feat: add QVeris MCP Gateway 0.1.0

[FairyZhang-sunny]

Plugin Submission

Plugin information

• Author: qverisai
• Plugin name: qveris-mcp
• Version: 0.1.0
• Source repository: https://github.com/QVerisAI/dify-qveris-mcp
• Contact: contact@qveris.ai

Submission type

• New plugin
• Version update

What changed

Adds QVeris MCP Gateway, a Dify Extension plugin that exposes six QVeris operations through a Dify-hosted Streamable HTTP MCP endpoint: discover, inspect, probe, call, usage_history, and credits_ledger.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

High risk. This plugin is a broad QVeris capability gateway. Depending on the selected QVeris capability, it can process health, financial, location, authentication, personal, or other sensitive inputs, and the call operation may incur charges. It forwards user-supplied tool inputs only to the fixed HTTPS API https://qveris.ai/api/v1, rejects redirects, uses request timeouts, and caps response sizes. It does not execute code or commands, access the filesystem, automate browsers, or fetch arbitrary URLs. The QVeris API key is kept in Dify endpoint settings and a separate bearer token protects the generated MCP endpoint.

Local validation

• The source repository's latest GitHub Actions CI run passed on Python 3.12.
• Packaging succeeded with the official Dify Plugin CLI 0.6.10.
• The generated package contains 21 files (39,855 bytes uncompressed; 17 KB archive).
• Package contents were inspected and exclude .env, .git, caches, tests, development files, and executables.
• SHA-256: d7e5010261305fc9c8a9b12ec8ced1b3670841731fbcbba9e8fe8eff54963320.

Reviewer notes

Live endpoint creation was not repeated on Dify Community Edition or Dify Cloud during this submission; this limitation is disclosed here. The plugin requires Dify 1.3.0 or later. It supports Streamable HTTP POST and does not support SSE.