Add Sofya plugin (search, fetch, extract, research) 0.1.0

[yusufgurdogan]

Plugin Submission

Plugin information

• Author: sofya
• Plugin name: sofya (Sofya)
• Version: 0.1.0
• Source repository: https://github.com/yusufgurdogan/dify-plugin-sofya
• Contact: support@sofya.co

Submission type

• New plugin
• Version update

What changed

I build Sofya. This adds a tool plugin for the Sofya API (https://sofya.co) with four tools:

• Sofya Search: web search where each result carries the page content, not only a snippet.
• Sofya Fetch: up to 10 URLs returned as clean markdown, including PDF and DOCX.
• Sofya Extract: reads one page and returns what the prompt asks for.
• Sofya Research: splits a question into sub queries, reads many sources, returns a cited report.

Each tool sends one JSON POST to https://sofya.co and returns the response as a JSON message plus a readable text message. One required credential, sofya_api_key, sent as a Bearer header. No retries, caching or telemetry.

Risk level

• Low risk
• Medium risk
• High risk

The plugin connects to one fixed HTTPS API and nothing else. sofya_fetch and sofya_extract take a user supplied URL as a parameter to that API, which fetches the page server side; the plugin never opens a connection to a user controlled host. That is Medium, not High.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

User provided URL fetching in sofya_fetch and sofya_extract, passed as a JSON field to the Sofya API. The API host is a constant in the code, not a tool parameter. Every request has a timeout, fetch is capped at 10 URLs, and anything shaped like an API key is masked in error messages.

Data sent to Sofya: the query, the URLs, the extraction prompt and the API key. The plugin stores nothing, logs nothing and contacts no other host. See PRIVACY.md.

Local validation

• Dify Plugin CLI 0.6.10 packaged the plugin: 19 runtime files, about 15 KB, no tests or development files inside.
• pytest -q: 54 passed (mocked HTTP for every tool, API errors, missing key, and a check that every YAML parameter matches the Python).
• ruff check .: passed.
• All dify-marketplace-toolkit validators pass with 0 blocking failures. Remaining warnings are informational: the outbound domain is sofya.co, declared in manifest.yaml; the one requests.post call site is disclosed above.
• test-plugin-install.py with INSTALL_METHOD=serverless: the plugin started under the SDK runner and reported success.
• Every tool was run against the live Sofya API with a real key: credential validation, search at both depths, fetch, extract and research all returned the expected JSON and text messages.

Reviewer notes

Not yet installed into a Dify Community Edition or Cloud instance, so that box is left unticked. Everything else above was run here.