@openhands/extensions 0.8.0 → 0.10.0

package/.github/workflows/deprecation-check.yml

@@ -0,0 +1,25 @@
+name: Deprecation deadlines
+
+# release-please opens its release PR with the OpenHands GitHub App token, so
+# this pull_request workflow also runs against the generated version bump.
+on:
+  pull_request:
+    branches: ["**"]
+  push:
+    branches: ["main", "master"]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Verify deprecation deadlines
+        run: uv run python scripts/check_deprecations.py

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.8.0"
+  ".": "0.10.0"
 }

package/README.md

@@ -87,7 +87,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **61 extensions** (51 skills, 10 plugins).
+This repository contains **2 marketplace(s)** with **62 extensions** (52 skills, 10 plugins).
 
 ### large-codebase
 
@@ -106,7 +106,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**57 extensions** (49 skills, 8 plugins)
+**58 extensions** (50 skills, 8 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -137,6 +137,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | gitlab | skill | Interact with GitLab repositories, merge requests, and APIs using the GITLAB_TOKEN environment variable. Use when wor... | — |
 | incident-retrospective | skill | Create an automation that drafts incident retrospectives by gathering incident-channel messages from Slack, collectin... | `/incident-retro:setup` |
 | iterate | skill | Iterate on a GitHub pull request — drive it through CI, code review, and QA until merge-ready. Monitors state, fixes ... | `/iterate`, `/verify`, `/babysit` |
+| jira-issue-to-pr | skill | Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable lab... | — |
 | jupyter | skill | Read, modify, execute, and convert Jupyter notebooks programmatically. Use when working with .ipynb files for data sc... | — |
 | kubernetes | skill | Set up and manage local Kubernetes clusters using KIND (Kubernetes IN Docker). Use when testing Kubernetes applicatio... | — |
 | learn-from-code-review | skill | Distill code review feedback from GitHub PRs into reusable skills and guidelines. Use when users ask to learn from co... | `/learn-from-reviews` |

package/automations/catalog/jira-issue-to-pr.json

@@ -0,0 +1,14 @@
+{
+  "id": "jira-issue-to-pr",
+  "name": "Jira issue to GitHub PR",
+  "category": "Project management",
+  "description": "Watch a Jira Cloud project for issues with a configurable label and automatically open a GitHub pull request for each new issue found. The target GitHub repo is read from the ticket body - no repo parameter required at deploy time.",
+  "requiredIntegrationIds": [
+    "jira",
+    "github"
+  ],
+  "popularityRank": 85,
+  "estimatedSetupMinutes": 5,
+  "prompt": "Set up a Jira automation to create pull requests",
+  "exampleImplementation": "Trigger: cron polling (e.g. every 5 minutes)\nRequired secrets: Jira API token, GitHub personal access token (repo + workflow scope)\n\n1. Collect Jira base URL, email, API token secret name, label to watch, and cron schedule from the user. No GitHub repo is needed at deploy time - each ticket must include the target repo (owner/repo) in its body.\n2. Poll POST /rest/api/3/search/jql on the Jira Cloud instance to find open issues carrying the configured label.\n3. Deduplicate against a KV-store-backed set of already-processed issue keys so re-runs never create duplicate PRs.\n4. For each new issue, start an independent OpenHands agent conversation that extracts the GitHub repo from the ticket body, clones it, creates a branch named after the Jira key, implements or scaffolds the requested change, and opens a pull request.\n5. Immediately after the conversation is created, post a Jira comment on the issue: 'I'm on it: <conversation URL>'.\n6. Persist the processed issue key immediately after dispatching so the next poll skips it."
+}

package/automations/index.js

@@ -5,6 +5,7 @@ import slack_channel_monitor from "./catalog/slack-channel-monitor.json" with {
 import linear_triage_assistant from "./catalog/linear-triage-assistant.json" with { type: "json" };
 import research_brief_writer from "./catalog/research-brief-writer.json" with { type: "json" };
 import incident_retrospective_drafter from "./catalog/incident-retrospective-drafter.json" with { type: "json" };
+import jira_issue_to_pr from "./catalog/jira-issue-to-pr.json" with { type: "json" };
 
 export const AUTOMATION_CATALOG = [
   github_pr_reviewer,
@@ -14,5 +15,6 @@ export const AUTOMATION_CATALOG = [
   linear_triage_assistant,
   research_brief_writer,
   incident_retrospective_drafter,
+  jira_issue_to_pr,
 ];
 export default AUTOMATION_CATALOG;

package/integrations/README.md

@@ -18,6 +18,31 @@ integrations so clients can consume one source of truth.
 Each integration carries its OAuth/MCP connection data directly. Do not add a
 separate provider catalog or per-language provider data.
 
+Every entry must include `docsUrl`. Marketplace input fields must explicitly
+declare both their `type` and whether they are `required`, rather than relying
+on client defaults. When connection metadata includes an `identityMapping`, it
+must also identify the external principal. These requirements keep catalogs
+actionable and prevent clients from guessing security- or UX-relevant defaults.
+
+Connection options may also carry an optional `connectionModel`. This metadata
+lets consumers distinguish the authenticated principal from the external
+resource the credential can reach:
+
+- `principalType` describes who or what authenticated.
+- `credentialScope` describes the provider boundary enforced by the credential.
+- `resourceType` and `resourceCardinality` describe whether the grant represents
+  one workspace/site/tenant or can enumerate several.
+- `selectionMode` tells clients whether the resource is known during auth,
+  selected immediately after auth, or supplied at runtime.
+- `identityMapping` contains constrained dot paths for identity values returned
+  by OAuth, access-token claims, or a provider identity endpoint.
+- `resourceDiscovery` describes a read-only endpoint used to enumerate resources
+  when one grant covers several of them.
+
+These fields are descriptive; they never broaden the scopes enforced by the
+provider credential. Consumers must not claim resource-level isolation when a
+provider token is only account- or tenant-scoped.
+
 Consumers should use the read functions exported by the package:
 
 ```js

package/integrations/catalog/atlassian.json

@@ -1,8 +1,13 @@
 {
   "id": "atlassian",
   "name": "Atlassian (Jira & Confluence)",
-  "description": "Search Jira issues and Confluence pages via Atlassian's hosted MCP server.",
-  "docsUrl": "https://www.atlassian.com/platform/remote-mcp-server",
+  "description": "Search Jira issues, manage tickets, and read Confluence pages from your agent.",
+  "categories": [
+    "Project management",
+    "Documentation"
+  ],
+  "appUrl": "https://www.atlassian.com",
+  "docsUrl": "https://mcp-atlassian.soomiles.com/docs/installation",
   "iconBg": "#0052CC",
   "logoUrl": "https://cdn.simpleicons.org/atlassian/FFFFFF",
   "keywords": [
@@ -10,12 +15,28 @@
     "confluence",
     "tickets",
     "wiki",
-    "issues"
+    "issues",
+    "sprint"
   ],
+  "popularityRank": 88,
+  "installHint": "Paste your Jira and/or Confluence URL and API token. The mcp-atlassian package runs via uvx - no install needed.",
   "connectionOptions": [
     {
       "id": "oauth",
       "provider": "mcp",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "account",
+        "resourceType": "site",
+        "resourceCardinality": "many",
+        "selectionMode": "post_auth",
+        "resourceDiscovery": {
+          "endpoint": "https://api.atlassian.com/oauth/token/accessible-resources",
+          "externalResourceIdPath": "id",
+          "resourceNamePath": "name",
+          "resourceUrlPath": "url"
+        }
+      },
       "transport": {
         "kind": "shttp",
         "url": "https://mcp.atlassian.com/v1/mcp"
@@ -23,6 +44,73 @@
       "auth": {
         "strategy": "oauth2"
       }
+    },
+    {
+      "id": "api",
+      "provider": "mcp",
+      "transport": {
+        "kind": "stdio",
+        "serverName": "mcp-atlassian",
+        "command": "uvx",
+        "args": [
+          "mcp-atlassian"
+        ],
+        "envFields": [
+          {
+            "key": "JIRA_URL",
+            "label": "Jira URL",
+            "type": "text",
+            "placeholder": "https://your-company.atlassian.net",
+            "required": false,
+            "helperText": "Your Atlassian Jira base URL. Omit if using Confluence only."
+          },
+          {
+            "key": "JIRA_USERNAME",
+            "label": "Jira username (email)",
+            "type": "text",
+            "placeholder": "your.email@company.com",
+            "required": false,
+            "helperText": "Email address linked to your Atlassian account."
+          },
+          {
+            "key": "JIRA_API_TOKEN",
+            "label": "Jira API token",
+            "type": "password",
+            "placeholder": "ATATT...",
+            "required": false,
+            "helperText": "Atlassian API token for Jira. Required when JIRA_URL is set.",
+            "helperLink": "https://id.atlassian.com/manage-profile/security/api-tokens"
+          },
+          {
+            "key": "CONFLUENCE_URL",
+            "label": "Confluence URL",
+            "type": "text",
+            "placeholder": "https://your-company.atlassian.net/wiki",
+            "required": false,
+            "helperText": "Your Atlassian Confluence base URL. Omit if using Jira only."
+          },
+          {
+            "key": "CONFLUENCE_USERNAME",
+            "label": "Confluence username (email)",
+            "type": "text",
+            "placeholder": "your.email@company.com",
+            "required": false,
+            "helperText": "Email address linked to your Atlassian account."
+          },
+          {
+            "key": "CONFLUENCE_API_TOKEN",
+            "label": "Confluence API token",
+            "type": "password",
+            "placeholder": "ATATT...",
+            "required": false,
+            "helperText": "Atlassian API token for Confluence. Required when CONFLUENCE_URL is set.",
+            "helperLink": "https://id.atlassian.com/manage-profile/security/api-tokens"
+          }
+        ]
+      },
+      "auth": {
+        "strategy": "api_key"
+      }
     }
   ]
 }

package/integrations/catalog/datadog.json

@@ -8,8 +8,9 @@
   ],
   "appUrl": "https://www.datadoghq.com",
   "docsUrl": "https://docs.datadoghq.com/bits_ai/mcp_server/setup/",
-  "notes": "Uses Datadog's official hosted MCP server. The default registration targets the US1 endpoint and can be edited for other Datadog sites.",
+  "notes": "Uses Datadog's official hosted MCP server. The MCP endpoint host is site-specific: use https://mcp.<site>.datadoghq.com/v1/mcp for your Datadog site (e.g. mcp.us5.datadoghq.com for US5). The default URL below targets US1 and can be edited in the install dialog.",
   "popularityRank": 35,
+  "installHint": "The Datadog MCP URL is site-specific. Edit the URL to https://mcp.<site>.datadoghq.com/v1/mcp for your Datadog site (for example https://mcp.us5.datadoghq.com/v1/mcp for US5, https://mcp.eu.datadoghq.com/v1/mcp for EU). Find your site at Organization Settings → Site in Datadog.",
   "connectionOptions": [
     {
       "id": "oauth",
@@ -27,7 +28,37 @@
       },
       "transport": {
         "kind": "shttp",
-        "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp"
+        "url": "https://mcp.datadoghq.com/v1/mcp"
+      }
+    },
+    {
+      "id": "api",
+      "provider": "mcp",
+      "auth": {
+        "strategy": "none"
+      },
+      "transport": {
+        "kind": "shttp",
+        "url": "https://mcp.datadoghq.com/v1/mcp",
+        "urlEditable": true,
+        "headerFields": [
+          {
+            "key": "DD-API-KEY",
+            "label": "Datadog API key",
+            "type": "password",
+            "required": true,
+            "placeholder": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "helperText": "Created in Datadog under Organization Settings → API Keys. Used to authenticate to the Datadog MCP server. See the [setup docs](https://docs.datadoghq.com/mcp_server/setup/?tab=other#authentication)."
+          },
+          {
+            "key": "DD-APPLICATION-KEY",
+            "label": "Datadog Application key",
+            "type": "password",
+            "required": true,
+            "placeholder": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "helperText": "Created in Datadog under Organization Settings → Application Keys. Grants the MCP server access to your Datadog data. See the [setup docs](https://docs.datadoghq.com/mcp_server/setup/?tab=other#authentication)."
+          }
+        ]
       }
     }
   ]

package/integrations/catalog/github.json

@@ -14,6 +14,26 @@
     {
       "id": "oauth",
       "provider": "mcp",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "account",
+        "resourceType": "organization",
+        "resourceCardinality": "many",
+        "selectionMode": "post_auth",
+        "identityMapping": {
+          "source": "identity_api",
+          "endpoint": "https://api.github.com/user",
+          "externalPrincipalIdPath": "id",
+          "resourceNamePath": "login",
+          "resourceUrlPath": "html_url"
+        },
+        "resourceDiscovery": {
+          "endpoint": "https://api.github.com/user/orgs",
+          "externalResourceIdPath": "id",
+          "resourceNamePath": "login",
+          "resourceUrlPath": "html_url"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/microsoft-outlook.json

@@ -14,6 +14,19 @@
     {
       "id": "oauth",
       "provider": "http",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "tenant",
+        "resourceType": "tenant",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "access_token_claims",
+          "externalPrincipalIdPath": "oid",
+          "externalTenantIdPath": "tid",
+          "externalResourceIdPath": "tid"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/microsoft-teams.json

@@ -14,6 +14,19 @@
     {
       "id": "oauth",
       "provider": "http",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "tenant",
+        "resourceType": "tenant",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "access_token_claims",
+          "externalPrincipalIdPath": "oid",
+          "externalTenantIdPath": "tid",
+          "externalResourceIdPath": "tid"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/notion.json

@@ -13,6 +13,19 @@
     {
       "id": "oauth",
       "provider": "http",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "resource",
+        "resourceType": "workspace",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "oauth_token_response",
+          "externalPrincipalIdPath": "owner.user.id",
+          "externalResourceIdPath": "workspace_id",
+          "resourceNamePath": "workspace_name"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/onedrive.json

@@ -14,6 +14,19 @@
     {
       "id": "oauth",
       "provider": "http",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "tenant",
+        "resourceType": "tenant",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "access_token_claims",
+          "externalPrincipalIdPath": "oid",
+          "externalTenantIdPath": "tid",
+          "externalResourceIdPath": "tid"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/sharepoint.json

@@ -14,6 +14,19 @@
     {
       "id": "oauth",
       "provider": "http",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "tenant",
+        "resourceType": "tenant",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "access_token_claims",
+          "externalPrincipalIdPath": "oid",
+          "externalTenantIdPath": "tid",
+          "externalResourceIdPath": "tid"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/slack.json

@@ -14,6 +14,20 @@
     {
       "id": "oauth",
       "provider": "mcp",
+      "connectionModel": {
+        "principalType": "user",
+        "credentialScope": "resource",
+        "resourceType": "workspace",
+        "resourceCardinality": "one",
+        "selectionMode": "automatic",
+        "identityMapping": {
+          "source": "oauth_token_response",
+          "externalPrincipalIdPath": "authed_user.id",
+          "externalTenantIdPath": "enterprise.id",
+          "externalResourceIdPath": "team.id",
+          "resourceNamePath": "team.name"
+        }
+      },
       "auth": {
         "strategy": "oauth2",
         "oauth": {

package/integrations/catalog/superhuman-mail.json

@@ -0,0 +1,36 @@
+{
+  "id": "superhuman-mail",
+  "name": "Superhuman Mail",
+  "description": "Search, read, draft, and send email via Superhuman's hosted MCP server.",
+  "categories": [
+    "Communication",
+    "Email"
+  ],
+  "appUrl": "https://superhuman.com",
+  "docsUrl": "https://github.com/superhuman/mcp-mail",
+  "notes": "OAuth is handled by the Superhuman MCP server itself (mcp-remote). No client credentials required.",
+  "connectionOptions": [
+    {
+      "id": "oauth",
+      "provider": "mcp",
+      "transport": {
+        "kind": "shttp",
+        "url": "https://mcp.mail.superhuman.com/mcp"
+      },
+      "auth": {
+        "strategy": "oauth2",
+        "oauth": {
+          "clientAuthentication": "none"
+        }
+      }
+    }
+  ],
+  "iconBg": "#FF5C28",
+  "logoUrl": "https://cdn.simpleicons.org/superhuman/FFFFFF",
+  "keywords": [
+    "email",
+    "mail",
+    "superhuman",
+    "inbox"
+  ]
+}

package/integrations/catalog/vanta.json

@@ -0,0 +1,55 @@
+{
+  "id": "vanta",
+  "name": "Vanta",
+  "description": "Query Vanta compliance controls, tests, evidence, risks, and vulnerabilities from the agent.",
+  "categories": [
+    "Security",
+    "Compliance"
+  ],
+  "appUrl": "https://www.vanta.com",
+  "docsUrl": "https://developer.vanta.com/docs/vanta-mcp",
+  "notes": "Vanta's hosted remote MCP server (beta, requires a Vanta Admin role). Regional endpoints: US https://mcp.vanta.com/mcp, EU https://mcp.eu.vanta.com/mcp, AUS https://mcp.aus.vanta.com/mcp. Authentication is OAuth only - no API keys.",
+  "popularityRank": 64,
+  "connectionOptions": [
+    {
+      "id": "oauth",
+      "provider": "mcp",
+      "auth": {
+        "strategy": "oauth2",
+        "oauth": {
+          "authorizationUrl": "https://app.vanta.com/oauth/authorize",
+          "tokenUrl": "https://api.vanta.com/oauth/token",
+          "registrationUrl": "https://api.vanta.com/oauth/register",
+          "scopes": [
+            "mcp-api.all:read"
+          ],
+          "optionalScopes": [
+            "mcp-api.all:write"
+          ],
+          "pkce": true,
+          "clientAuthentication": "none",
+          "additionalAuthorizationParams": {
+            "resource": "https://mcp.vanta.com"
+          },
+          "additionalTokenParams": {
+            "resource": "https://mcp.vanta.com"
+          }
+        }
+      },
+      "transport": {
+        "kind": "shttp",
+        "url": "https://mcp.vanta.com/mcp"
+      }
+    }
+  ],
+  "iconBg": "#003D2B",
+  "keywords": [
+    "compliance",
+    "soc2",
+    "security",
+    "audit",
+    "risk",
+    "vanta"
+  ],
+  "installHint": "Connect via the OAuth MCP option. After connecting, complete the OAuth flow in your browser as a Vanta Admin. EU tenants should use https://mcp.eu.vanta.com/mcp and AUS tenants https://mcp.aus.vanta.com/mcp as the transport URL. The legacy local server @vantasdk/vanta-mcp-server is deprecated - prefer the hosted remote server."
+}