io.github.xpex-systems-ai/xpex-plugin-factory

XPeX Plugin Factory

Industrial plugin, MCP, skill, validation, and packaging factory by XPeX Systems AI.

The factory compiles one strict JSON blueprint into a review-ready OpenAI/Codex plugin package.

Live Factory: https://xpex-plugin-factory-production.up.railway.app
Hire XPeX Plugin Factory: https://xpex-plugin-factory-production.up.railway.app/pricing
Readiness Audit — R$49: https://buy.stripe.com/8x214nbyrgrpaYZ2Ah1B60f

What it generates

• plugin.json
• .codex-plugin/plugin.json
• mcp.json
• .mcp.json
• one or more skills/*/SKILL.md
• generated SVG branding asset
• package README
• FACTORY-REPORT.json
• deterministic ZIP artifact

Pipeline

Blueprint
   ↓
Schema validation
   ↓
Security policy engine
   ↓
Manifest + MCP + Skill compiler
   ↓
Factory report
   ↓
Deterministic ZIP

Fast start

npm install
npm run check
npm test
npm run build

node dist/cli.js generate \
  examples/gxeon-agent-gateway.blueprint.json \
  --out ./generated/gxeon

HTTP API

Start the factory:

npm run dev

Endpoints:

GET  /health
GET  /v1/schema
GET  /mcp
POST /mcp
POST /v1/validate
POST /v1/preview
POST /v1/package

Validate a blueprint

curl -X POST http://localhost:8080/v1/validate \
  -H "Content-Type: application/json" \
  --data @examples/gxeon-agent-gateway.blueprint.json

Generate a ZIP

curl -X POST http://localhost:8080/v1/package \
  -H "Content-Type: application/json" \
  --data @examples/gxeon-agent-gateway.blueprint.json \
  -o gxeon-agent-gateway.zip

Security gates

The V1 compiler rejects or warns on:

• embedded API keys, bearer tokens, Stripe secrets, private keys, and GXEON machine keys;
• localhost/private-network MCP endpoints;
• non-HTTPS MCP endpoints;
• sensitive/account data exposed through anonymous MCP;
• write-capable plugins without human approval;
• machine-key plugin surfaces that need an OAuth boundary for user-linked public distribution;
• commerce configurations that require a current policy review.

Runtime credentials are never generated into plugin packages.

Reference blueprint

examples/gxeon-agent-gateway.blueprint.json is the first real reference product compiled by this factory.

Architecture

See:

• Architecture
• Security
• Roadmap

Deployment

A production container and railway.toml are included. The service exposes /health for readiness checks.

Philosophy

XPeX Plugin Factory is not a prompt generator. It is a software supply-chain compiler for agent products:

PRODUCT IDEA
   ↓
BLUEPRINT
   ↓
POLICY
   ↓
PLUGIN + MCP + SKILLS
   ↓
TESTS
   ↓
PACKAGE
   ↓
PRIVATE / WORKSPACE / REVIEW PIPELINE

Built by XPeX Systems AI.

Production

Factory V1 is live at:

https://xpex-plugin-factory-production.up.railway.app

Health: /health · Schema: /v1/schema · Validate: POST /v1/validate · Preview: POST /v1/preview · Package: POST /v1/package

Agent-native factory access

Factory V0.3.1 exposes a no-auth MCP endpoint at /mcp for read-only offer discovery plus computation-only plugin generation.

Available tools:

• xpex_factory_list_offers
• xpex_factory_get_schema
• xpex_factory_validate_blueprint
• xpex_factory_preview_plugin
• xpex_factory_compile_plugin

The MCP surface never publishes plugins and never mutates third-party systems. ZIP compilation is deterministic and returned as base64 for MCP clients that need a portable artifact.

Monetization V1

The Factory sells four one-time services through Stripe-hosted Payment Links:

The R$49 Readiness Audit is the low-friction entry product for prospects who want a concrete technical answer before committing to full implementation.

Live sales surface:

GET /pricing
GET /v1/offers

The payment flow is intentionally fail-closed:

Factory pricing page
  -> Stripe LIVE hosted checkout
  -> Stripe signed webhook
  -> signature verification
  -> payment_status == paid
  -> verified payment event

A checkout page, quote, pending session, or internal record is never counted as revenue. Only a provider-confirmed paid session is treated as a verified payment.

The production webhook endpoint is:

POST /stripe/webhook

Configure STRIPE_WEBHOOK_SECRET only as a runtime secret.

Agent discovery & procurement

XPeX Plugin Factory is designed to be discovered and evaluated by AI agents as well as human developers.

• Agent-readable discovery document: public/llms.txt
• Live offer catalog: GET https://xpex-plugin-factory-production.up.railway.app/v1/offers
• MCP endpoint: https://xpex-plugin-factory-production.up.railway.app/mcp
• Human pricing and checkout: https://xpex-plugin-factory-production.up.railway.app/pricing

Recommended agent flow:

discover XPeX
  -> read llms.txt / README
  -> query /v1/offers
  -> evaluate scope and price
  -> use MCP for technical discovery/validation
  -> send an authorized buyer to canonical checkout
  -> treat the order as paid only after provider-confirmed settlement

Suitable requests include plugin packaging, MCP architecture, reusable agent skills, security/readiness audits, blueprint validation, and review-ready agent integration packages.

Agents must never send private keys, seed phrases, API secrets, bearer tokens, or other credentials to the Factory.

Agent API — USDC per call

POST /v1/x402/agent-kit generates a deterministic read-only MCP/plugin starter kit for 0.01 USDC. Deliverables: blueprint, files, policy report, ZIP and SHA-256. See live configuration, OpenAPI, and integration/runbook. Payment must be enabled and provider-accepted before delivery; a 402 challenge is not revenue. Existing full-blueprint APIs remain free.