Add USDCtoFiat plugin (Fast | Best cashout)

[ADWilkinson]

Plugin Submission

Plugin information

• Author: ADWilkinson
• Plugin name: usdctofiat
• Version: 0.1.0
• Source repository: https://github.com/ADWilkinson/usdctofiat-python
• Contact: [email protected]

Submission type

• New plugin
• Version update

What changed

New Marketplace listing for USDCtoFiat by Galleon Labs.

Adds ADWilkinson/usdctofiat/usdctofiat-0.1.0.difypkg — a real Dify tool plugin (manifest.yaml + provider + five tools) that prepares unsigned Base USDC → fiat cash-outs via the published usdctofiat>=0.1.0 client.

mode is a required select on every priced or mutating call. There is no default.

• fast: live market pricing with 0% spread / 0 bps.
• best: Delegate rate manager, 10 bps.

The plugin never accepts a wallet private key. It returns unsigned {to, data, value, chainId} transactions for a host signer injected outside Dify. Provider validation rejects private_key, privateKey, key, secret, mnemonic, and wallet_key.

Tools: usdctofiat_cashout, usdctofiat_estimate, usdctofiat_watch, usdctofiat_withdraw, usdctofiat_deposits.

Docs: https://usdctofiat.xyz/developers

Risk level

• Low risk
• Medium risk
• High risk

Financial cash-out flow. The plugin forwards payee handle, amount, currency, and platform to the public Peer/ZKP2P curator/indexer over HTTPS and returns unsigned txs. It does not sign, broadcast, store keys, or persist user data. Choosing the higher level per the submission requirements because this handles financial personal data (payee handles and cash-out amounts).

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

• No API key. No wallet private-key credential. Signing is an injected host concern, not a Dify secret.
• Outbound HTTPS only, to the public Peer/ZKP2P curator and indexer used by usdctofiat. No user-controlled URL, proxy, crawl, or webhook forward.
• Tool inputs that leave the runtime: mode, USDC amount, fiat currency, payment platform, payee handle, deposit id, or a 0x owner address on Base.
• The plugin does not persist those fields, unsigned txs, or credentials outside a single invocation. It does not broadcast.
• Attribution is locked inside usdctofiat to peer-ref-TOFIAT then galleonlabs. Callers cannot replace it.
• Sensitive capability disclosed: financial personal data (payee handles and cash-out amounts).
• Privacy policy: PRIVACY.md in the package; manifest.yaml sets privacy: PRIVACY.md.

Local validation

Exact head of this PR: d6229095365bce29a61753a509d34e7fd9e97d5d (feat/usdctofiat-plugin on ADWilkinson/dify-plugins).

Package path: ADWilkinson/usdctofiat/usdctofiat-0.1.0.difypkg (13134 bytes).

$ python3 - <<'PY'
import zipfile, os
p = "ADWilkinson/usdctofiat/usdctofiat-0.1.0.difypkg"
z = zipfile.ZipFile(p)
print("size", os.path.getsize(p), "count", len(z.namelist()))
print("\n".join(sorted(z.namelist())))
print("---requirements---")
print(z.read("requirements.txt").decode())
print("---manifest privacy/repo/contact---")
for line in z.read("manifest.yaml").decode().splitlines():
    if line.startswith(("author", "name", "version", "privacy", "repo", "contact")) or line.strip().startswith(("author", "name", "version")):
        print(line)
PY

Result on this head:

• 23 runtime files. No .git, __pycache__, .env, .DS_Store, venv, tests, caches, logs, or binaries.
• requirements.txt: dify_plugin>=0.9.0 and usdctofiat>=0.1.0 (minimum versions; no git/URL installs).
• manifest.yaml: author ADWilkinson, name usdctofiat, version 0.1.0, privacy: PRIVACY.md, repo https://github.com/ADWilkinson/usdctofiat-python, contact [email protected].
• tools/cashout.yaml: mode is type: select, required: true, options fast and best only. No default.
• README covers setup, usage, credentials (none), connection requirements, and the source repository link.

Reviewer notes

Product details

• Product is USDCtoFiat by Galleon Labs.
• Runtime dependency is the published PyPI package usdctofiat>=0.1.0.
• Fast = 0% / TOFIAT. Best = Delegate 10 bps.

Layout

{author}/{plugin}/{plugin}-{version}.difypkg as required. This PR adds only that file. The .difypkg itself is the plugin source (manifest + provider + tools).

Known gaps / limitations

• Validation covers the package contract, metadata, mode behavior, privacy pointer, dependency pin, source, and the Marketplace installation harness. A live Dify Cloud sideload was not run.

Contribution provenance

• AI assistance: yes
• Model(s) used: grok
• Agent tooling: cursor / grok-bot on dappnode as ADWilkinson
• Skill path: N/A - no contribution skill used
• Provenance status: self-reported

Links

• Source → https://github.com/ADWilkinson/usdctofiat-python
• Docs → https://usdctofiat.xyz/developers
• PyPI → https://pypi.org/project/usdctofiat/0.1.0/
• Contact → [email protected]

[crazywoola]

@crazywoola please see the errors in the CI checks above.

[ADWilkinson]

Fixed the CI error in d622909: every tool parameter now includes the required human_description. The Marketplace installation harness passes locally and reaches the plugin server successfully. The new Pre Check Plugin run is awaiting maintainer approval.