Verified plugins

For: tenant administrators and plugin users.

Choose a verified plugin when its tools and agents fit your task. The project publishes these plugins under the ai.oz0 namespace using the same interfaces available to other authors.

The hub reserves their names: tool IDs start with oz0_ and agent names with oz0-. Other publishers cannot use those prefixes.

Their agents ask for the tenant's standard model aliases (default, fast, smart) with what they need, never a vendor's model, so each runs on whichever provider a tenant set up: an OpenAI-only or Mistral-only tenant runs them as an Anthropic one does. A verified agent names a vendor's model only with model.vendor_reason, the vendor's own feature it needs.

Essentials (ai.oz0/essentials) is a verified set: github, email, atlassian, servicenow, web, memory, pr-reviewer, merge-when-green and support-triage, at versions chosen to run together, installed as one decision.

Slack and Discord (ai.oz0/slack, ai.oz0/discord) are verified too: see chat channels. Microsoft Teams (ai.oz0/teams) is verified too: see Microsoft Teams. Outside A2A agents run on ai.oz0/a2a-remote, which has no tool or agent of its own, with the presets ai.oz0/a2a-agentcore and ai.oz0/a2a-foundry (agents oz0-agentcore and oz0-foundry): see ai.oz0/a2a-remote.

ai.oz0/sandbox-e2b is not on this list because it is not a plugin a tenant installs: it is the backend a node's operator runs for remote sandboxes on E2B-compatible services.

What verified means

"Verified" means the project tested, pinned and secured the plugin, never that a system's vendor endorses it. Every verified plugin keeps the house rules of How to structure plugins, which the project's tests check with oz0 plugin lint --verified (every rule an error), and holds to these, which its tests check too:

• Every function says what it does. Each carries readOnlyHint, destructiveHint and openWorldHint, so your tool policy can retry, approve or refuse it by kind, and a shadow run knows what it may call.
• Every agent has a contract: its input and output, as text or a JSON Schema (contracts).

Every plugin has evals that replay without a model

The evals use recorded model answers or flow steps, so CI runs them offline; oz0 plugin test plugins/<name> runs them. Their expectations are what each prompt makes a model write, not a tool's JSON, and their cases need nothing a tenant must set or allow, so the quality gate of a first install runs them with your models and passes on a fresh tenant. make starter-results MODEL=<provider>/<model> runs the four starters' cases live on a model, with harder ones (evals/measured/) that no gate runs, and records the pass rate, tokens and cost (measured results).

• What reaches hosts stays inside the egress allowlist. A function that reaches hosts for a model (a fetch, a probe, an advisory lookup) checks each target against the tenant's list and its plugin's own, on every node, not only in the sandbox; it connects to the address it checked and never to the node itself, its link or a metadata service by name. A refusal names the host and the command that allows it.
• Settings are settings, keys are secrets. Addresses, backends and switches are tenant settings (requires.settings), shown and never scanned for as secrets; an API key a backend may need is an optional secret (requires.optional_secrets). Both carry the plugin's prefix (WEB_, CVE_TRIAGE_): a verified plugin installs and starts with none set, says which to set when a function needs one, and never reads another plugin's this way. Installs and listings name them (Secrets).
• Untrusted code runs only in sandbox tier 1. pr-reviewer runs a pull request's tests in a sandbox of their own, with no secret and no network but the tenant's allowlist, and refuses on a node without one. It holds no token either: it downloads the code through ai.oz0/github, so a webhook's review runs its tests too.

Verified; model changed by the tenant

A tenant may send a verified plugin's agents to other models with a mapping rule. The plugin stays verified: the rule lives outside it, so its signature, its pins and its updates are untouched. Its evals ran on its author's model, so the plugin's page, oz0 plugin show and its agents' capability cards say verified; model changed by the tenant, and offer its evals on the new model and a paired comparison of the old and the new one.

Install one

oz0 plugin install hub:ai.oz0/net-diag

The hub is not public yet; until it is, install from a checkout of the repository: oz0 plugin install plugins/net-diag. Each page below says what to set and allow first. Most verified plugins name hosts in their egress, so their install waits as a change request until a tenant admin approves it (oz0 change approve), or installs at once with --approve-egress when you may approve: see Reviewed changes.