Add plugin: enconvert/enconvert v0.0.1

[OmJadav9]

Plugin Submission

Plugin information

• Author: enconvert
• Plugin name: enconvert
• Version: 0.0.1
• Source repository: https://github.com/enconvert/dify-enconvert
• Contact: support@enconvert.com

Submission type

• New plugin
• Version update

What changed

First submission. A tool plugin for the EnConvert API with six tools behind a single BYO API-key credential:

Tool	Endpoint	What it does
Perceive URL	POST /v2/perceive	Render a page to markdown, HTML, screenshot, PDF, links, images or structured data, with a render_quality score from 0.0 to 1.0 so a blocked or empty page is flagged rather than passed off as content.
Web Search	POST /v2/lookup	Web, news, image, scholar, patent and map search.
Discover URLs	POST /v2/discover	List a site's URLs via sitemap, crawl or hybrid, without rendering.
Extract Structured	POST /v2/distill	Extract fields matching a JSON schema from given URLs or from a discovered site.
Convert File to Markdown	POST /v1/convert/anything-to-markdown	Convert an uploaded Dify file (Office, PDF, EPUB, HTML, CSV…) to Markdown.
Convert File to PDF	POST /v1/convert/anything-to-pdf	Convert an uploaded Dify file to PDF.

The plugin ships no key and no default credential. Each user supplies their own private EnConvert key (sk_), validated on connect against GET /v1/whoami, which rejects public pk_ keys. It is free on the Marketplace; EnConvert bills the user on their own key.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Outbound network requests. Two hosts, both declared in manifest.yaml under network.domains. Every API call goes to https://api.enconvert.com, built from the module-level BASE_URL constant in tools/enconvert_client.py — no user input reaches the host or scheme. Perceive additionally reads back the signed storage URL the API returns (nyc3.digitaloceanspaces.com) so a page's markdown lands in the tool result instead of a 15-minute link an agent cannot open; that read is capped at 256 KB and falls back to emitting the link. www.enconvert.com appears in the declaration only because it is named in a credential-error message. All requests set an explicit timeout (30s for credential validation, 120s for tool calls and artifact reads).

The plugin never fetches a user-supplied URL itself. URLs passed to Perceive, Discover and Extract Structured are sent to the EnConvert API as request data and are fetched, rendered and crawled by EnConvert's servers — not by the Dify host running the plugin. There is no SSRF path from a tool parameter into the deployment's network. The two convert tools take a Dify file object (type: file) and upload its bytes, so they do not fetch a URL either.

Data sent to a third party. The user's API key (X-API-Key header), the tool parameters they or their agent supply, and — for the convert tools — the bytes of the file they wire in. EnConvert processes these under its own terms and privacy policy, both linked from PRIVACY.md.

Not present: no command, shell or code execution; no SQL or database access; no SSH/SFTP; no local filesystem operations; no browser automation inside the plugin; no webhook forwarding; no proxying; no bundled binaries; no analytics or telemetry. The plugin is stateless and stores nothing — the API key is held only for the duration of a request, in Dify's encrypted credential store. No health, financial, biometric, children's or location data is handled.

Local validation

Packaged with dify-plugin-windows-amd64.exe v0.6.10:

$ dify plugin package ./dify-enconvert -o enconvert-0.0.1.difypkg
INFO plugin packaged successfully

$ python validator/check-package-contents.py -d unpacked        # Package contents check passed
$ python validator/check-package-secrets.py -d unpacked         # Package secrets check passed
$ python validator/check-package-dependencies.py -d unpacked    # Package dependency check passed
$ python validator/check-readme-metadata.py -d unpacked         # README metadata check passed
$ python validator/check-access-domains.py -d unpacked          # Access domain check passed
$ python validator/check-python-safety-warnings.py -d unpacked  # Python safety warning check passed

Manifest metadata was checked field-by-field against toolkit/checks/manifest.py (all required fields present, contact is a valid address, repo host allowed, PRIVACY.md present and non-templated) — check-manifest-metadata.py itself needs yq, which is not available on the packaging machine.

Package contents: 24 files, no .env, .venv, __pycache__, .git, caches or OS files.

All six tools were then run for real against api.enconvert.com under the plugin runtime, driven over the daemon's own stdio protocol (INSTALL_METHOD=local, newline-delimited JSON on stdin/stdout — the same interface the daemon uses when it runs a plugin as a subprocess). Credential validation returns {"result": true} for a valid key and the provider's error for an invalid one; Perceive renders example.com at render_quality 0.85 and inlines its markdown; Web Search returns ranked results; Discover returns URLs from sitemap plus crawl; Extract Structured returns {"title": "Example Domain"} on the LLM tier; both convert tools upload a file and return a signed result URL.

That run found and fixed two defects a stubbed test could not: Perceive emitted only a signed URL for markdown (and markdown was not in the link-message set at all), and Extract Structured always reported tier: None because extraction_tier is per result, not top level. The package in this PR is the fixed build.

Behaviour is also pinned by an offline test with a stubbed transport: each of the six tools invoked through its real _invoke and asserted to POST to the correct endpoint, with the convert tools asserted to send direct_download=false and the uploaded filename and bytes.

Reviewer notes

Testing limitation, stated plainly: every tool has been run for real, but not through a Dify server — the plugin was driven directly over the daemon's stdio protocol rather than by a Dify instance, so the "I tested this plugin on Community Edition and Cloud" box above is left unchecked. What that leaves unverified is the Dify-side surface only: how the parameters render in the UI (in particular the type: file input on the two convert tools) and the install flow itself. Tool logic, credential validation, endpoints, payloads and response handling are all confirmed against the live API — see Local validation. Happy to do a UI pass and push a follow-up if you would rather review after that.

Source for every file in the package is at https://github.com/enconvert/dify-enconvert (release v0.0.1 carries the identical .difypkg).