[Chkhikvadze]

Plugin Submission

Plugin information

• Author: desearch
• Plugin name: desearch
• Version: 0.0.1
• Source repository: https://github.com/Desearch-ai/dify-plugin-desearch
• Contact: support@desearch.ai

Submission type

• New plugin
• Version update

What changed

New tool plugin. Adds Web Search, AI Search and X Search tools that call the Desearch API with the user's own API key.

Why it is needed: there is no Desearch plugin on the Dify Marketplace today. This plugin lets Dify workflows, chatflows and agents use Desearch web search, AI search (web, Reddit and Hacker News sources) and X post search with a single credential.

Pick one source per call: reddit, hackernews, wikipedia and arxiv each limit the whole search to that site.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Sends user queries to the Desearch API (api.desearch.ai) over HTTPS, fixed endpoints only. No command execution, file operations, browser automation or arbitrary URL fetching. The API key is stored as a Dify secret credential, sent only in the Authorization header, and not logged or included in error messages. Privacy policy: PRIVACY.md.

Local validation

• dify plugin package ./desearch (dify-plugin CLI v0.6.11): packaged successfully.
• Package: desearch/desearch/desearch-0.0.1.difypkg, sha256 e8cc89c1302fd78a9776db2c63eb01ca1feaaed01a5676dfbceceba63966f781.
• validate-difypkg.py desearch-0.0.1.difypkg (dify-marketplace-toolkit 57a21d1, re-run 2026-10-26): 0 blocking failures, 0 environment failures, 4 warning categories (tiktoken pattern match is a false positive; meta.minimum_dify_version unset; console.desearch.ai link in an error message; dependency scan reports no known vulnerabilities in 38 pinned dependencies).
• Dependency update: certifi bumped from 2026.7.22 to 2026.10.19 in requirements.txt and uv.lock (GHSA-6q48-6c7w-9gw2 flagged by the validator).
• Installed the package on self-hosted Dify Community Edition 1.17.1 (docker compose, plugin daemon 0.6.10-local). Credential validation (free key check, no search) rejects an invalid key (HTTP 403 from the API) and accepts a valid key.
• Ran a draft workflow (Start, Web Search, AI Search, X Search, End) on 2026-10-23 and again on 2026-10-26. All three tool nodes succeeded with live results both times.

Reviewer notes

Tested on Dify Community Edition 1.17.1 only (self-hosted, docker compose). Not tested on Dify Cloud (no Cloud workspace used for this submission). Credential validation calls GET https://api.desearch.ai/web without a query: a valid key returns HTTP 422 (parameter validation, no search runs, not billed), an invalid key returns HTTP 403 and a missing key HTTP 401. meta.minimum_dify_version is left unset.

[crazywoola]

Hi @Chkhikvadze, thank you for your contribution! Is this PR ready for maintainer review? If so, please mark it as Ready for review. If you are still working on it, could you share what remains and whether you need any help from us? Thank you!

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the submitted package, documentation and relevant source: this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.