Marketplace examples

:::danger Marketplace availability

Nexo does not currently offer a supported public marketplace, public plugin SDK/package or language guarantee, live publishing service, commercial program, review SLA, analytics/ranking service, or marketplace legal terms. Material labeled Legacy/illustrative preserves the retired dashboard documentation for parity; it is not a product promise, API contract, price, policy, or legal agreement.

:::

How to use these examples

The three retired examples below use the retired native Go SDK (github.com/nexo-proxy/plugin-sdk-go) and its contexts/results. They are preserved for design parity, not as buildable public samples. Porting requires choosing either the current release-bundled protobuf step contract or the repository-local WASM experiment, then reworking manifests, actions, contexts, configuration, tests, and packaging.

Sample 1: Request Logger

The example logs request metadata, optionally includes BSON bodies, filters commands, supports JSON/pretty output, and demonstrates configuration validation and tests. Body logging may expose credentials, PII, secrets, and regulated data; it should be disabled by default and governed by retention/redaction policy.

Sample 2: IP Allowlist

The example supports allow/deny modes, CIDR parsing, client-address matching, logging, rejection with MongoDB-compatible error information, configuration variants, and tests. A plugin check must not replace network policy, firewalling, authentication, or current verified-principal controls. Fail closed on malformed addresses and protect trusted proxy/header boundaries.

Sample 3: Query Complexity Analyzer

The example assigns costs to query operators, depth, fields, $lookup, $group, $unwind, sorting, regex, JavaScript, and document size; returns a breakdown; and can warn or reject above a threshold. Scores are heuristics, not query plans or a supported security boundary. Test against representative BSON and bound recursive parsing.

Repository-local TinyGo rate limiter

A direct local sample imports the internal Azure DevOps SDK, parses max_requests_per_second, defaults to 100, keys a plugin KV counter by client address, applies a one-second TTL, emits counters/logs, and rejects above the limit. It demonstrates local SDK calls but does not establish public package availability, distributed accuracy, atomic increments, production fairness, or marketplace installability.

// Package main implements a simple per-client rate limiter as a Nexo plugin.
//
// Build: tinygo build -o rate-limiter.wasm -target=wasi -scheduler=none ./
package main

import (
	"encoding/binary"
	"encoding/json"
	"time"

	"dev.azure.com/nexo-io/Nexo/nexo-cli.git/sdk/go/nexo"
)

// Config holds the plugin's JSON configuration.
type Config struct {
	MaxRequestsPerSecond int `json:"max_requests_per_second"`
}

// RateLimiter implements nexo.NexoPlugin.
type RateLimiter struct {
	nexo.BasePlugin
	maxRPS int
}

func (r *RateLimiter) Init(config []byte) error {
	var cfg Config
	if err := json.Unmarshal(config, &cfg); err != nil {
		return err
	}
	r.maxRPS = cfg.MaxRequestsPerSecond
	if r.maxRPS <= 0 {
		r.maxRPS = 100 // default
	}
	nexo.Log(nexo.LevelInfo, "rate-limiter initialized: max %d req/s", r.maxRPS)
	return nil
}

func (r *RateLimiter) OnRequest(ctx *nexo.RequestContext) nexo.Action {
	key := "rl:" + ctx.ClientAddr()

	// Read current counter from KV
	data := nexo.KVGet(key)
	var count int64
	if data != nil && len(data) == 8 {
		count = int64(binary.LittleEndian.Uint64(data))
	}

	count++
	if count > int64(r.maxRPS) {
		nexo.Counter("rate_limiter.rejected", 1)
		ctx.SetError("rate limit exceeded")
		ctx.Log(nexo.LevelWarn, "rate limit exceeded for %s (%d > %d)", ctx.ClientAddr(), count, r.maxRPS)
		return nexo.Reject
	}

	// Store updated count with 1-second TTL
	buf := make([]byte, 8)
	binary.LittleEndian.PutUint64(buf, uint64(count))
	nexo.KVSet(key, buf, 1*time.Second)

	nexo.Counter("rate_limiter.allowed", 1)
	return nexo.Continue
}

func main() {
	nexo.Register(&RateLimiter{})
}

Related pages

• Step contract reference — authoritative protobuf/gRPC contract definition.
• Plugin SDK and contract reference — current contract families, actions, opcodes, and WASM interface.
• Developer guide — lifecycle, manifests, hooks, and security guidance.
• nexoctl commands — scaffold, validate, test, and publish reference.
• Publishing and policy — manifest fields and current limitations.
• Support — how to report issues.