[kikiyop1101]

Plugin Submission

Plugin information

• Author: boim
• Plugin name: boim
• Version: 0.0.1
• Source repository: https://github.com/kikiyop1101/boim-dify-plugin
• Contact: public-id@naver.com (also GitHub issues on the source repository)

Submission type

• New plugin
• Version update

What changed

Adds BOIM — Korean Business Finder, a tool plugin for Dify Agents, Chatflows and Workflows that finds businesses in South Korea from BOIM (boim.io), a read-only directory built on Korean government open data. Three tools:

• find_businesses — operating businesses of any industry (about 2.76 million nationwide, 247 sub-categories) by province/city/district (optionally a neighborhood) plus industry or part of a name. Name, industry and neighborhood only.
• search_vendors — 76,000+ vendor cards from Public Procurement Service data (contract items and the last 12 months of public deliveries), with National Tax Service business status and details businesses registered on BOIM.
• find_public_bids — open public tenders in all fields from KONEPS, Defense e-Procurement, LH, K-water and Nuri-jangteo, closest deadline first, with the original notice link.

Each call returns up to 5 results, the total count, a link to the full public list on boim.io and a citation line, as a readable text message plus BOIM's structured result as json. No API key, account or credentials. The order is relevance/alphabetical/deadline as documented — not a ranking, rating or paid placement. There are no purchase, payment or subscription actions.

The plugin is published by the operator of BOIM (Public identity Co., Ltd.), and this submission was prepared with an AI coding assistant (Claude Code) under the operator's review.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Medium risk is selected because the search arguments a user or model fills in (region, industry or item, business name or keyword, certification, bid type) are sent to an external service. Nothing else applies: no command or code execution, SQL, database or filesystem access, SSH/SFTP, browser automation, arbitrary URL fetching, proxying, uploaded files, write actions, or sensitive personal data.

Security boundary:

• Destination: one fixed HTTPS endpoint, https://boim.io/api/mcp (JSON-RPC tools/call), declared in manifest.yaml under network.domains. The URL is a constant in boim_client.py; inputs never change the host or path.
• Inputs: only the tool's own parameters are sent, each converted to a string and trimmed to 100 characters; the result limit is fixed at 5. No conversation text, user identifiers, files or Dify credentials are sent.
• Credentials: none (credentials_for_provider: {}).
• Timeouts and errors: 20-second timeout; HTTP errors, rate limits (403/429) and malformed responses become short, generic error messages without request data or stack traces.
• Data handling: the plugin stores and logs nothing. BOIM's server-side logging is described in PRIVACY.md and https://boim.io/privacy/. Results are public information from Korean government open data plus details that businesses chose to publish on BOIM; BOIM does not publish representative names, street addresses or business registration numbers. Results are data, not instructions.

Local validation

dify plugin package ./dify-plugin -o boim-0.0.1.difypkg      # dify CLI v0.6.12 → "plugin packaged successfully"
python validator/validate-difypkg.py boim-0.0.1.difypkg --output-dir ./validation-report --pr-body-file pr-body.md

dify-marketplace-toolkit (commit 57a21d1): exit code 0. Blocking checks all PASS (package_contents, package_secrets, package_binaries, manifest_metadata, readme_metadata, package_dependencies, python_compile). Warning-level checks PASS (python_safety, prohibited_financial_activity, access_domains — one outbound domain boim.io, dependency_vulnerabilities — 2 pinned, 0 unpinned, no known vulnerabilities).

Functional test with the real SDK (dify_plugin 0.10.2, Python 3.12): each tool's _invoke called against the live endpoint, 6 cases, all returned a text and a json message:

Tool	Input	Result
find_businesses	region 세종 보람동, category 미용실	36 found, 5 shown, list URL
find_businesses	region Seoul Gangnam-gu, category cafe	2,095 found, 5 shown
search_vendors	category 안내판, region 세종	32 found, 5 vendor cards with URLs
search_vendors	query zzzxxyy-nothing	0 found, source line
find_public_bids	category 청소, bid type 용역	160 found, notices with original links
find_public_bids	region 경기, category 안내판	0 found, guidance note

Reviewer notes

• Testing limitation: the plugin has not yet been installed on a Dify Community Edition or Dify Cloud instance through remote debugging; the tests above exercise the same Tool._invoke code path with the official SDK and live API. I will run a remote-debug install on Dify Cloud and post the result in this PR.
• The local validator was run on Windows, where os.access(..., X_OK) reports every extracted file as executable; the package itself stores no Unix mode bits (zip create_system 0) and contains no binaries or scripts with a shebang.
• readme/README_ko_KR.md is a Korean translation for Korean users; the primary README.md is English. If Korean is not a supported README locale, it simply falls back to English.
• Rate limits: very frequent calls in a short time can receive HTTP 429/403 from boim.io; the README explains this.

🤖 Generated with Claude Code

https://claude.ai/code/session_013TJ95F97xxwxFwnrmeaUrm

[kikiyop1101]

Dify Cloud test (remote debugging) — passed

Following up on the testing limitation in the description:

• Environment: Dify Cloud (cloud.dify.ai), Sandbox workspace, plugin run from the source repository (kikiyop1101/boim-dify-plugin, same code as the package) with dify_plugin 0.10.2 / Python 3.12 in remote-debug mode (debug.dify.ai:5003). Plugin log: Installed tool: boim.
• App: new Agent app with the three BOIM tools enabled (3/3), default model (gpt-5, workspace message credits), no other settings changed.
• Query: 세종 보람동 미용실 알려 줘 ("hair salons in Boram-dong, Sejong").
• Result: the agent called find_businesses with {"region": "세종 보람동", "category": "미용실"} and received 36 found / 5 shown, the full-list URL on boim.io, the data-source citation line and the note about contact details; the final answer listed the five businesses with their boim.io list URL. Tool round-trip 21.35 s.

For this test run only, the plugin's User-Agent was temporarily set to an internal value so the test was not counted as an outside AI read on boim.io; the published package uses boim-dify-plugin/0.0.1. The test app was not published, and the debug key was removed afterwards.

🤖 Generated with Claude Code

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the submitted package, documentation, and relevant source; this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.