Bot.",
   "author": {
     "name": "BeatAPI",
     "email": "support@beatapi.io"
@@ -34,6 +34,16 @@
         "title": "BeatAPI base URL",
         "description": "Optional API base URL override. Keep the default unless BeatAPI support gave you another endpoint.",
         "default": "https://api.beatapi.io"
+      },
+      "BEATAPI_TRUST_CUSTOM_BASE_URL": {
+        "type": "string",
+        "title": "Trust custom API origin",
+        "description": "Leave empty for the official API. Set exactly 1 only when BeatAPI support gave you the custom HTTPS origin above."
+      },
+      "BEATAPI_UPLOAD_ROOTS": {
+        "type": "string",
+        "title": "Approved upload directories",
+        "description": "Optional path-list of directories containing files you explicitly want the plugin to upload. Use colon separators on macOS/Linux and semicolons on Windows."
       }
     },
     "required": [

.github/workflows/ci.yml

@@ -11,14 +11,14 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run verify
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: beatapi-plugin-artifacts
           path: |

.github/workflows/release.yml

@@ -12,14 +12,14 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run verify
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: |
             dist/beatapi-agent-plugin-marketplace.zip

.grok-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "beatapi-agent-plugin",
+  "version": "0.3.0",
+  "description": "Use BeatAPI text, image, video, Effects, workflows, and analysis APIs from Grok Build.",
+  "author": {
+    "name": "BeatAPI",
+    "url": "https://beatapi.io"
+  },
+  "homepage": "https://beatapi.io",
+  "repository": "https://github.com/BeatAPI/beatapi-agent-plugin",
+  "license": "MIT",
+  "keywords": [
+    "beatapi",
+    "beatapi agent toolkit",
+    "beatapi video",
+    "beatapi image",
+    "beatapi workflows"
+  ],
+  "logo": "./assets/logo.png",
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json"
+}

.mcp.json

@@ -9,11 +9,11 @@
       "env_vars": [
         "BEATAPI_API_KEY",
         "BEATAPI_BASE_URL",
+        "BEATAPI_TRUST_CUSTOM_BASE_URL",
         "BEATAPI_CLI_PATH",
-        "BEATAPI_DATA_HOME",
-        "CODEX_HOME"
+        "BEATAPI_UPLOAD_ROOTS"
       ],
-      "tool_timeout_sec": 900
+      "tool_timeout_sec": 4500
     }
   }
 }

CHANGELOG.md

@@ -11,12 +11,17 @@
   generation-model discovery, generic image/video generation, versioned
   Effects, and Video Analysis.
 - Synchronized the canonical Skill, typed client runtime, and OpenAPI snapshot
-  with the complete 29-operation contract and USD-denominated usage semantics.
+  with the complete 30-operation contract and USD-denominated usage semantics.
 - Replaced hardcoded image/video model unions with a stable `model` plus
   `parameters` interface so newly published model IDs do not require a plugin
   release.
 - Added host Configure guidance for `BEATAPI_API_KEY` and kept credentials out
   of tool arguments and model-visible results.
+- Confined uploads to configured trusted roots, rejected credential material in
+  open-ended parameters, validated custom API origins, reduced CLI environment
+  inheritance, and pinned release workflow dependencies.
+- Removed Realtime-session and webhook creation from agent-visible surfaces
+  until hosts provide an opaque secret broker.
 
 ## 0.2.0 - 2026-07-31