518.PLUS

518.PLUS

An MCP tool marketplace.

Discover and call tools through one MCP endpoint. Process files, text or JSON, share the results, and publish your own tools.

Website · Connect your agent · Publish a tool

English · 简体中文

What it is

Connect your agent

Two ways to connect — pick one:

Sign in with OAuth: add the server URL to an OAuth-capable MCP client. When prompted, sign in to your 518 account or create one, then approve the requested permissions. The client manages its OAuth tokens.

claude mcp add --transport http 518-plus https://518.plus/mcp

Use an API key: sign in to your existing account and create or reveal a key at 518.plus/account/keys. An agent that needs its own new account can register over HTTPS:

curl -s -X POST https://518.plus/auth/mcp/register -H "Content-Type: application/json" -d '{}'
# → {"ok":true,"username":"agent_…","password":"…","key":{"key":"fsk_…",…}}
# save the username and password; use key.key as the Bearer credential

Then send Authorization: Bearer fsk_YOUR_API_KEY on every request:

{
  "mcpServers": {
    "518-plus": {
      "type": "http",
      "url": "https://518.plus/mcp",
      "headers": { "Authorization": "Bearer fsk_YOUR_API_KEY" }
    }
  }
}

The same key works on the REST surface:

curl -s -X POST https://518.plus/v1/tools/compress \
  -H "Authorization: Bearer fsk_YOUR_API_KEY" \
  -H "Idempotency-Key: compress-request-1" \
  -F "file=@input.png"

GET /v1/tools lists the catalog; Idempotency-Key makes retries safe; body-input tools take the request body itself as input (Content-Type per the declaration).

Packaging a plugin or connector? Identify your OAuth client with CIMD (an HTTPS client metadata document) or DCR (POST /oauth/register); discovery starts at 518.plus/.well-known/oauth-authorization-server. Client registration records the application; it does not create a 518 account or grant access to one. The account owner separately approves the requested scopes: tools:call, files:read, files:delete.

MCP file inputs can be inline base64, HTTPS URLs or references; large files use a two-step upload. Executions and upload tickets require a stable client_ref: reuse it for retries of the same operation. Discovery and file-management tools use their declared arguments. The full agent guide is at 518.plus/llms.txt.

The Agent Plugin download, also linked on the homepage, contains the portable 518-plus plugin directory with plugin.json and mcp.json. Extract it and follow your client's Agent Plugins installation instructions. It connects to the same /mcp endpoint; use the OAuth or API-key access flow above. The package contains no account credentials.

Publish a tool

A published tool is an HTTPS endpoint that follows the tool contract. For file-input tools, 518 sends file metadata, fetch URLs and parameters:

{
  "files": [{ "filename": "a.png", "content_type": "image/png", "size": 1024, "url": "https://..." }],
  "params": { "quality": 80 }
}

To return an ordered list of text, JSON or file results, respond with Content-Type: application/vnd.518.items+json:

{
  "items": [
    { "kind": "text", "text": "Compressed 1 image" },
    { "kind": "file", "filename": "a.png", "content_type": "image/png", "data_b64": "..." }
  ]
}

Set a price in credits (1,000 credits = US$1). Failed calls are refunded to the user automatically. Your share of each paid call goes to your earnings balance, which you can withdraw. The full declaration and execution contract is in docs/publishing.md.

New tools are published unlisted (not in the public market). After you run your own tool successfully once, you can make it public from My tools — the platform does not review tools. Un-publishing is unrestricted.

Self-hosting

Requirements: Python 3.12, PostgreSQL 16, Gokapi v2.2.4, Nginx.

git clone https://github.com/samelabs/FlashShare.git && cd FlashShare
python3.12 -m venv venv && venv/bin/pip install -r requirements.txt
# set the environment variables listed in DEVELOPMENT.md, then:
venv/bin/python -m uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 1

The database schema is created on first start. Configuration, deployment and tests are covered in DEVELOPMENT.md.

Contributing

Read AGENTS.md for the architecture contracts and DEVELOPMENT.md for the local test stack. Pull requests must pass CI.

Security

Report vulnerabilities privately — see SECURITY.md.

License

AGPL-3.0