Plugin

Overview#

Different organisations deploy Argus for different purposes, and no single product can anticipate every bespoke analysis need. The Plugin domain lets third-party developers extend the platform with sandboxed, marketplace-distributed plugins, giving each tenant access to community-built capabilities while maintaining strict security through code signature verification, capability grants, and isolated runtime environments.

Key Features#

• Plugin lifecycle management: draft, review, publication, deprecation, and archival
• Semantic versioning with changelog tracking and manifest support
• Capability-based security model with fine-grained permission grants
• Sandboxed execution with isolated runtime, resource limits, and timeout controls
• Full marketplace with listings, pricing models (free, paid, subscription), and user reviews
• Code signature verification for integrity assurance
• Multiple execution triggers: manual, scheduled, and event-based
• Input/output payload management with stdout/stderr capture for debugging
• Time-limited capability grants with expiration and revocation support
• Install tracking and usage metrics for marketplace analytics

Use Cases#

Relevant sectors include law enforcement, financial crime investigation, and intelligence agencies.

• Enabling third-party developers to build and distribute platform extensions through a marketplace
• Running sandboxed analysis plugins on evidence with controlled capability access
• Managing capability grants for plugin execution with time-limited permissions
• Publishing versioned plugin updates with changelog documentation and review workflows

Integration#

The Plugin domain connects with external integration frameworks, webhook systems, audit logging, and feature flag management.

Open Standards#

• GraphQL (June 2018 Specification): All plugin and marketplace operations, registration, versioning, capability grants, execution, and reviews, are exposed exclusively through a GraphQL query and mutation API.
• RSA PKCS#8 / RSASSA-PSS (RFC 8017, RFC 5958): Plugin code signatures are generated and verified using RSA-4096 keys serialised in PEM/PKCS8 format with PSS padding and MGF1, ensuring publisher authenticity before a version is trusted.
• SHA-256 (FIPS PUB 180-4): Every published plugin version carries a SHA-256 content hash (code_sha256), and the tamper-evident execution ledger chains each record with a SHA-256 digest of the previous entry.
• FIPS 140-2: The cryptographic security module is designed to operate within an OpenSSL FIPS boundary, ensuring that key generation and signature primitives can be deployed in FIPS-validated environments.
• Semantic Versioning 2.0.0 (SemVer): Plugin releases follow the SemVer scheme, with per-version changelogs and min_platform_version / max_platform_version constraints expressed as SemVer strings.
• JSON (RFC 8259): Plugin manifests, execution input/output payloads, capability grant metadata, and ledger record serialisation all use JSON as the canonical data interchange format.
• UUID (RFC 4122): Every domain entity, plugins, versions, executions, grants, listings, and reviews, is identified by a UUID version 4 universally unique identifier.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14