Offing Codex plugin submission

Offing is prepared as a desktop-only Codex plugin because its MCP server runs locally over stdio. Repository data remains on the user's computer, the tools are read-only, and no Offing account is required.

Release package

Build the review ZIP from canonical sources:

npm run package:codex-plugin

The command regenerates the package and writes artifacts/offing-codex-plugin-<version>.zip. The manifest, Skill, MCP configuration, approved icons, walkthrough image, license, README, and review fixture are all at the archive root.

Reviewer walkthrough

1. Install Node.js 22 or newer and extract the ZIP.
2. Confirm the plugin shows the Offing name, approved Offing mark, and Developer Tools category.
3. Copy review-fixtures/demo into a temporary directory and rename package.json.fixture to package.json in the copy. Ask Offing to scan that temporary path for end-of-life runtimes, packages, and GitHub Actions. Keep all edits and verification steps below in that copy.
4. Confirm the result reports the fixture's evidence-backed Node.js, request, and actions/checkout findings with exact file locations.
5. Ask for an explanation and migration context for the request finding. Confirm that source usages and evidence links appear and no files change.
6. Update the fixture workflow to actions/checkout@v5, ask Offing to verify the original finding, and confirm it is absent without executing suggested commands.
7. Run the three negative cases in review/submission.json and confirm Offing declines unrelated security auditing, states that Java lifecycle coverage is unsupported, and does not execute migration commands automatically.

Privacy and permissions

• The local MCP server reads repository files under the path authorized by the user.
• Results can include paths and short source excerpts and are returned to the host.
• Tools are read-only and do not edit files, run suggested commands, request credentials, or listen on a network port.
• The pinned npm package may be downloaded from the user's configured registry when first launched.
• See Privacy, Support, and Terms.

Submission status

OpenAI currently limits public submissions containing local MCP servers to approved partners. The submitting Platform organization must be identity-verified and allowlisted by an OpenAI representative before the ZIP can be uploaded through the plugin portal. Track allowlist confirmation, automated findings, reviewer feedback, approval, and publication in Issue #31.