Install and manage plugins

Plugins are distributed as cryptographically signed ZIP packages authored and maintained exclusively by Speednet. A plugin is installed globally for your user environment and enabled per project from either the Desktop application or the CLI interface. Explore available extensions in the Plugin catalog.

Plugin architecture and storage

Installing a package extracts its verified contents to ~/.speedwave/plugins/<slug>/. If the plugin declares an MCP service, Speedwave compiles its container image locally within the virtual machine. Resource-only plugins contain only prompt assets (skills, custom commands, subagents, and hooks) and omit the container build step. Runtime metadata resides in ~/.speedwave/plugin-state/<slug>/.

Installation workflow

To install a plugin package, pass the archive path to the CLI:

Terminal

speedwave plugin install ./my-plugin.zip

1. Speedwave validates the archive’s Ed25519 cryptographic signature and inspects plugin.json manifest constraints against Binary authenticity standards.
2. Extracts package contents into ~/.speedwave/plugins/<slug>/.
3. If an MCP service is declared, Speedwave compiles the container image locally.
4. Registers the plugin in global application metadata.

The CLI reports installation progress through verifying, extracting, and building phases:

• Standard installation: Package verified, extracted, and worker image compiled. Speedwave outputs Plugin '<name>' (<slug>) installed successfully.
• Deferred compilation: If image compilation encounters transient errors (such as network unavailability during dependency resolution), Speedwave records a pending state (~/.speedwave/plugin-state/<slug>/image_pending) and outputs Plugin '<name>' (<slug>) installed; image build failed and will retry on next launch.

Deferred builds and automatic retry

Speedwave automatically retries deferred container builds during the next application launch without requiring manual package reinstallation.

Activate the verified plugin within a specific project:

Terminal

speedwave plugin enable <service_id> --project my-project

Enabling a plugin requires valid cryptographic signatures; modified or corrupted packages are rejected until reinstalled.

Interface management

Desktop

1. Navigate to Plugins in the primary navigation sidebar.
2. Click Install plugin and select the signed .zip package.
3. Once verified (✓ ed25519), toggle activation for the active project.

Installed plugins $ install plugin my my-project

plugintypesignedon

figmamcp✓ ed25519

glpimcp✓ ed25519

CLI

1. Install package: speedwave plugin install ./my-plugin.zip
2. Enable in project: speedwave plugin enable <service_id> --project my-project
3. Inspect installed plugins: speedwave plugin list (displays verification status: [verified] or [UNVERIFIED: <reason>]).
4. Uninstall package: speedwave plugin remove my-plugin (removes plugins/<slug>/ and plugin-state/<slug>/).

Release notes and changelogs

When a verified plugin package includes a CHANGELOG.md file, the Desktop application renders an integrated Changelog tab within plugin details. The changelog file is protected by the package signature and displays only for verified installations.

Security verification boundaries

Speedwave executes cryptographic signature audits across all installed plugins prior to running standard CLI commands. If an installed plugin fails signature verification, commands exit with code 2 until the package is reinstalled or removed.

Management commands (plugin install, plugin list, and plugin remove) bypass startup audits, allowing corrupted or tampered packages to be safely uninstalled.