[sam1siam]

Plugin Submission

Plugin information

• Author: fokals
• Plugin name: fokals
• Version: 0.0.1
• Source repository: https://github.com/fokals/dify-plugin
• Contact: partners@fokals.com

Submission type

• New plugin
• Version update

What changed

A new tool plugin that brings Fokals company intelligence to Dify agents and workflows. It has 28 tools:

• find, count and enrich companies by the technologies they run, buying intent, hiring, announcements, funding, industry and country
• company profiles, recent changes, lookalikes and competitors, connections (customers, partners, integrations, investors), health and likely next technologies
• open job postings, sales teams and advertised sales pay
• intent, headcount, website traffic and funding history for a company
• feeds of buying signals, announcements and website changes across all companies
• market breakdowns, market trends and the day's market movers

Each tool returns its answer as text and as JSON (message and data). Setup is one credential, a Fokals key made on the user's account page.

Risk level

• Low risk
• Medium risk
• High risk

Medium because the tools send user supplied inputs (company names, website addresses and filters) to an outside API.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Testing limitation: the plugin has not yet been installed on Dify Community Edition or Dify Cloud. It was tested with dify_plugin 0.10.2, the version it pins: the provider and all 28 tools are loaded the way the plugin runtime loads them, every tool is invoked against recorded API answers, and the key check was run against the live API. We will install it on Dify Cloud as soon as it is listed and fix anything found in a version update.

Security and privacy notes

• Network access: every tool sends HTTPS requests to one fixed host, api.fokals.com, declared in manifest.yaml under network.domains. There is no arbitrary URL fetching or proxying. Website addresses the user gives are sent to the API as lookup values and are never fetched by the plugin.
• Credential: one secret-input field, the user's Fokals key. It is sent only to api.fokals.com, as a bearer token. The plugin does not log or store it.
• Data sent: the company names, website addresses, filters and dates passed to a tool. Answers hold company data only, never personal data.
• Usage limit: paid tools draw on the user's prepaid Fokals balance at the published prices. A call that would cost more than the user's own limit does not run and returns its price instead, so the agent asks the user first.
• No command or code execution, SQL, SSH or SFTP, file operations or browser automation.
• Privacy policy: PRIVACY.md in the package (referenced by manifest.yaml) and https://www.fokals.com/privacy.

Local validation

Packaged with the Dify plugin CLI 0.6.12 and checked with the Marketplace toolkit validator:

dify plugin package ./fokals -o fokals-0.0.1.difypkg
python3 dify-marketplace-toolkit/validator/validate-difypkg.py fokals-0.0.1.difypkg --output-dir validation-report

Result: 0 blocking failures. All blocking checks pass, including package contents, secrets, binaries, manifest, README, dependencies and Python compile. The two warnings are informational: access_domains finds only api.fokals.com, and dependency_vulnerabilities finds no known vulnerabilities in the two pinned dependencies (dify_plugin==0.10.2, requests==2.34.2).

The same packaging and validation run on every push in the source repository: https://github.com/fokals/dify-plugin/actions/workflows/package.yml

Reviewer notes

The tools are generated from the public Fokals API description (https://api.fokals.com/v1/openapi.json), and a weekly job in the source repository checks they still match it.

🤖 Generated with Claude Code

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the submitted package, documentation and relevant source: this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.