Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .claude-plugin/marketplace.json
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,9 @@
"name": "display-dev",
"source": {
"source": "github",
"repo": "display-dev/skill"
"repo": "display-dev/claude-plugin"
},
"description": "Publish, browse, search, read, edit, and share HTML or Markdown artifacts with public, private, or company-authenticated access. Includes Visualize, the display.dev MCP server, and /display-dev:feedback for reviewer comments.",
"version": "0.9.0",
"author": {
"name": "display.dev",
"url": "https://display.dev"
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:

- name: Version equality across release metadata
# Single source of truth is SKILL_VERSION in
# display-dev/scripts/_common.sh. Every manifest version field and
# display-dev/scripts/_common.sh. Every local manifest version field and
# the Codex .mcp.json X-Client-Source suffix must match it, so a
# release bump can't half-land across the hand-authored files.
run: |
Expand All @@ -84,7 +84,6 @@ jobs:
}
check "$(jq -r .version .cursor-plugin/plugin.json)" .cursor-plugin/plugin.json
check "$(jq -r .version .claude-plugin/plugin.json)" .claude-plugin/plugin.json
check "$(jq -r '.plugins[0].version' .claude-plugin/marketplace.json)" .claude-plugin/marketplace.json
check "$(jq -r '.mcpServers["display-dev"].headers["X-Client-Source"]' .claude-plugin/plugin.json | sed 's/.*@//')" '.claude-plugin/plugin.json (X-Client-Source)'
check "$(grep -oE 'display-dev-claude-plugin@[0-9]+\.[0-9]+\.[0-9]+' claude/commands/feedback.md | sort -u | sed 's/.*@//')" claude/commands/feedback.md
check "$(jq -r .version codex/display-dev/.codex-plugin/plugin.json)" codex/display-dev/.codex-plugin/plugin.json
Expand Down
5 changes: 4 additions & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -196,11 +196,14 @@ or delete them as part of routine publishing.

- `.cursor-plugin/plugin.json`
- `.claude-plugin/plugin.json`
- `.claude-plugin/marketplace.json`
- `display-dev/SKILL.md` (every embedded `display-dev-skill@<version>` attribution literal)
- `codex/display-dev/.codex-plugin/plugin.json`
- `codex/display-dev/.mcp.json` (the `display-dev-codex-plugin@<version>` suffix in `X-Client-Source`)
- `.claude-plugin/plugin.json` `mcpServers` (the `display-dev-claude-plugin@<version>` suffix in `X-Client-Source`)
- `claude/commands/feedback.md` (every `display-dev-claude-plugin@<version>` literal)

For local testing without editing the file, set `SKILL_VERSION_OVERRIDE` in your environment.

The Claude marketplace entry points to `display-dev/claude-plugin`. Its version
comes from that repository's plugin manifest; do not copy the skill package
version into `.claude-plugin/marketplace.json`.
37 changes: 6 additions & 31 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,37 +17,12 @@ npx skills add display-dev/skill --skill display-dev
/plugin install display-dev@display-dev
```

Then run `/mcp` and complete OAuth for `plugin:display-dev:display-dev`. The
Claude Code plugin contains:

- the display.dev skill;
- the [Visualize](https://github.com/display-dev/visualize) skill for on-brand
HTML reports, plans, and decks (a pinned release, see `claude/visualize.lock`);
- the remote MCP server (`https://api.display.dev/v1/mcp`);
- `/display-dev:feedback`: lists your artifacts with open comments, shows a
plan for each thread, and after you approve it, edits the artifact, replies,
and resolves the threads;
- a hook that scans a publish for secrets (API keys, tokens, private keys). It
blocks a public publish and asks before any other publish;
- a hook that tells you at session start which of your artifacts have new
comments. It reads only the open-thread counts, not the comment text.

The hooks need the `dsp` CLI for the comment note and run in Claude Code and
in Cowork on your own computer. Claude.ai loads the skills and the command but
not the hooks. There, connect the display.dev connector for the tools. If you
also turned on the display.dev connector in Claude Code, the agent sees two
sets of display.dev tools and uses one of them.

#### What the Claude Code plugin runs and sends

| Part | Runs | Sends or fetches | Stores |
|---|---|---|---|
| display.dev skill | The bundled helper scripts, the installed `dsp` CLI, and a bundled `jq` binary for JSON | Requests to `api.display.dev` for the actions you ask for. An anonymous publish sends the file to `https://api.display.dev/v1/public/artifacts`. | Nothing. `dsp` keeps its own sign-in. |
| MCP server | Nothing on your machine | Tool calls to `https://api.display.dev/v1/mcp` after you sign in with OAuth, with the header `X-Client-Source: display-dev-claude-plugin@<version>` | Nothing |
| Publish guard hook | `claude/hooks/publish-guard.sh` before each Bash command and each display.dev `publish` tool call | Nothing. It reads only the files named in a publish command, or the `content` of an MCP publish, and checks them for secrets on your machine. | Nothing |
| Comment note hook | `claude/hooks/comment-digest.sh` at session start, only when `dsp` is installed | One request through `dsp` to `api.display.dev`: your 100 most recently updated artifacts with their names and open-thread counts. It never fetches comment text. | The open-thread count and name of each of your artifacts with open threads, in Claude Code's plugin data folder (`open-thread-counts.json`) |
| `/display-dev:feedback` | `dsp` commands or MCP tool calls | Reads the metadata, open comments, and source of the artifact you choose. After you approve the plan, publishes the new version and posts replies and resolves to `api.display.dev`. | A temporary copy of the artifact source while it edits |
| Visualize skill | Local scripts for brand capture, checks, and rendering. Mermaid diagrams run `@mermaid-js/mermaid-cli@11.12.0` through `npx`. | Nothing by default. Only when you explicitly choose OpenAI or Google for image generation, it reads `OPENAI_API_KEY` or `GEMINI_API_KEY` from your environment and sends the image brief and any reference images to `api.openai.com` or `generativelanguage.googleapis.com`. Publishing goes through display.dev. | The HTML files it writes in your project |
Then run `/mcp` and complete OAuth for `plugin:display-dev:display-dev`.

The marketplace installs the Display plugin from
[`display-dev/claude-plugin`](https://github.com/display-dev/claude-plugin).
Its [README](https://github.com/display-dev/claude-plugin#readme) documents the
bundled skills, MCP server, hooks, commands, and what they run, fetch, and store.

### Codex – plugin (skill + bundled MCP server)

Expand Down
Loading