Plugin Manifest
The plugin.json file declares your plugin's permissions, exports, and required config. Surfaced to users at install time so they know what they're consenting to.
Example
{
"name": "telegram-channel",
"version": "1.0.0",
"description": "Telegram bot channel for OpenVesper",
"author": "your name",
"license": "MIT",
"openvesperVersion": ">=1.7.0",
"permissions": ["external", "mutation"],
"exports": {
"tools": ["telegram_send", "telegram_reply"],
"agents": [],
"channels": ["telegram"]
},
"config": {
"TELEGRAM_BOT_TOKEN": {
"required": true,
"type": "string",
"secret": true,
"description": "Bot token from @BotFather"
},
"TELEGRAM_ALLOWED_CHATS": {
"required": false,
"type": "string[]",
"description": "Comma-separated chat IDs to allow"
}
},
"tags": ["channel", "messaging"],
"repository": "https://github.com/openvesper/plugin-telegram"
}Permission categories
| Permission | What it allows |
|---|---|
read | Read-only API calls, file reads |
external | Outbound API calls (general internet) |
mutation | Send messages, post, alter remote state |
filesystem | Write to user's filesystem |
shell | Run shell commands |
Install-time consent
When user runs vesper plugin install <path>, the CLI summarizes the manifest and asks for confirmation:
📦 telegram-channel v1.0.0
Telegram bot channel for OpenVesper
Requested permissions:
- external: make external API calls
- mutation: perform mutating actions
Exports:
Tools: telegram_send, telegram_reply
Channels: telegram
Required config:
- TELEGRAM_BOT_TOKEN (string, secret)
Install this plugin? [y/N]Validating
import { manifestValidator } from "@openvesper/plugin-sdk";
const { valid, errors } = manifestValidator.validate(myManifest);
if (!valid) console.error(errors);