mts1b-pluginsdk

Plugin template + SDK + showcase registry.

Repo: github.com/MTS1B/mts1b-pluginsdk Layer: 1 Wave: 3 (months 8-12) Depends on: foundation, platform Audience: community plugin authors

What it is

A starter kit for community plugins. Plugins extend MTS1B without forking any repo. They're packaged as standalone Python packages that implement one of the mts1b-foundation protocols (e.g., BrokerProtocol, MarketDataProtocol, FactorFn).

Plugin type	Examples
Broker adapter	Robinhood Crypto, Tastytrade, Webull
Market-data adapter	IEX Cloud, Alpaca, dxFeed
Factor library	A specialist's mean-reversion factor set
Execution algo	Reinforcement-learning sliced execution
Risk gate	Per-firm custom compliance check
Sizer	Black-Litterman variant

What's in the SDK

mts1b-pluginsdk/
├── template/                  # cookiecutter-style scaffold
│   ├── pyproject.toml.j2
│   ├── README.md.j2
│   ├── src/{{plugin_name}}/__init__.py.j2
│   └── tests/test_protocol.py.j2
├── sdk/
│   ├── registry.py            # how plugins register themselves
│   ├── protocols.py           # re-exports from foundation
│   └── helpers.py             # logging, config, retry wrappers
├── showcase/
│   ├── index.yaml             # registry of approved community plugins
│   └── README.md
└── docs/
    ├── writing-a-broker.md
    ├── writing-a-factor.md
    └── ...

Creating a plugin

pip install mts1b-pluginsdk

mts1b-plugin new \
  --type broker \
  --name robinhood-crypto \
  --author "Jane Q. Hacker" \
  --output ./my-plugin

cd my-plugin
pip install -e ".[dev]"
pytest             # protocol conformance tests pre-included

Generated structure (broker example):

my-plugin/
├── pyproject.toml
├── README.md
├── LICENSE                    # Apache 2.0 by default
├── src/
│   └── mts1b_plugin_robinhood_crypto/
│       ├── __init__.py        # registers with mts1b-brokers
│       └── client.py          # implements BrokerProtocol
└── tests/
    ├── test_protocol.py       # isinstance(client, BrokerProtocol)
    ├── test_unit.py           # adapter-specific unit tests
    └── conftest.py

Registration (entry points)

Plugins register via Python entry points:

pyproject.toml
[project.entry-points."mts1b.brokers"]
robinhood-crypto = "mts1b_plugin_robinhood_crypto:RobinhoodCryptoClient"

[project.entry-points."mts1b.factors"]
f_my_mean_rev = "my_plugin.factors:f_my_mean_rev"

At startup, mts1b-brokers and mts1b-quantkit scan all installed packages for these entry points and load the plugins. No code modification needed in the host repo.

Protocol contract (broker example)

src/mts1b_plugin_robinhood_crypto/client.py
from dataclasses import dataclass
from mts1b_foundation.protocols import BrokerProtocol
from mts1b_foundation.orders import Order, Fill, Position
from mts1b_platform.http import http_client
from mts1b_platform.retry import with_retry


@dataclass
class RobinhoodCryptoClient(BrokerProtocol):
    name: str = "robinhood-crypto"
    api_key: str = ""
    private_key_pem: str = ""

    @with_retry(retries=3, backoff=1.5)
    async def submit(self, order: Order) -> Order:
        # Your implementation
        ...

    async def cancel(self, order_id: str) -> bool: ...
    async def get_open_orders(self) -> list[Order]: ...
    async def get_positions(self) -> list[Position]: ...
    async def stream_fills(self): ...

Tests:

tests/test_protocol.py
from mts1b_plugin_robinhood_crypto import RobinhoodCryptoClient
from mts1b_foundation.protocols import BrokerProtocol


def test_implements_protocol():
    client = RobinhoodCryptoClient(api_key="x", private_key_pem="x")
    assert isinstance(client, BrokerProtocol)


def test_name():
    assert RobinhoodCryptoClient().name == "robinhood-crypto"

These tests are pre-generated. CI runs them on every PR.

Showcase registry

showcase/index.yaml lists approved plugins. Inclusion criteria:

Apache 2.0 / MIT / BSD licensed
Protocol conformance tests pass
README + docs in the plugin repo
No use of pinned vulnerable dependencies (gitleaks + safety clean)
Maintainer co-signs (one of the MTS1B maintainers)

Approved plugins appear at:

Submitting a plugin:

Build it from the template
Test it
PR to mts1b-pluginsdk adding to showcase/index.yaml
Maintainer reviews + co-signs

Plugin discovery from the user side

# List installed plugins
mts1b-plugin list

# Search the public registry
mts1b-plugin search broker
# Found 5 broker plugins:
#   mts1b-plugin-robinhood-crypto   v0.2.1   Jane Q. Hacker     ★ 124
#   mts1b-plugin-tastytrade         v0.1.3   ...                ★ 67
#   ...

# Install one
mts1b-plugin install mts1b-plugin-robinhood-crypto

Security model

Plugins run in-process with the host service. That means:

Concern	Mitigation
Malicious plugin	Showcase review + license audit + dependency check
Plugin secrets leak	Each plugin gets a scoped Vault path (e.g., `secret/mts1b/plugins/<name>`)
Plugin abuses LLM budget	Same governor as host (`mts1b-llm`)
Plugin exfiltrates data	NATS subjects gated by JWT scope per plugin

We do NOT sandbox plugins (no separate process / VM). Trust comes from the showcase review + the plugin's repo being public.

Build + test

pip install -e ".[dev]"
pytest -m unit

Roadmap

Version	Items
0.1 (Wave 3)	Cookiecutter template, registry, 5 starter plugins
0.2 (Wave 3)	`plugins.mts1b...` registry website with ratings
0.3	Plugin sandbox (separate process via `subprocess` for high-trust plugins)
1.0 (LTS)	Stable plugin API

What it is​

What's in the SDK​

Creating a plugin​

Registration (entry points)​

Protocol contract (broker example)​

Showcase registry​

Plugin discovery from the user side​

Security model​

Build + test​

Roadmap​

See also​