[krumjahn]

What changes

Adds plugins/krumjahn/vividsites-cinematic: a skill for discovering cinematic landing-page designs, comparing real previews, retrieving the selected build prompt, and using editable UI components in the user's existing project.

Ships portable and Claude-compatible manifests, identical skill copies for the two discovery layouts, an endpoint configuration example, MIT license, setup/data/pricing disclosures, and detailed validation evidence. No proprietary catalog assets are bundled.

User value

Use VividSites to build a cinematic landing page for a boutique architecture studio. Keep this project's framework, compare three dark editorial designs, choose the closest fit, and implement it with a clear consultation CTA and reduced-motion support. Use existing library assets; do not deploy it.

Expected result: actual template candidates and preview links, a selected design, and local project changes based on the retrieved prompt, followed by available responsive/accessibility checks. A browse-only request stops after the shortlist.

All six VividSites tools require a paid library account and personal API key. MiniMax subscription access and VividSites Create credits do not include library access. Premium prompt retrieval can consume the existing daily allowance. The plugin does not build through VividSites Create, purchase, generate media, or deploy.

Connection and compatibility

The existing public Streamable HTTP endpoint is https://www.vividsites.app/api/connector. As with the community TickTick plugin, users configure it in MiniMax's global MCP settings and privately supply the Authorization header. The portable plugin contract has no per-user secret reference; a credential-free root MCP declaration would fail with 401. The included configs/mcp.example.json is documentation, not an automatically loaded anonymous connection. No proxy or credential bridge is introduced.

Read the current contribution, architecture, compatibility, and v0.4 manifest docs. Also inspected the published 0.7.4 loader: its Claude-compatible skill reader resolves ./skills from the plugin root. This accommodates the docs' conflicting manifest/file-path examples. Actual MiniMax installation and authenticated execution remain unverified.

Dependencies, platforms, network, and data

• No plugin-specific executable, dependency, hook, installer, native binary, or background process. Normal MiniMax runtime/provider access and project build tools are needed and may have separate charges.
• Text/configuration targets macOS, Linux, and Windows; local checks were on macOS.
• MCP sends Authorization, protocol metadata, short style queries, slugs, and tool arguments to VividSites. The skill does not request source files, customer records, or the full conversation.
• Previews and media may contact returned CDN/storage/live-preview origins. Existing server usage/account/quota logging and service policies are disclosed.
• Fixed MiniMax UTM labels appear only on VividSites informational links. No tags on MCP requests, returned assets, user CTAs, or generated websites; no new backend or telemetry code.
• Original contribution is MIT; fetched assets retain their own terms and trademarks.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name>.
• plugin.json name matches the Plugin directory.
• README includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license.
• Required executables, accounts, paid services, and supported platforms are disclosed.
• Network destinations and data handled by the plugin are disclosed.
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are included.
• Every scaffold TODO has been replaced.
• npm run check passes.

Evidence

• Base: 01c44b6828085f8000bd40926170c18af7b0bb10.
• npm run check: 30 hosted plugins and all examples validated; 1,121 tests, 1,120 passed, 0 failed, 1 Linux-only test skipped on macOS (Node 24.21.0, Python 3.14, Pillow 12.3.0). The initial sandbox run blocked existing loopback-server tests; the complete rerun with loopback access passed.
• Skill-creator validation: Skill is valid!; JSON parses; skill copies byte-identical; no symlinks; git diff --check passes.
• Existing VividSites live verifier: anonymous initialization, discovery, and all six tool calls rejected with HTTP 401; invalid-key discovery rejected with HTTP 401 (nine denial checks).
• Live unpaid- and paid-account checks explicitly skipped because no keys were supplied. Tool names and behavior checked against connector commit bee5559327a17aeab297486918dcb05b753a3b87; no successful live library retrieval is claimed.
• Manual instruction review covered browse-only, build, missing-key, tracking, and asset-license paths. This was not an independent model run or rendered-site test. See VALIDATION.md for details.

Draft pending authenticated MiniMax installation/execution evidence. No new credentials, paid purchases, production changes, or acceptance claims.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[hetaoBackend]

Request changes for exact current head eaf9c72.\n\nThe package is structurally valid locally (repository validator accepts the new plugin; manifest skill paths and duplicate Skill copies are consistent), and the Skill preserves the private API-key setup and premium-request cautions. However, exact-head GitHub checks are not green: both CI and CodeQL check suites/workflow runs completed with conclusion action_required, with no completed successful repository-owned checks. Local validation cannot substitute for those current-head checks.\n\nPlease authorize/re-run CI and CodeQL for this exact SHA and provide completed successful results before requesting approval again. Authenticated MiniMax host execution and paid VividSites retrieval are explicitly unverified in VALIDATION.md and must remain described as unverified; no paid request or deployment should be triggered by validation.

[hetaoBackend]

Readable follow-up to review 5761766325 for exact current head eaf9c72.

The local repository validator accepts the plugin and the manifest skill paths/duplicate Skill copies are consistent. The Skill keeps the API key in private host settings and warns about premium usage. However, both exact-head GitHub suites, CI and CodeQL, completed with action_required; there are no completed successful repository-owned checks. Local validation cannot replace exact-head CI/CodeQL evidence.

Please authorize or re-run CI and CodeQL for this SHA and provide completed successful results before requesting approval again. Authenticated MiniMax host execution and paid VividSites retrieval remain unverified per VALIDATION.md; do not trigger paid requests or deployment as part of validation.