[z4o4z]

This adds the metadata that six directories read, so the plugin can be submitted. Nothing is submitted or published here. It is stacked on #12 and cannot merge before it, because the README says the bundled docs connection runs with logging turned off.

Blockers before any submission

1. Icon. There is no official icon file, so this PR sets no icon or logo field. We need a square PNG, 512 to 2048 px, under 2 MB. Anthropic's portal may take the icon only from the first save or submission, so add it before anyone opens the portal. OpenAI and Codex also require logo and composerIcon.
2. A published release. awesome-copilot reviews a release tag and a commit SHA, not a branch.
3. feat: turn off docs MCP logging for package connections #12 and the docs server change it depends on.
4. Docs tools on the account MCP, before the OpenAI submission only. The OpenAI listing attaches mcp.voiceflow.com as its only server, and the server cannot change after the first submission. Today it has no docs tool, so ChatGPT and Codex users from that listing would get no docs MCP. The account server team adds a few read-only vf_docs_* tools that call the docs MCP with logging=off and pass on no user, workspace, or token. Other directories do not wait for this.

Decisions for the reviewer

MCP Registry names. A published name is hard to change.

• Recommended: com.voiceflow/voiceflow for the account server and com.voiceflow/knowledge for the docs server.
• Alternative: com.voiceflow/account and com.voiceflow/docs.
• Trade-off: the recommended names match what the docs call the servers. The alternatives say more plainly what each one is for.

Registry versions. I used 3.0.0 for the account server, to match its v3 tools, and 2.1.2 for the docs server, the version it reports today. Each later publish needs a new version.

Support URL. No Voiceflow support page answers 200: /support and /docs/support return 404. I used this repository's SUPPORT.md, which routes to issues and to support@voiceflow.com. OpenAI requires a support URL for MCP review.

The docs registry entry has no logging=off. People who add the server from the registry are treated like people who add it by hand, so their requests are logged.

What changes

Directory	What it reads	Change
Anthropic	.claude-plugin/plugin.json and a README in the plugin folder	New voiceflow/README.md. Manifest adds displayName, homepage, repository, keywords, documentationUrl, supportUrl, privacyPolicyUrl, termsOfServiceUrl
OpenAI	Root plugin.json, extensions.com.openai. It ignores .codex-plugin/plugin.json when that object exists	Category Developer Tools. Adds websiteURL, supportURL, privacyPolicyURL, termsOfServiceURL, defaultPrompt, capabilities, and onboardingSkill set to voiceflow-setup. The marketplace entry gets category
Codex format	.codex-plugin/plugin.json	Same interface at the root and onboardingSkill under extensions.com.openai
Cursor	.cursor-plugin/plugin.json	Adds homepage, repository, keywords
awesome-copilot	Root plugin.json and the plugin README	Keywords are lowercase and hyphenated
skills.sh	skills.sh.json at the repo root	paths: ["./voiceflow/skills"]
MCP Registry	server.json per server	mcp-registry/voiceflow/ and mcp-registry/knowledge/, not packaged. mcp-publisher was not run

The README says what the plugin runs, sends, and fetches. It covers the CLI download from the official release with pinned checksums, OAuth with workspace read and write access for https://mcp.voiceflow.com/mcp, and the docs MCP, which gets the question plus the version, skill, and stage tag. It links the license, support, privacy policy, and terms.

validate.py now checks that the manifests share links, keywords, category, and onboarding skill. It also checks the OpenAI length limits, that the README has at least 40 words outside code blocks, the skills.sh.json paths, and that the registry entries point at the two server URLs. An icon field passes only when its file exists. The build ships the README, and the standalone skill installer ignores it because it copies only voiceflow/skills.

All URLs returned 200 with curl -sIL on 2026-11-12: https://www.voiceflow.com, /docs, /privacy, /legal/terms (/terms redirects there), /docs/mcp/knowledge, and the repository and SUPPORT.md links.

Sources

• Anthropic: plugin manifest reference, pre-submission checklist, submit a plugin
• OpenAI: build plugins, submission and manifest fields
• Agent Plugins plugin schema, which allows no extra root fields
• Cursor: plugins reference
• awesome-copilot: CONTRIBUTING, external plugins
• skills CLI: creating skills, custom discovery paths, schema
• MCP Registry: remote servers, authentication, server schema 2025-12-11

Not verified

• Anthropic's portal Validate and security scan. They need a portal sign-in.
• The OpenAI dashboard upload checks.
• npx skills add. I did not run third-party npm code; the format comes from the skills CLI docs.
• awesome-copilot intake and vally lint.
• mcp-publisher validate. Publishing also needs DNS or HTTP proof for voiceflow.com.
• Cursor marketplace discovery.

Open questions

• Anthropic asks that a plugin's remote MCP server you run also be submitted as a connector. The docs MCP is bundled. Should we submit it as a connector too?
• capabilities is ["Read", "Write"], as in OpenAI's example. Do we want task labels instead?

Verification

• python3 scripts/validate.py: passed.
• python3 -m unittest discover -s tests -v: 106 tests ran, 105 passed, 1 skipped. New tests cover listing drift, prompt and description limits, a missing icon file, registry URLs, skills.sh.json, and README word counting.
• python3 scripts/build.py: passed. The archive includes voiceflow/README.md.
• claude plugin validate ./voiceflow and claude plugin validate . (Claude Code 2.1.322): passed. The only directory warning is the missing icon.
• python3 scripts/verify_hosts.py: Codex 0.165.0 and Claude Code install the plugin with the new manifests in disposable configs.
• Not run: python3 scripts/scan_secrets.py, because Gitleaks is not installed locally; CI runs it.

🤖 Generated with Claude Code