Confusing documentation on adding external plugins: are they allowed or not?

[toonvanvr]

Question

In CONTRIBUTING.md, I discovered that plugins from remote sources are not accepted. It's unclear whether my repository toonvanvr/prompt-engineering is a remote source or not, as it doesn't clearly define a remote source as being something hosted outside of the Github platform or something hosted outside of this Github repository.

I intended to add my repository to the list of Agent Plugins (VSCode preview feature), to make it available in the VSCode marketplace, but now I'm not sure if this is supported.

My main issue with understanding it, comes from this phrase:

While the plugin design allows us to support plugins from other GitHub repos, or other Git endpoints, we are not accepting contributions that simply add plugins from external sources.

It's not clear whether you're meaning "while it's supported technically, we don't allow it" vs. "we support sources from the Github platform, not third party platforms or sources".

References

CONTRIBUTING.md - What We Don't Accept

• Plugins from remote sources: While the plugin design allows us to support plugins from other GitHub repos, or other Git endpoints, we are not accepting contributions that simply add plugins from external sources. Plugins from remote sources represent a security risk as we are unable to verify their content for the policies we enforce on this repository. This policy does not apply to repositories that are managed by Microsoft or GitHub.

CONTRIBUTING.md - Adding External Plugins

To add an external plugin, append an entry to plugins/external.json following the Claude Code plugin marketplace spec. Each entry requires name, source, description, and version:

[aaronpowell]

We aren't going to be allowing remote plugins to the Awesome Copilot plugin marketplace from sources outside of the GitHub/Microsoft organisation (or potentially partners) at this point in time. Marketplaces are essentially just a JSON index of locations where tools (Copilot CLI, VS Code, etc.) can obtain plugins from. Remote plugins do pose a risk as a marketplace owner because we are not able to validate source for things like security, since we only see the endpoint like some-account/my-plugin (yes, you can do ref pinning but that isn't foolproof)

People can still create their own marketplaces, it's a matter of putting the .github/plugins/marketplace.json file into their repo, and then users can add the marketplace via the VS Code tooling experience (it goes into the settings.json file so it can be part of a projects repo) or using copilot plugin marketplace add ... using CLI.