Manifest reference

Every field of plugin.json for store apps (pluginApiVersion 3), the grants, and every validation code the CLI, the store and the desktop installer can report.

plugin.json sits at the root of your app. It's the part of your app the store reviews and the user consents to: what the app is, where its tools live, which hosts it may reach, and what it may do.

For editor completion and inline errors, point it at the JSON Schema:

{ "$schema": "https://chataway.co/schemas/app-manifest-v3.json" }

The schema checks shape. chataway validate --store runs the full store checks — the same code the store and the desktop installer run.

#A complete example

{
  "$schema": "https://chataway.co/schemas/app-manifest-v3.json",
  "pluginApiVersion": 3,
  "id": "com.example.acme-assets",
  "name": "Acme Assets",
  "version": "1.2.0",
  "description": "Upload images and audio from your chats to your Acme library.",
  "publisher": "acme",
  "categories": ["media", "games"],
  "homepage": "https://example.com/chataway",
  "support": "mailto:help@example.com",
  "branding": {
    "icon": "assets/icon.png",
    "mark": "assets/mark.svg",
    "accent": "#2F7BF6",
    "screenshots": ["assets/s1.png", "assets/s2.png"]
  },
  "remote": {
    "mcpUrl": "https://apps.example.com/chataway/mcp",
    "domains": ["apps.example.com", "cdn.example.com"]
  },
  "accounts": [{
    "id": "acme", "label": "Acme",
    "authorizeUrl": "https://auth.example.com/oauth/authorize",
    "tokenUrl": "https://auth.example.com/oauth/token",
    "clientId": "chataway-3f9c1a",
    "scopes": ["openid", "asset:write"],
    "required": true
  }],
  "grants": ["files:receive", "host:media"],
  "permissions": [
    "Receive images and audio you choose to upload to Acme",
    "Resize images to Acme's decal size before uploading"
  ],
  "contributes": {
    "tools": [{
      "id": "upload_decals",
      "name": "Upload decals",
      "description": "Upload images to the user's Acme inventory as decals. Returns the new asset ids.",
      "files": {
        "images": {
          "accept": ["image/png", "image/jpeg"],
          "multiple": true,
          "maxBytes": 20000000,
          "prepare": { "op": "resize", "width": 512, "height": 512, "fit": "contain", "format": "png" }
        }
      },
      "confirm": { "title": "Upload {{count}} image(s) to Acme?", "action": "Upload" },
      "account": "acme"
    }],
    "panels": [{
      "id": "main", "title": "Acme", "icon": "branding", "component": "webview",
      "config": { "entry": "ui/index.html" },
      "views": [{ "id": "assets", "label": "Assets" }]
    }],
    "settings": []
  }
}

#Top-level fields

#Not available to store apps

These exist for Chataway's built-in apps and for local apps (which also declare network.domains), and are rejected in store bundles (in dev mode, they're warnings):

#requires

"requires": {
  "apps":       [{ "id": "browser-use", "reason": "Opens canva.com when the connector isn't connected" }],
  "connectors": [{ "url": "https://mcp.canva.com/mcp", "reason": "Fast, reliable Canva edits" }],
  "optional":   [{ "id": "media", "reason": "Saves exports into your Media library" }]
}

At most 10 entries per list. Adding a required app or connector in an update needs review and fresh consent. See Dependencies.

#remote

domains is used for:

• your panel's CSP (connect-src, img-src, media-src),
• every request Chataway makes for your app: MCP calls, redirects, and resource_link downloads,
• the store listing (users see the list).

Adding a domain in an update needs human review and the user's consent again.

#grants

Every grant must be explained in permissions. Adding a grant in an update needs human review and the user's consent again.

#branding

Paths are relative to the bundle root, with no .. and no leading /. See Branding.

#accounts

¹ Not with auth: "mcp".

See Connected accounts.

#contributes.tools[]

Write descriptions for the agent: what the tool does, when to use it, what it returns, and anything it must not do. "Upload images to the user's Acme inventory as decals. Returns the new asset ids. Only call it when the user asked to upload."

#files

"files": { "<param>": { "accept": ["image/*"], "multiple": true, "maxBytes": 20000000, "prepare": { "op": "resize", "width": 512 } } }

Param names follow the tool id rules. See Files & hand-off.

#confirm

See Cards & approvals.

#contributes.panels[]

See Panels & the bridge.

#contributes.settings[] and settingSections[]

See Settings for every field.

#Categories

Up to three of:

media · design · productivity · developer · data · marketing · sales · games · communication · finance · education · other

#Bundle

A .chataway-app file is a zip of:

Anything else at the top level is rejected. No executables (.node, .dylib, .so, .dll, .exe, .sh, .command, .app, .pkg, .dmg, .py, .rb, .jar). Total ≤ 25 MiB. Minified JavaScript is fine; obfuscated JavaScript is flagged. chataway pack builds the bundle for you.

#Validation codes

Every issue has a stable code, a path into the manifest (or bundle) and a message. chataway validate prints them like this:

✖ contributes.tools[0].files.images.prepare: "prepare" needs the "host:media" grant [tools.files.prepare.grant]
⚠ categories: Add at least one category so people can find the app [categories.missing]

Error issues block publishing. Warnings don't, but reviewers see them. Rules marked Error (store) · warning (dev) are store-only: chataway dev accepts them so you can experiment locally, and the store rejects them.

This table is generated from the validator the store runs.