Plugin SDK · build for QuoxCORE

Quox Plugin SDK.

Build, test and distribute third-party plugins for QuoxCORE. Three packages. One command to start. Ship a .quoxplugin in minutes.

Read the docs Build and sell$ npx create-quox-plugin my-plugin

Packages 3Permissions 9Signing Ed25519Licence MIT

In plain words

What it is, where it lives, when to reach for it

What is it: A software development kit for building plugins that install into the QuoxCORE dashboard.
Where do I use it: On your own development machine, in any Node.js project, with your usual editor.
When would I use it: When QuoxCORE needs a view or capability it does not ship with, and you can build it.
How do I use it: Run npx create-quox-plugin my-plugin, build the .quoxplugin file, then upload it in the dashboard's plugin settings.

QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE

How it works

Four steps from idea to installed plugin.

Scaffold, build, package, install. No manual wiring required.

ScaffoldRun npx create-quox-plugin to generate a ready-to-code project with manifest, entry point and dev server.

BuildWrite standard React components. The Vite plugin externalises shared deps and handles bundling.

Packagenpm run build produces a .quoxplugin ZIP with your bundle, manifest, styles and optional signature.

InstallUpload to QuoxCORE via Settings, then Plugins, then Community plugins. Routes and sidebar register automatically.

What you can build

Extend QuoxCORE in six directions.

Plugins can add UI, backend logic, agent capabilities and event integrations.

Sidebar views

Add new navigation items and full-page views to the QuoxCORE dashboard. Routes are namespaced under /plugins/ automatically.

sidebar

Backend services

Ship a Docker container alongside your plugin. Requests from your frontend are proxied through the collector with resource limits enforced.

network

Agent tools

Register new tools that AI agents can call through MCP. Your tool appears in the tool library and respects RBAC permissions.

tools

Memory integrations

Read and write to the QuoxCORE memory system. Save observations, search context and track entities across sessions.

memory

Notifications

Show toast notifications to users from plugin actions. Success, warning, error and info variants are all supported.

notifications

AEE events

Emit Agent Envelope Exchange events from your plugin. Other plugins and agents can subscribe and react to your events.

aee

Three packages

Everything you need, nothing you do not.

Each package has a single responsibility. Use them together or individually.

create-quox-plugin

Scaffolder

Interactive project generator. Asks for display name, category and whether to include a backend service, then outputs a ready-to-run project.

npx create-quox-plugin my-plugin

quox-plugin-sdk

Runtime and types

TypeScript types for the manifest format, the usePluginApi() hook for storage, notifications, memory and AEE access, plus testing utilities with mock API helpers.

import { usePluginApi } from 'quox-plugin-sdk'

quox-plugin-vite

Build tooling

Vite plugin that externalises React, ReactDOM and React Router via window.__quoxSharedDeps, then packages your output as a .quoxplugin ZIP.

import quoxPlugin from 'quox-plugin-vite'

The monorepo also ships eslint-plugin-quox-plugin, lint rules for plugin authors that catch localStorage-as-primary-store mistakes at build time. Optional, and worth having.

Architecture

The .quoxplugin format.

A .quoxplugin file is a ZIP archive containing your compiled bundle, manifest, optional styles, assets and signature. QuoxCORE extracts it, validates the manifest, and registers routes and sidebar entries automatically.

manifest.json: plugin metadata, permissions, sidebar config
plugin.esm.js: compiled ESM bundle, React externalised
plugin.css: optional scoped styles
assets/: optional static files
signature.json: optional Ed25519 signature for verified distribution

my-plugin.quoxplugin (ZIP)

my-plugin.quoxplugin/
├── manifest.json
├── plugin.esm.js
├── plugin.css
├── assets/
│   └── icon.svg
└── signature.json

Shared dependencies

// QuoxCORE provides these globally:
window.__quoxSharedDeps = {
  React,
  ReactDOM,
  ReactRouter
};

// Your plugin imports work normally.
// The Vite plugin rewrites them
// at build time.

Where your plugin fits

Four kinds of add-on, clearly labelled.

Quox has four kinds of add-on, and no one should have to guess which is which. Plugins you build with this SDK list in the marketplace as Community plugins, credited to you.

Core

bundled · always on

Ships inside every QuoxCORE install. Always present, no purchase, and it cannot be removed. QuoxCORE itself is the platform runtime these run on, not a plugin.

e.g. QuoxMemory, governance

Installable

marketplace · free or licence key

Added from the marketplace when you want it. Some are free, some unlock with a licence key. Non-core, toggle on and off.

e.g. Wazuh SIEM, Prometheus, GitHub

Quox-installable

install · a real deploy

Quox-made, but a genuine install: a daemon, service or desktop app you set up, not a one-click key unlock.

e.g. QuoxAgent, QuoxBastion, QuoxTerminal

built with this SDK

Community

marketplace · third-party

Built by an outside developer, listed in the marketplace, and credited to its author. Reviewed before it lists.

open for developers to publish

Sell what you build. Community plugins can be listed free or sold through the storefront. The developer programme handles listing, licensing and payout. Build and sell

Security

Signed, scoped and sandboxed.

Plugins run in a controlled environment with explicit permissions.

Ed25519 signing

Sign your plugin with an Ed25519 key pair. Signed plugins display a Signed badge in the QuoxCORE plugin manager. Unsigned plugins show a warning to the admin before installation proceeds.

Generate a key pair with the included script
Sign your .quoxplugin before distribution
QuoxCORE verifies the signature on install
Tampered packages are rejected automatically

Permission model and sandbox

Each plugin declares the permissions it needs in its manifest. QuoxCORE enforces these at runtime: a plugin without the memory permission cannot call api.memory methods.

Nine granular permissions, declared in the manifest
A React ErrorBoundary wraps every plugin: render errors are caught
eval, dynamic imports and prototype manipulation are blocked during validation
Storage is namespaced: plugins cannot access other plugins' data
Network requests go through the collector, where the network permission is checked and the call is recorded. That is the governed path, not a browser sandbox: plugin code shares the dashboard runtime, so install code you have reviewed

sidebar

Add items to the sidebar navigation.

storage

Store configuration data in browser storage.

durable

Read and write server-side, org or user scoped key-value storage that survives a cleared browser.

secrets

Read and write the encrypted secrets vault.

network

Make API requests through the plugin backend gateway.

memory

Read and write to the QuoxCORE memory system.

notifications

Show toast notifications.

aee

Emit Agent Envelope Exchange events.

tools

Plugin API

One hook, full platform access.

Plugins access QuoxCORE features through a scoped API provided via React context. The usePluginApi() hook gives you namespaced storage, notifications, memory access, backend fetch and AEE event emission.

Every API method is permission-gated. If your manifest does not declare the notifications permission, calling api.notify() throws a clear error at runtime.

Scoped storage: namespaced to your plugin ID
Backend fetch: proxied through the collector
Memory: save observations and search context
AEE: emit events other agents can react to

usePluginApi()

import { usePluginApi } from 'quox-plugin-sdk';

function MyComponent() {
  const api = usePluginApi();

  async function runScan() {
    // Scoped storage
    api.storage.set('lastRun', Date.now());

    // Backend fetch (proxied)
    const res = await api.fetch('/api/status');

    // Memory
    await api.memory.save({
      type: 'observation',
      content: 'Found 3 new hosts',
      tags: ['network'],
    });

    // AEE events
    await api.aee.emit(
      'plugin.scan.complete',
      { hostsFound: 3 }
    );

    // Notifications
    api.notify('Scan complete', 'success');
  }
}

Where it stands

What's proven, what's still beta.

The SDK itself is open source and on GitHub; this covers what the platform side, signing, permissions and licensing, actually enforces today.

Live and proven

All nine permissions, including durable storage and the secrets vault, are enforced at runtime by permissionGate() in the plugin API, not just declared in the manifest
Ed25519 signing is real: generate-signing-key.js and sign-plugin.js exist, and the installer shows a Signed or Unsigned badge from actual signature verification, not a static label
A plugin review gate exists server-side for marketplace listings, with its own test coverage

Beta and partial

Licence gates on the paths a plugin is actually served through, proxyToPlugin, the bundle and CSS routes, QuoxChat, are code-complete and test-green but not yet verified against a running container per the licensing status doc

Known gaps

The SDK monorepo itself is v0.1.0, active development: expect its API surface to still move
Third-party, customer-uploaded .quoxplugin files are deliberately not licence-gated by design, which is correct for a customer’s own code but is worth knowing plainly, not assuming

Get started

One command to a running plugin.

Scaffold a new plugin, install dependencies and start the dev server. Then build and sign.

Create a new plugin

# Scaffold a new plugin project
npx create-quox-plugin my-plugin

# Install dependencies
cd my-plugin
npm install

# Start the dev server
npm run dev

Build and sign

# Build the .quoxplugin package
npm run build

# Generate a signing key (once)
node scripts/generate-signing-key.js

# Sign the plugin
node scripts/sign-plugin.js \
  --plugin ./my-plugin.quoxplugin \
  --key ./quox-signing.key

Then upload in QuoxCORE under Settings, Plugins, Community plugins. The SDK is open source under the MIT licence: github.com/quoxai/quox-plugin-sdk

packages3permissions9signingEd25519format.quoxpluginlicenceMIT

Start building

Your plugin, on every QuoxCORE.

The SDK is open source and on GitHub. Read the docs, scaffold your first plugin and ship it to the community.

Read the docs Build and sell

Go deeper