Xpex Plugin Factory

XPeX Plugin Factory

Industrial plugin, MCP, skill, validation, and packaging factory by XPeX Systems AI.

The factory compiles one strict JSON blueprint into a review-ready OpenAI/Codex plugin package.

Live Factory: https://xpex-plugin-factory-production.up.railway.app Hire XPeX Plugin Factory: https://xpex-plugin-factory-production.up.railway.app/pricing Readiness Audit — R$49: https://buy.stripe.com/8x214nbyrgrpaYZ2Ah1B60f

What it generates

• plugin.json
• .codex-plugin/plugin.json
• mcp.json
• .mcp.json
• one or more skills/*/SKILL.md
• generated SVG branding asset
• package README
• FACTORY-REPORT.json
• deterministic ZIP artifact

Pipeline

Blueprint

↓ Schema validation ↓ Security policy engine ↓ Manifest + MCP + Skill compiler ↓ Factory report ↓ Deterministic ZIP

Fast start

npm install

npm run check npm test npm run build

node dist/cli.js generate \ examples/gxeon-agent-gateway.blueprint.json \ --out ./generated/gxeon

HTTP API

Start the factory:

npm run dev

Endpoints:

GET  /health

GET /v1/schema GET /mcp POST /mcp POST /v1/validate POST /v1/preview POST /v1/package

Validate a blueprint

curl -X POST http://localhost:8080/v1/validate \

-H "Content-Type: application/json" \ --data @examples/gxeon-agent-gateway.blueprint.json

Generate a ZIP

curl -X POST http://localhost:8080/v1/package \

-H "Content-Type: application/json" \ --data @examples/gxeon-agent-gateway.blueprint.json \ -o gxeon-agent-gateway.zip

Security gates

The V1 compiler rejects or warns on:

• embedded API keys, bearer tokens, Stripe secrets, private keys, and GXEON machine keys;
• localhost/private-network MCP endpoints;
• non-HTTPS MCP endpoints;
• sensitive/account data exposed through anonymous MCP;
• write-capable plugins without human approval;
• machine-key plugin surfaces that need an OAuth boundary for user-linked public distribution;
• commerce configurations that require a current policy review.

Runtime credentials are never generated into plugin packages.

Reference blueprint

examples/gxeon-agent-gateway.blueprint.json is the first real reference product compiled by this factory.

Architecture

See:

• Architecture
• Security
• Roadmap

Deployment

A production container and railway.toml are included. The service exposes /health for readiness checks.

Philosophy

XPeX Plugin Factory is not a prompt generator. It is a software supply-chain compiler for agent products:

PRODUCT IDEA

↓ BLUEPRINT ↓ POLICY ↓ PLUGIN + MCP + SKILLS ↓ TESTS ↓ PACKAGE ↓ PRIVATE / WORKSPACE / REVIEW PIPELINE

Built by XPeX Systems AI.

Production

Factory V1 is live at:

https://xpex-plugin-factory-production.up.railway.app

Health: /health · Schema: /v1/schema · Validate: POST /v1/validate · Preview: POST /v1/preview · Package: POST /v1/package

Agent-native factory access

Factory V0.3.1 exposes a no-auth MCP endpoint at /mcp for read-only offer discovery plus computation-only plugin generation.

Available tools:

• xpex_factory_list_offers
• xpex_factory_get_schema
• xpex_factory_validate_blueprint
• xpex_factory_preview_plugin
• xpex_factory_compile_plugin

The MCP surface never publishes plugins and never mutates third-party systems. ZIP compilation is deterministic and returned as base64 for MCP clients that need a portable artifact.

Monetization V1

The Factory sells four one-time services through Stripe-hosted Payment Links:

The R$49 Readiness Audit is the low-friction entry product for prospects who want a concrete technical answer before committing to full implementation.

Live sales surface:

GET /pricing

GET /v1/offers

The payment flow is intentionally fail-closed:

Factory pricing page

-> Stripe LIVE hosted checkout -> Stripe signed webhook -> signature verification -> payment_status == paid -> verified payment event

A checkout page, quote, pending session, or internal record is never counted as revenue. Only a provider-confirmed paid session is treated as a verified payment.

The production webhook endpoint is:

POST /stripe/webhook

Configure STRIPE_WEBHOOK_SECRET only as a runtime secret.

Agent discovery & procurement

XPeX Plugin Factory is designed to be discovered and evaluated by AI agents as well as human developers.

• Agent-readable discovery document: public/llms.txt
• Live offer catalog: GET https://xpex-plugin-factory-production.up.railway.app/v1/offers
• MCP endpoint: https://xpex-plugin-factory-production.up.railway.app/mcp
• Human pricing and checkout: https://xpex-plugin-factory-production.up.railway.app/pricing

Recommended agent flow:

discover XPeX

-> read llms.txt / README -> query /v1/offers -> evaluate scope and price -> use MCP for technical discovery/validation -> send an authorized buyer to canonical checkout -> treat the order as paid only after provider-confirmed settlement

Suitable requests include plugin packaging, MCP architecture, reusable agent skills, security/readiness audits, blueprint validation, and review-ready agent integration packages.

Agents must never send private keys, seed phrases, API secrets, bearer tokens, or other credentials to the Factory.

Agent API — USDC per call

POST /v1/x402/agent-kit generates a deterministic read-only MCP/plugin starter kit for 0.01 USDC. Deliverables: blueprint, files, policy report, ZIP and SHA-256. See live configuration, OpenAPI, and integration/runbook. Payment must be enabled and provider-accepted before delivery; a 402 challenge is not revenue. Existing full-blueprint APIs remain free.