Plugins And Marketplace

Capabilities, not a free-for-all

Plugins are how Ambient grows beyond its built-in tools — and how supply-chain risk usually enters an agent. So Ambient makes the trade-off explicit: every capability has a known class, the permissions it runs under are visible, and you can inspect, validate, repair, and remove it. The Plugin Manager is where that state lives.

The install classes

What you can add falls into a few classes, ordered roughly by how much trust they require. Knowing the class tells you how it is contained.

Build your own capability

When the catalog does not cover a narrow, repeatable job, the Capability Builder turns it into a first-class capability instead of a brittle prompt. You describe the provider, its locality (local, network, or either), expected outputs, and any secrets, and Ambient generates an installer-friendly descriptor.

• Generated capabilities expose their command contract, dependency approvals, and secret requests up front.
• They can be previewed, validated, repaired, updated, re-registered, and removed from the Plugin Manager.
• They run under the same MCP permission policy as any other capability — no special trust because you built it.

Worked example: a Hacker News digest

Suppose you want a quick, repeatable way to see the front page of Hacker News without re-typing the request each time. Turn it into a capability once, then call it whenever you like.

1. Describe it in Plugin Setup

   Open Plugin Setup, choose Create capability, and describe the job in plain language:

   Create a skill that captures the top stories on Hacker News
   and prints them for the user.

2. Set the contract

   Mark it as a network capability (it reads a public site), declare the output — a ranked list of titles, points, and links — and confirm it needs no secrets. Ambient turns that into an installer-friendly descriptor.

3. Review the generated descriptor

   Before anything runs, the descriptor shows its command contract, any dependency approvals, and that it requests no credentials. Reading a public page still passes through the same permission and isolation boundaries as any other capability — see Browser & Scraping Safety.

4. Validate once

   Run it a single time to confirm the output shape. You should get the current top stories with their titles, scores, and links — proof it works before you depend on it.

5. Invoke it anytime

   From then on, call it like any reviewed tool — for example, "Run my Hacker News digest" — and it prints the current front page. Update, re-register, or remove it from the Plugin Manager whenever you want.

Where the marketplace is headed

Today the experience is a curated catalog plus your own local additions. The roadmap is a hosted storefront for reviewed Web2 and Web3 capabilities built on Ambient — with signing, checksums, and provenance policy so that breadth arrives without giving up the trust posture. That hosted marketplace is direction, not a shipped surface, and is labeled accordingly.

FAQ