Third-party plugins

Anyone can build a plugin with the plugin SDK (the technical side is in the developer documentation), for example a new metadata source, a subtitle source, danmaku or a people alias list. This page explains how to install one and, more importantly, what you are trusting when you do.

Install a third-party plugin#

Third-party plugins come from a plugin catalog: an HTTPS address that lists plugins. To add one, open Plugins → Marketplace → Manage plugin catalogs, enter the address and press Add. A warning explains the risk first (see below); you add the catalog only after you confirm it. The same window lists every catalog with the result of its last fetch, and lets you remove a third-party catalog (plugins you already installed from it keep working; the official catalog cannot be removed). Once your server knows a catalog, its plugins show up in the Marketplace tab, marked Third-party with the catalog's address.

1. Open Plugins → Marketplace and find the plugin.
2. Press Install. A warning asks whether to install the third-party plugin; read it, then press Install anyway.
3. Set the plugin up and enable it, like any other plugin.

A catalog address must be a public HTTPS address. The server refuses addresses on your own network (localhost, private addresses and names such as .lan or .local), so you cannot add a catalog hosted on your own LAN.

Updates come only from the catalog you installed the plugin from. A different catalog cannot replace it with a higher version.

Read this before you install#

• A plugin is a program that runs with the server's own permissions, with no extra isolation. It can read any file the server can read (including your libraries and the server's data folder), connect to the network and start other programs. Installing a third-party plugin means trusting its author. Install only from sources you trust.
• Contents of Kryspal’s own catalog are digitally signed and verified. Third-party catalogs are not signed. The server can only check that a downloaded file matches what the catalog says. It cannot prove who the author is.
• Names of Kryspal’s plugins cannot be impersonated: an entry in a third-party catalog with the same name as one of them is ignored.
• Sensitive permissions must be allowed explicitly by an administrator and are off by default. Using AI assist (BETA) and reaching your local network are two of them: the plugin's page shows AI permission and Local network access switches.
• If you are unsure, do not install. An installed plugin can be disabled or uninstalled at any time.

What a plugin can and cannot do#

• It can provide metadata, images, subtitles, intro and credits data, danmaku, people alias lists, metadata recognition and member sync.
• Third-party plugins can offer new capabilities. Capabilities that match a paid feature (name recognition, subtitle search and download, community intro and outro data) need the same plan no matter who provides them; other features can be offered for free. The plugin itself is never locked: you can install, set up and enable it without a plan. Until you have the plan, its page says “This feature needs PRO to take effect” and the paid feature is not used.
• People alias lists (real names and stage names): a plugin that offers this can supply a whole table. The server syncs it once a day and uses it only to recognize that two names are the same person, while scanning and scraping, in search, and as evidence when detecting possible duplicates. It never merges two people that already exist. An administrator can turn off the alias list of any plugin.

When a third-party plugin misbehaves#

• A plugin that keeps crashing is disabled automatically, and the reason is shown on its page. See the Plugin center page for statuses.
• Report plugin problems to the plugin's author first. Report only server problems to us.