[khmuhtadin]

What changes

Adds two hosted Plugins, each with an MCP server definition and a Skill:

• plugins/khmuhtadin/1toolring — 1ToolRing: pay-per-call access to thousands of tools from third-party providers (web search, maps and places, shopping and prices, market data, web pages, images, weather, jobs) through one prepaid key.
• plugins/khmuhtadin/api-indonesia — API Indonesia: official Indonesian public data (regions down to villages and postal codes, boundaries, holidays, prayer times, schools, hospitals, earthquakes, weather, exchange rates, minimum wage, QRIS parsing and more).

User value

After installing either Plugin, a MiniMax Code user can reach a live data source without writing an integration. Examples:

• 1ToolRing: "Find a supplier price for a Raspberry Pi 5 and show the cheapest three options." → the Skill runs discover_tools, shows the price from inspect_tool, then run_tool, and answers with the three cheapest listings.
• API Indonesia: "Which villages are in Kecamatan Pontianak Kota, with postal codes?" → the Skill picks the region tool, returns the village list with codes and postal codes.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name> (plugins/khmuhtadin/1toolring, plugins/khmuhtadin/api-indonesia).
• plugin.json name matches the Plugin directory.
• README.md includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license (MIT).
• Required executables, accounts, paid services, and supported platforms are disclosed: both Plugins call a hosted remote MCP server and need an account for an API key; 1ToolRing is paid per call from a prepaid balance (price shown before each call), API Indonesia gives free credits on sign-up and charges 2 credits per successful request. No local executables, no platform-specific dependencies.
• Network destinations and data handled by the plugin are disclosed: https://mcp.1toolring.com/mcp and https://mcp.apiindonesia.id/mcp, HTTPS only, and only the tool arguments are sent.
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are included. mcp.json ships a placeholder header value.
• Every scaffold TODO has been replaced.
• npm run check passes.

Evidence

Local run of the repository validator on this branch:

$ node scripts/validate.mjs
OK   plugin khmuhtadin/1toolring
OK   plugin khmuhtadin/api-indonesia
Validated 32 hosted Plugins and all examples.

No secrets appear in the diff. The two services are operated by the submitter (Khaisa Studio), so the endpoints are stable and the submitter is the owner of the Plugins being listed.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[hetaoBackend]

Request changes for exact current head f064739.\n\nBlocking findings:\n\n1. The packaged MCP authentication is not a working portable configuration. Both plugins/khmuhtadin/1toolring/mcp.json:8 and plugins/khmuhtadin/api-indonesia/mcp.json:8 hard-code Authorization: Bearer YOUR_API_KEY. The repository contract explicitly says not to embed tokens in headers and that generic OAuth is not part of the portable subset (docs/plugin-compatibility.md:66-68). The upstream public configs use a supported credential reference or omit the header for OAuth; the two exact endpoints returned 401 to anonymous requests requiring OAuth or a real API key. As submitted, the installed MCP entries send a literal fake credential and the advertised live-data examples cannot authenticate. Replace this with a host-supported auth/configuration path and do not ship a placeholder Authorization header.\n\n2. Billable calls lack an immediate user-confirmation gate. plugins/khmuhtadin/1toolring/skills/1toolring-tools/SKILL.md:21-22 says to inspect and state the price only when a run is not trivial, but does not require explicit confirmation before run_tool. plugins/khmuhtadin/api-indonesia/skills/api-indonesia-data/SKILL.md:16-20 states that successful requests cost 2 credits but also has no confirmation step. Both skills can therefore spend prepaid balance/credits without an informed confirmation immediately before the paid call. Require the exact price or credit cost, target, and user confirmation immediately before every billable invocation; failed-call semantics do not remove this gate.\n\n3. Sensitive-data and downstream-egress boundaries are incomplete. API Indonesia advertises NIK, NPWP and QRIS operations (api-indonesia-data/SKILL.md:10-12), but the README only says that tool arguments are sent to the endpoint (README.md:28-32) and does not prohibit sending real personal or financial identifiers or require confirmation/minimization. 1ToolRing forwards arguments to third-party providers, but the Plugin does not disclose per-tool downstream recipients, logging, retention, training behavior or prevent sensitive URLs/content from being sent. Add an explicit trust and egress boundary and safe handling rules before enabling these flows.\n\n4. The contribution violates the one-hosted-folder/one-PR governance boundary. This PR adds two independent hosted Plugins, plugins/khmuhtadin/1toolring and plugins/khmuhtadin/api-indonesia, while CONTRIBUTING.md:3 and GOVERNANCE.md:11 require one hosted folder per pull request. Split them so each Plugin can be independently validated, reviewed and reverted.\n\n5. There is no completed repository-owned exact-head test evidence. This SHA has zero check-runs; its two GitHub Actions check suites are completed with action_required. The local validator passing 32 hosted Plugins and [code]smith = SKIPPED cannot substitute for exact-head repository Checks.\n\nDo not approve or merge until the authentication contract, billing confirmation, data-egress boundary, contribution split, and exact-head Checks are fixed.

[hetaoBackend]

Readable follow-up to review 5852107854 for exact current head f064739.

The previous review state and commit binding are correct, but this readable copy preserves the blockers with real newlines:

1. Both mcp.json files hard-code Authorization: Bearer YOUR_API_KEY at line 8. This violates docs/plugin-compatibility.md:66-68, which prohibits embedding tokens in headers and says generic OAuth is not in the portable subset. The two exact endpoints returned 401 without OAuth or a real key. Replace the placeholder with a host-supported auth/configuration path; do not ship a fake Authorization header.

2. Billable calls lack an immediate confirmation gate. 1toolring-tools/SKILL.md:21-22 only says to state price when a run is not trivial, and api-indonesia-data/SKILL.md:16-20 only states the 2-credit cost. Require the exact cost, target and explicit user confirmation immediately before every billable invocation.

3. Sensitive-data and downstream-egress boundaries are incomplete. API Indonesia advertises NIK, NPWP and QRIS operations without rules preventing real identifiers or requiring minimization/confirmation. 1ToolRing forwards arguments to third-party providers without per-tool downstream recipients, logging, retention, training or sensitive-URL handling disclosures. Add the trust and egress boundary before enabling these flows.

4. This PR adds two independent hosted Plugins, violating CONTRIBUTING.md:3 and GOVERNANCE.md:11. Split them into separate PRs for independent validation, review and revert.

5. The exact head has zero check-runs; its two GitHub Actions suites are action_required. Local validator output and [code]smith = SKIPPED are not exact-head repository evidence.

Do not approve or merge until these blockers are fixed.