[External Plugin]: eczid-api-trust

[Ecocitizenz]

Plugin name

eczid-api-trust

Short description

Free agent plugin, MIT-licensed: no purchase, account, sign-in, licence key or trial is required, and nothing it does is withheld pending a purchase. See which API surfaces a workspace exposes, how they are secured and whether they carry public proof: OpenAPI / GraphQL / AsyncAPI contracts, catalogues, auth configuration, disclosure contacts and contract tests, with a deterministic Review Priority. Inspection only. Free.

GitHub repository

Ecocitizenz/eczid-agent-plugins

Plugin path inside the repository

plugins/eczid-api-trust

Ref to review

No response

Commit SHA to review

ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374

Version

0.1.1

License identifier

MIT

Author name

EcoCitizenz Ltd

Author URL

https://developers.ecocitizenz.com

Homepage URL

https://developers.ecocitizenz.com/agent-trust/api-passport/

Keywords

ecz-id
api
openapi
graphql
api-security
review
security

Additional notes for reviewers

PRICING, STATED PLAINLY: this plugin is free and MIT-licensed. It installs and runs in full with no account, sign-in, licence key, trial or paywall, and it sells nothing.

EcoCitizenz separately sells Pro editions of its VS Code extensions and ECZ-ID Passports through TrustOps. Those are different products. This plugin does not sell, unlock, gate or require any of them, and it never runs checkout or grants entitlement. Where a paid route is genuinely the next step for a result, the plugin links to it, clearly labelled optional, below the free capability it has already given.

The README has been corrected at the generator so this cannot be misread: it opens with "Free agent plugin. No purchase required.", every price sits below the doctrine and privacy sections under an explicit "Optional and separate ... a different product" heading, and suggested next actions are split into free routes and clearly-labelled optional paid ones. Tests fail the build if a price appears above the free statement.

Agent Plugins 1.0.0 package: one skill plus a dependency-free Node review script that lists file names and paths only (no file opened, no endpoint called, no network, nothing written), and the read-only ECZ-ID Verifier MCP server (@ecocitizenz/ecz-id-mcp-verifier@0.9.0) for public proof lookups. Never asserts compliance, certification or safety; routes only to documentation and, where relevant, to TrustOps. Same estate and validation as eczid-mcp-verifier (#2919).

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: eczid-api-trust

• Repository: https://github.com/Ecocitizenz/eczid-agent-plugins

• SHA: ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	0 day(s)
Repository activity	repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 0 open issues/PRs
Homepage heuristics	no configured signal

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: not_run
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ api-trust-review (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-PWKMnh/copilot-home/.copilot/installed-plugins/external-plugin-intake/eczid-api-trust/plugin.json.

Version match output

- ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374: matched version "0.1.1" at "plugins/eczid-api-trust/plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "eczid-api-trust",
  "description": "Free agent plugin, MIT-licensed: no purchase, account, sign-in, licence key or trial is required, and nothing it does is withheld pending a purchase. See which API surfaces a workspace exposes, how they are secured and whether they carry public proof: OpenAPI / GraphQL / AsyncAPI contracts, catalogues, auth configuration, disclosure contacts and contract tests, with a deterministic Review Priority. Inspection only. Free.",
  "version": "0.1.1",
  "author": {
    "name": "EcoCitizenz Ltd",
    "url": "https://developers.ecocitizenz.com"
  },
  "repository": "https://github.com/Ecocitizenz/eczid-agent-plugins",
  "homepage": "https://developers.ecocitizenz.com/agent-trust/api-passport/",
  "license": "MIT",
  "keywords": [
    "ecz-id",
    "api",
    "openapi",
    "graphql",
    "api-security",
    "review",
    "security"
  ],
  "source": {
    "source": "github",
    "repo": "Ecocitizenz/eczid-agent-plugins",
    "path": "plugins/eczid-api-trust",
    "sha": "ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374"
  }
}

View workflow run

[aaronpowell]

/reject Sorry, we're not a channel for purely paid services.

[github-actions]

❌ External plugin rejected

A maintainer rejected eczid-api-trust, and the submission issue has been closed.

Reason

Sorry, we're not a channel for purely paid services.

If you address the feedback, edit this issue with the updated details and have the issue author or a maintainer comment /rerun-intake to re-run automated intake.

[Ecocitizenz]

/rerun-intake

Thank you for reviewing, and sorry for the confusion — the wording was ours, not a misreading on your part.

To state it plainly: this Agent Plugin is free. It is MIT-licensed and installs and runs in full with no account, no sign-in, no licence key, no trial and no paywall. Nothing it does is withheld pending a purchase, and the plugin sells nothing and runs no checkout. It is useful on its own: it performs a local, filename-and-path-only review and reports evidence with a deterministic Review Priority — no source upload, no telemetry.

We do sell separate products (Pro editions of our VS Code extensions, and ECZ-ID Passports through TrustOps). Those are different products, and this plugin neither requires nor unlocks them.

The README is what invited the other reading, and it is fixed at the generator rather than by editing text:

• it now opens with "Free agent plugin. No purchase required.", above everything else;
• every price has moved below the doctrine and privacy sections, under an explicit "Optional and separate … a different product" heading;
• suggested next actions are split into free routes and clearly-labelled optional paid ones;
• tests now fail the build if a price appears above the free statement, so this cannot regress.

The issue is updated to the corrected commit ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374. It is submitted as a SHA only so the v0.1.1 tag stays immutable; the plugin version is unchanged at 0.1.1.

Requesting one reconsideration through the documented mechanism. If the answer is still no, that is completely fine and we will not press it further.