Xpex Plugin Factory

What xpex-plugin-factory does

The xpex-plugin-factory MCP server connects an MCP client to XPeX Plugin Factory, a software supply-chain compiler for agent products. It turns a strict JSON blueprint into a reviewable package containing plugin manifests, MCP configuration, skills, branding, documentation, a factory report, and a deterministic ZIP artifact.

The MCP interface is computation-only. It supports offer and schema discovery, blueprint validation, artifact previews, and ZIP compilation. It does not publish a plugin, create a payment checkout, authorize payment, or mutate third-party systems.

As a listing in the 💻 Developer Tools category, it fits workflows where an agent or developer needs to check an agent integration design before packaging or implementation.

How it works

A typical compilation path is:

1. Provide a JSON blueprint.
2. Validate its structure and run XPeX security policy checks.
3. Preview the generated text files, or compile the accepted blueprint.
4. Receive a deterministic ZIP as base64 from the MCP compilation tool.

The underlying HTTP service also exposes /health, /v1/schema, /v1/validate, /v1/preview, and /v1/package. The MCP endpoint is /mcp. The factory’s security gates can reject or warn about embedded credentials, private or non-HTTPS MCP endpoints, anonymous access to sensitive data, write-capable plugins without human approval, and machine-key surfaces that need an OAuth boundary.

Setup and configuration

Connect an MCP client to:

https://xpex-plugin-factory-production.up.railway.app/mcp

The README documents a production deployment and a local development workflow using npm install, npm run check, npm test, npm run build, and npm run dev. Local HTTP examples use port 8080. A command-line generation example reads a blueprint and writes generated output to a local directory.

The service has an unauthenticated MCP surface for offer discovery and computation-only generation. Do not send private keys, seed phrases, API secrets, bearer tokens, or other credentials in blueprints. STRIPE_WEBHOOK_SECRET is described as a runtime secret for the production Stripe webhook, not as an input to the MCP blueprint workflow.

Tools and capabilities

The xpex-plugin-factory MCP server provides these tools:

• xpex_factory_get_agent_kit_offer returns live x402 Agent Kit terms, an OpenAPI URL, and example input. It only provides discovery information.
• xpex_factory_list_offers lists fixed-price services and Stripe-hosted checkout URLs without creating checkout sessions.
• xpex_factory_get_schema returns the blueprint contract summary and generation endpoints.
• xpex_factory_validate_blueprint checks a blueprint and applies security policy rules without generating or publishing it.
• xpex_factory_preview_plugin compiles reviewable text artifacts without external mutation.
• xpex_factory_compile_plugin returns a deterministic, base64-encoded ZIP.

Generated packages may include plugin.json, Codex plugin metadata, MCP configuration files, skill files, an SVG asset, a README, and FACTORY-REPORT.json.

Limitations and notes

The xpex-plugin-factory MCP server does not publish generated plugins or perform changes in external systems. Its offer-listing tool does not claim payment, and the Agent Kit offer tool does not authorize the 0.01 USDC request or generate a kit. The full-blueprint APIs remain free according to the README, while paid services and the x402 Agent Kit follow separate payment flows.

Compilation depends on a valid blueprint and the factory’s policy checks. Runtime credentials are not generated into packages. A deterministic ZIP is returned as base64 through MCP, so clients must decode it if they need a local archive.