Admin console · animated

Click to expand

Plugins

Route: /marketplace (sidebar: Account → Plugins)

The Plugins page lets you install outbound plugins that receive signed webhook events from Mushi Mushi, for example when a report is classified or a fix is requested. The page itself suggests Zapier and your own HTTPS endpoint; for Sentry, Linear, Jira or PagerDuty it points you to their cards on Integrations instead.

Tabs

The page has four tabs: Overview, Browse, Installed and Deliveries. Overview shows your installed plugins and how their deliveries are doing.

Browse

A card grid showing all plugins in the catalog. Each card shows:

• Plugin name, publisher, category, short description, version
• Install status — installed badge if already active
• Reliability stats — total dispatches, ok rate, avg latency (from the dispatch log)

Use the text search, category filter, and Installed only toggle to narrow the list.

Installed

The installed plugins list with per-plugin controls (see Actions below).

Deliveries

A dispatch log table showing the most recent outbound webhook calls. Filterable by plugin slug and status (ok, error, timeout). Use this to debug delivery problems or confirm an event fired.

Installing a plugin

1. Find the plugin on the Browse tab.
2. Click Install.
3. Fill in the install form:
   • Webhook URL — your endpoint that receives events
   • Signing secret (HMAC-SHA256): store it, it is shown only once; verify the X-Mushi-Signature header in your handler
   • Subscribed events: a comma-separated list of event names, or * for all
4. Click Install.

Managing installed plugins

Signing verification

Every outbound webhook includes an X-Mushi-Signature header of the form t=<unix ms>,v1=<hex>, where v1 is the HMAC-SHA256 of `${t}.${rawBody}` with your signing secret. Deliveries also carry the Standard Webhooks  headers (webhook-id, webhook-timestamp, webhook-signature). Verify the signature in your handler before processing events:

import crypto from 'crypto'
 
function verify(rawBody: string, header: string, secret: string) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  const t = parts.t
  const v1 = parts.v1 ?? ''
  if (!t || Math.abs(Date.now() - Number(t)) > 5 * 60 * 1000) return false
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return expected.length === v1.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))
}

First-party plugins

Cursor Cloud Agent

The Cursor Cloud Agent plugin (cursor-cloud-agent) is a first-party plugin that starts a Cursor Cloud Agent when qualifying events fire. The agent opens a draft PR on your GitHub repo. It still needs your review: see Fixes for the review and merge gates.

Subscribes to: report.classified · fix.requested · qa_story.failed · skill_pipeline.step.dispatched

For report.classified, only reports at or above the plugin’s severity threshold start an agent (critical when no threshold is set). A fix.requested event that the fix worker already sent to Cursor does not start a second agent.

Configure after installing:

Unlike standard webhook plugins, the Cursor Cloud Agent plugin calls the Cursor REST API directly, so there is no outbound webhook URL to configure. If the plugin has no API key, Mushi Mushi falls back to the project’s Cursor key; with no key at all, or no GitHub repo URL on the project, the dispatch is skipped.

The dispatch result (agent ID, run ID, PR URL) is visible in Fixes under the Cursor badge.

Building a plugin

See Plugins → Building a plugin for the full plugin schema, event payload reference, and publishing guide.

Related pages

• Plugins → Building a plugin — create your own integration
• Plugins → Events reference — full event payload schemas
• Settings — API keys for BYOK plugin providers