Sophon Marketplace
Discover, install, and publish skills and plugins for Sophon — browse the catalog at marketplace.sophon.buildersoft.io.
The Sophon Marketplace is the official package registry and web catalog for Sophon, operated by Buildersoft. It's where you discover community-built packages — skills and plugins — browse what they can do before installing, and publish your own. All packages on the marketplace are free.
You can browse the catalog in any browser, or directly from your Sophon instance: the Dashboard's Skills → Marketplace tab and the sophon skills CLI commands both search and install from the same registry. See Installing Packages.
Skills and plugins
The marketplace carries two package types:
| Skills | Plugins | |
|---|---|---|
| Archive | .sophon-skill | .sophon-plugin |
| Contents | manifest.json + entrypoint code | manifest.json + compiled .dll payload |
| Runtime | python, csharp, or sandbox | .NET, runs as a separate process |
| What they add | Tools agents can call — each declares a risk level (none → critical) | A platform capability behind one of five extension interfaces — never new tools |
| How they run | Sandboxed per invocation | Full-trust long-lived local process — only runs once the instance enables plugins |
A skill packages a set of tools — the same shape as Sophon's bundled skills. A plugin extends the platform itself, targeting one of five extension interfaces. Two are consumed by the runtime today: ChannelAdapter (teach your instance a new messaging channel — a proprietary in-house chat system, say, or an internal ticketing bridge) and DocumentExtractor (bring new file formats like EPUB or CAD into the document pipeline). The other three — ModelProvider, EmbeddingProvider, and VaultBackend — are accepted by the manifest parser but not yet consumed by the runtime; those extension points are coming. There is deliberately no Tool plugin interface: tool manifests are refused at parse time, because custom tools belong in sandboxed skills or an MCP server.
One more thing separates plugins from skills: an installed plugin doesn't run until the instance's admin turns plugins on with Sophon:Plugins:Enabled (optionally restricted further with a per-plugin allowlist). Installing from the marketplace puts the plugin on disk; enabling is a deliberate, separate step. See the Plugins guide.
Browsing the catalog
The marketplace website is organized for discovery:
- Home — featured, trending, and newly published packages
- Browse — full-catalog search with filters for package type, category, tags, and rating
- Categories — utility, productivity, communication, data, development, integration, AI, automation, and other
- Package pages — the package's README, its capabilities (every tool with its declared risk level and permissions), full version history, and user reviews
- Publisher profiles — everything a given author has published
Press Cmd+K (or Ctrl+K) anywhere on the site for quick search.
Reviews and accounts
Browsing and installing are anonymous — you only need a marketplace account (email + verification) to publish packages or review them. Reviews are 1–5 stars with optional text, one editable review per user per package. Reviews posted from a linked Sophon instance carry a "Via Sophon" pill — see reviewing from your instance.
Trust and safety
Every package version goes through the same gate before anyone can see or install it:
- Mandatory human review — a new version is invisible to browse, search, and download until a moderator approves it. Automated static analysis (declared permissions, tool risk levels, file inventory, diff against the previous version) assists every review.
- Checksum-verified installs — your Sophon instance verifies each download against its SHA-256 checksum and fails closed: if the checksum is missing or doesn't match, nothing is installed.
- Declared permissions, sandboxed execution — skills state their network and filesystem access up front, and run inside the same sandbox as every other skill. Agent-initiated installs always require your explicit approval.
Cryptographic package signing is on the roadmap. For the full picture of how marketplace packages fit Sophon's security model, see the threat model.
Where to go next
- Installing Packages — Dashboard, CLI, and agent installs; updates; air-gapped setups
- Publishing Packages — packaging, the publish API, and the review lifecycle
- Skills — how skills work once installed
- Plugins — enabling plugins and how they run
- Skill Manifest Reference — the full manifest schema
PluginsNEW
Extend Sophon with out-of-process plugins — new messaging channels and document formats running as local processes alongside the Gateway.
Installing Packages
Browse, install, update, and remove marketplace packages from the Dashboard, CLI, or an agent — with human approval on every agent install.