Declarative plugins have no code
Their actions call an HTTP API or a Volath function when an event happens. Pick this style when it is enough: there is no plugin code to trust.
Plugins and marketplace
AI coding agent plugins and marketplace for Volath
AI coding agent plugins extend Volath with your own page, board widgets, automations or integrations, without changing Volath. An administrator installs a plugin from a zip, reads what it asks for in plain words, and accepts it before it runs.
What a plugin is
What an AI coding agent plugin is
A plugin is a zip with a plugin.json at its root and, optionally, one Node file and a web page. There are two styles.
Code plugins use a Node file
A code plugin is one CommonJS Node file that exports hooks and talks to Volath through a single ctx object. It can also bring a web page of its own.
An administrator installs it from a zip
Installing and managing plugins is done by an administrator in Settings, Plugins. A new plugin stays off until its permissions are accepted.
What plugins can do
What Volath plugins can do
React to what happens, act on your work, show pages inside the app and talk to outside systems.
React to events, schedules and outside systems
About 28 named events such as ticket.status_changed, pr.opened, ci.failed and ticket.created, a change of any database row, a schedule of at least one minute, and calls from outside systems.
Act on tickets, projects, workflows and more
Tickets, projects, workflows, developers, users, agents, skills, squads, documents, ticket templates, board views, custom fields, webhooks and notifications. Analyze, develop, pull request, tests and merge still follow approval gates, budgets and workflow steps.
Add pages and widgets in six places
One page of its own plus up to 20 slots in the top bar, menu, board, ticket tab, ticket panel and project tab. Pages and widgets follow the app's light and dark theme.
Receive and send webhooks
A plugin gets its own webhook addresses that other systems can call, with a secret Volath generates. It can also create webhooks that send Volath events elsewhere.
Add to the AI prompts
Text added at the end of the analysis, development, review, pull request description, merge conflict, live test and release notes prompts, in a block marked as added by the plugin. It never replaces the base prompt.
Supply workflows to the catalog
A plugin can publish a workflow to the workflow catalog or apply one to a project. Catalog entries from plugins are marked as coming from the plugin.
Settings, set once or per project
Text, password, number, toggle and select fields, validated when saved. A password is stored encrypted and never exported. Values can be set for every project or for one project, and exported and imported as JSON without secrets.
Safe by design
Sandboxed plugins you approve before they run
Every call a plugin makes goes through Volath, which checks it against what the administrator accepted.
Code runs in a separate process
Plugin code runs in its own Node process with Node's permission model: no child processes, workers, native addons or file access outside the plugin's folder, and 256 MB of memory. None of Volath's environment reaches it, so tokens and keys stay out. This needs Node 22 or newer; without it the code is refused unless you turn the sandbox off, and the app then says so.
Permissions in plain words, accepted by an administrator
The install screen lists what a plugin asks for in plain words. A plugin stays off until an administrator accepts it, and a new version that asks for more stays off until it is accepted again.
Limits on how much a plugin can do
A plugin does not receive events its own changes caused, is limited to 120 changes a minute, and a call times out after 60 seconds. A plugin that crashes five times in ten minutes is switched off.
Things a plugin can never do
Delete tickets, projects or custom fields, read project or ticket settings because they hold credentials, change anyone's email or password, or create sign-in accounts. A person's email never reaches a plugin.
Everything a plugin creates says so
Tickets, projects and the rest show a "from plugin X" badge. Uninstalling a plugin deletes the plugin, its settings and its stored data, and what it created stays.
Warnings at install, never a block
The install screen warns when a plugin looks like it reimplements a feature of a paid plan, or asks for admin access or a wildcard network host.
An honest limit: trust the people who write the code
Node cannot close the network for a process, so plugin code could open a connection without going through Volath. Install plugin code only from people you trust. Declarative plugins have no code.
Staying in control
Keep control of every plugin you run
Each plugin has a source, a health view, logs and an update path you can undo.
Know where a plugin came from
Every plugin says whether it came from the marketplace or from a zip, which is not reviewed by Volath.
Health at a glance
Restarts, last crashes, calls, failed calls, average and slowest time, memory, CPU and uptime.
Logs you can read and download
What the plugin wrote and the calls it made, with filters, search, download and clear.
Update, compare permissions, roll back
A marketplace plugin shows an update. The dialog compares permissions: a version that asks for more stays off until accepted, and settings are kept. Roll back restores the previous version from the kept zip.
Marketplace only and auto-update policy
Administrators can refuse zip installs, and can let marketplace plugins update every 24 hours only when the new version asks for nothing more.
Plugin marketplace
How the plugin marketplace works
The marketplace is a list of official plugins you can install from the app, in Settings, Plugins, Marketplace.
Cards that say what a plugin asks for
Each card shows logo, name, version, author and description, a search, and what the plugin asks for in plain words, with warnings. Installing goes on to the same approval screen as a zip.
Every install is checked
A download must carry a sha256 that matches the list, and the package must have the id of the entry, or the install is refused.
The list comes from a GitHub release
Volath reads the latest GitHub release of volath/marketplace and caches it for 10 minutes. If it cannot be reached, the last list is shown with a warning.
You never need the marketplace
Any plugin is a zip that an administrator can install from Settings, Plugins. A pull request adds a plugin to the marketplace; it needs a logo and readable source, and may not reimplement a feature of a paid plan.
Official plugins
Six official plugins to install or build on
Install them from the marketplace, or open their source and use them as the starting point for your own plugin.
hello-dashboard
An example. Posts merged tickets to an external dashboard and lists them on its own page.
project-bootstrap
Adds a default developer and a custom field to every new project.
project-workflow
Gives new projects the local workflow.
ticket-mirror
An example. Creates the same ticket in another system.
ticket-triage
Fills a field, comments and notifies the team on a new ticket.
ui-slots
Shows every place a plugin can put a widget, so you can see them before you build one.
Build your own
Build a plugin with AI and the plugin SDK
The SDK tool is the same validator and test runner the app uses. It has four commands.
new: start a plugin folder
Run npx @volath/sdk new my-plugin. Creates a folder with plugin.json, code, a README and an AGENTS.md.
validate: run the check Volath runs on install
Run npx @volath/sdk validate my-plugin. Uses the same validator the app runs when a plugin is installed.
test: run it like Volath would
Run npx @volath/sdk test my-plugin. Starts the plugin like Volath and sends it sample events. It prints the HTTP requests a plugin would make instead of sending them, unless you ask it to send them.
pack: write the zip
Run npx @volath/sdk pack my-plugin. Validates the plugin and writes my-plugin-version.zip, ready for an administrator to install.
Plugin SDK
What the plugin SDK gives you
The SDK is a public GitHub repository, the kit for writing a plugin.
TypeScript types and a JSON Schema
Types for ctx, events and hooks, and a JSON Schema for plugin.json. They are generated from the app's own API description, so they cannot drift from what Volath accepts.
An AI guide for your assistant
A reference and an AI guide meant to be handed to an AI assistant, plus the six example plugins.
Build with AI, inside the app
The Build with AI dialog in Settings, Plugins lets you describe the plugin, copy the prompt and the full plugin guide into an AI chat, check the files it returns with the SDK tool, and drop the zip.
A guide in the Help center
The plugin guide is in the app's Help center under Writing plugins.
Open source kit
The SDK and the marketplace are MIT licensed
Volath itself is not open source. Only these two repositories are.
volath/sdk
The validator, test runner, types, schema, reference, AI guide and example plugins.
volath/sdk on GitHubvolath/marketplace
The official plugins, the contribution rules and the release the app reads its list from.
volath/marketplace on GitHub
Plugins and your plan
How plugins and your plan work together
Installing plugins is not tied to a plan. What a plugin may call follows your plan.
Plugin calls follow your plan, per call
Calls to tickets and actions need the board, while agents, skills, squads and documents each need their own module, and webhooks need the webhooks tool. A plugin cannot use what your plan does not include.
A plan change needs no reinstall
A plan that ends or changes takes effect without reinstalling the plugin.
Installing is not tied to a plan
Installing and managing plugins needs an administrator, not a particular plan. The plans themselves are on the pricing page.
FAQ
Plugin questions
What is a Volath plugin?
A plugin extends Volath with your own page, board widgets, automations or integrations, without changing Volath. It is a zip with a plugin.json and, optionally, one Node file and a web page. An administrator installs it in Settings, Plugins.
Are Volath plugins safe to run?
Plugin code runs in a separate process with Node's permission model, and every call is checked against the permissions an administrator accepted. A plugin stays off until they are accepted. Node cannot close the network for a process, so install plugin code only from people you trust. Declarative plugins have no code.
Do I need the marketplace to install a plugin?
No. Any plugin is a zip that an administrator can install from Settings, Plugins. The marketplace is a list of official plugins, and installs from it are checked with a sha256.
Can I build my own plugin for a tool I use?
Yes. The six official plugins are small and readable, and several are examples that point at example hosts, so you can copy one and change the host and the events. A declarative plugin calls an HTTP API when an event happens, with no plugin code.
Do plugins depend on my plan?
Calls a plugin makes follow your plan, one call at a time, so a plugin cannot use a feature your plan does not include. Installing plugins is not tied to a plan, and a plan change takes effect without reinstalling.
Can I build my own plugin with AI?
Yes. The Build with AI dialog in Settings, Plugins gives you a prompt and the full plugin guide to hand to an AI chat. The plugin SDK then checks the files it returns with validate and test, and pack writes the zip.
Is Volath open source?
No. Only the plugin SDK and the plugin marketplace are MIT licensed, as public GitHub repositories. Volath itself is not open source.
Extend Volath your way
Start with a plugin from the marketplace, or write your own with the SDK.