mewbo-apps-builder

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Security

Grade A, and why

mewbo-apps-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

apps/mewbo_api/src/mewbo_api/apps/plugin/.claude-plugin/plugin.json · 31 lines

What it actually says

{
  "name": "mewbo-apps-builder",
  "display_name": "App Builder",
  "description": "app-builder + app-repair agents and the submit_app / app_data session tools for the Mewbo Apps sub-product.",
  "version": "0.1.0",
  "author": "Mewbo",
  "requires-capabilities": ["apps"],
  "session_tools": [
    {
      "tool_id": "submit_app",
      "module": "mewbo_api.apps.plugin.submit_app",
      "class": "SubmitAppTool"
    },
    {
      "tool_id": "app_data",
      "module": "mewbo_api.apps.plugin.app_data",
      "class": "AppDataTool"
    },
    {
      "tool_id": "run_pipeline",
      "module": "mewbo_api.apps.plugin.run_pipeline",
      "class": "RunPipelineTool"
    },
    {
      "tool_id": "get_app",
      "module": "mewbo_api.apps.plugin.get_app",
      "class": "GetAppTool"
    }
  ]
}

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

Related

Other plugins, from other repositories