Skip to main content

Availability

Resource Provider plugins allow you to register custom resource types that integrate into the App creation flow, participate in privacy scoring, and work with the group-based access control model. This enables plugins to extend the platform’s governance model with new kinds of resources beyond the built-in LLMs, Datasources, and Tools.

Overview

By default, Apps in AI Studio bundle three built-in resource types: LLMs, Datasources, and Tools. The Resource Provider capability lets plugins register additional resource types that:
  • Appear in the Create App form as selectable resources (via a plugin-provided Web Component or a platform-rendered multi-select)
  • Participate in privacy scoring with the generalized rule: no resource privacy score may exceed the maximum LLM privacy score in the app
  • Integrate with group-based access control so admins can assign resource instances to groups, and users only see resources available to their groups
  • Support the community submission workflow so end-users can submit new resource instances for admin review
  • Propagate to gateways via the config snapshot, so gateway plugins can access resource associations at runtime

Use Cases

  • MCP Server Registry: Register MCP servers as a resource type, let users bundle them into Apps
  • Vector Store Catalog: Expose vector databases with privacy scores for RAG pipelines
  • API Connectors: Custom API integrations that need governance and access control
  • Knowledge Bases: Document collections with sensitivity classifications

How It Works

Implementing a Resource Provider

1. Implement the ResourceProvider Interface

Expandable

2. Declare in the Manifest

Add the resource_types section to your plugin manifest:
Expandable
Resource types declared in the manifest are automatically registered when the plugin loads. The GetResourceTypeRegistrations() method provides a runtime fallback and can return additional types not in the manifest.

3. Serve the Plugin

ResourceProvider Interface Reference

SDK Types

ResourceTypeRegistration

ResourceInstance

Security: Do not store secrets, credentials, or PII in the Metadata field. Metadata is propagated to all gateways via config snapshots, cached in database join tables, and may appear in logs or be accessible to other plugins with access to the app configuration.

ResourceFormComponent

Privacy Scoring

When HasPrivacyScore is true, each resource instance carries a privacy score (0-100). The platform enforces a generalized rule during app creation and updates:
No resource privacy score may exceed the maximum LLM privacy score in the app.
This applies to both built-in datasources and plugin resources. For example: The plugin sets privacy scores on instances via the PrivacyScore field in ResourceInstance. Admins review and approve these scores through the submission workflow.

Access Control

Plugin resource instances use direct group mapping instead of the catalogue pattern used by built-in types. This is simpler and sufficient since plugins organize their own resources.

Access Chain

Compare with built-in types:

Admin Workflow

  1. Admin navigates to Teams (Groups) in the admin UI
  2. Opens a group and scrolls to the Plugin Resources section
  3. For each registered resource type, selects which instances this group can access
  4. Saves the group

User Experience

When a user creates an App, they only see resource instances accessible via their group memberships. Admins bypass this filter and see all instances.

Custom Form Components

For richer selection UX, plugins can provide a Web Component instead of the platform’s standard multi-select. Declare it in the FormComponent field:
The platform loads your Web Component JS from plugin assets and renders it in the App form. The contract:

Injected Properties

Events to Dispatch

Example Web Component

Expandable

Gateway Integration

Plugin resource associations are included in the config snapshot sent to gateways. Each AppConfig includes a plugin_resources field:
Gateway plugins can access these associations from the app’s config to make routing or authorization decisions. For example, an MCP proxy plugin could check if the requesting app has access to a specific MCP server by examining the plugin_resources field.

Community Submissions

When SupportsSubmissions is true, community users can submit new resource instances through the existing submission workflow:
  1. User fills out a submission form with resource_type: "plugin" and a plugin_resource_type_id
  2. The resource_payload contains plugin-defined JSON describing the new instance
  3. Admin reviews the submission (including a suggested privacy score)
  4. On approval, the platform calls the plugin’s CreateResourceInstance() with the payload
  5. The plugin creates the instance and returns its ID
  6. The instance becomes available for selection in the App form

Manifest Reference

Expandable

API Endpoints

These endpoints are available for frontend integration:

Set Group Plugin Resources

Combining with Other Capabilities

Resource Provider plugins often combine with other capabilities for a complete solution:

Example: Complete MCP Registry Plugin

Expandable