Availability
| Edition | Deployment Type |
|---|---|
| Community & Enterprise | Self-Managed, Hybrid |
Overview
By default, Apps in AI Studio bundle three built-in resource types: LLMs, Datasources, and Tools. The Resource Provider capability lets plugins register additional resource types that:- Appear in the Create App form as selectable resources (via a plugin-provided Web Component or a platform-rendered multi-select)
- Participate in privacy scoring with the generalized rule: no resource privacy score may exceed the maximum LLM privacy score in the app
- Integrate with group-based access control so admins can assign resource instances to groups, and users only see resources available to their groups
- Support the community submission workflow so end-users can submit new resource instances for admin review
- Propagate to gateways via the config snapshot, so gateway plugins can access resource associations at runtime
Use Cases
- MCP Server Registry: Register MCP servers as a resource type, let users bundle them into Apps
- Vector Store Catalog: Expose vector databases with privacy scores for RAG pipelines
- API Connectors: Custom API integrations that need governance and access control
- Knowledge Bases: Document collections with sensitivity classifications
How It Works
Implementing a Resource Provider
1. Implement the ResourceProvider Interface
Expandable
2. Declare in the Manifest
Add theresource_types section to your plugin manifest:
Expandable
GetResourceTypeRegistrations() method provides a runtime fallback and can return additional types not in the manifest.
3. Serve the Plugin
ResourceProvider Interface Reference
| Method | When Called | Purpose |
|---|---|---|
GetResourceTypeRegistrations() | Plugin load/reload | Declare resource types |
ListResourceInstances(ctx, slug) | App form load, Group form load | List available instances |
GetResourceInstance(ctx, slug, id) | Config snapshot build | Get instance details for gateway |
ValidateResourceSelection(ctx, slug, ids, appID) | App create/update | Custom validation logic |
CreateResourceInstance(ctx, slug, payload) | Submission approval | Create instance from approved submission |
SDK Types
ResourceTypeRegistration
ResourceInstance
Security: Do not store secrets, credentials, or PII in the Metadata field. Metadata is propagated to all gateways via config snapshots, cached in database join tables, and may appear in logs or be accessible to other plugins with access to the app configuration.
ResourceFormComponent
Privacy Scoring
WhenHasPrivacyScore is true, each resource instance carries a privacy score (0-100). The platform enforces a generalized rule during app creation and updates:
No resource privacy score may exceed the maximum LLM privacy score in the app.This applies to both built-in datasources and plugin resources. For example:
| Resource | Privacy Score | Result |
|---|---|---|
| LLM “GPT-4 Enterprise” | 80 | Max LLM score = 80 |
| Datasource “Internal DB” | 60 | OK (60 <= 80) |
| Plugin resource “MCP Server A” | 70 | OK (70 <= 80) |
| Plugin resource “MCP Server B” | 90 | Rejected (90 > 80) |
PrivacyScore field in ResourceInstance. Admins review and approve these scores through the submission workflow.
Access Control
Plugin resource instances use direct group mapping instead of the catalogue pattern used by built-in types. This is simpler and sufficient since plugins organize their own resources.Access Chain
Admin Workflow
- Admin navigates to Teams (Groups) in the admin UI
- Opens a group and scrolls to the Plugin Resources section
- For each registered resource type, selects which instances this group can access
- Saves the group
User Experience
When a user creates an App, they only see resource instances accessible via their group memberships. Admins bypass this filter and see all instances.Custom Form Components
For richer selection UX, plugins can provide a Web Component instead of the platform’s standard multi-select. Declare it in theFormComponent field:
Injected Properties
| Property | Type | Description |
|---|---|---|
data-selected-ids | JSON string[] | Currently selected instance IDs |
data-app-id | string | App ID (empty on create) |
data-mode | "create" or "edit" | Form mode |
pluginAPI.call(method, payload) | function | Make RPC calls to your plugin backend |
pluginAPI.listInstances() | function | List available instances |
Events to Dispatch
| Event | Detail | Description |
|---|---|---|
selection-change | { selectedIds: string[] } | Dispatch when user changes selection |
Example Web Component
Expandable
Gateway Integration
Plugin resource associations are included in the config snapshot sent to gateways. EachAppConfig includes a plugin_resources field:
plugin_resources field.
Community Submissions
WhenSupportsSubmissions is true, community users can submit new resource instances through the existing submission workflow:
- User fills out a submission form with
resource_type: "plugin"and aplugin_resource_type_id - The
resource_payloadcontains plugin-defined JSON describing the new instance - Admin reviews the submission (including a suggested privacy score)
- On approval, the platform calls the plugin’s
CreateResourceInstance()with the payload - The plugin creates the instance and returns its ID
- The instance becomes available for selection in the App form
Manifest Reference
Expandable
| Field | Required | Default | Description |
|---|---|---|---|
slug | Yes | - | Machine-readable identifier, unique per plugin |
name | Yes | - | Human-readable display name |
description | No | "" | Description shown in the App form |
icon | No | "" | Material icon name or plugin asset path |
has_privacy_score | No | false | Whether instances carry privacy scores |
supports_submissions | No | false | Whether community submissions are enabled |
form_component | No | null | Custom Web Component for the App form (null = standard multi-select) |
API Endpoints
These endpoints are available for frontend integration:| Method | Path | Description |
|---|---|---|
GET | /api/v1/plugin-resource-types | List all active registered resource types |
GET | /api/v1/apps/:id/plugin-resources | Get plugin resources for an app |
GET | /api/v1/groups/:id/plugin-resources | Get plugin resource access for a group |
PUT | /api/v1/groups/:id/plugin-resources | Set plugin resource access for a group (admin) |
Set Group Plugin Resources
Combining with Other Capabilities
Resource Provider plugins often combine with other capabilities for a complete solution:| Combination | Purpose |
|---|---|
| ResourceProvider + UIProvider | Admin UI for managing resource instances |
| ResourceProvider + PortalUIProvider | Portal self-service for resource browsing |
| ResourceProvider + CustomEndpointHandler | Gateway proxy for resource access (e.g., MCP proxy) |
| ResourceProvider + EdgePayloadReceiver | Aggregate analytics from gateway resource usage |
| ResourceProvider + ConfigProvider | Admin-configurable plugin settings |
Example: Complete MCP Registry Plugin
Expandable