Publish to marketplace

# Publish to marketplace

HUMΛN Marketplace is review-first. You submit manifests; intake automation and human reviewers approve; only then can orgs install. There is no silent direct-to-production publish.

Overview

Two submit surfaces serve different callers:

Both set review_status: 'pending' and emit marketplace.asset.submitted for intake agents.

Implementation: apps/api/src/routes/control-plane/cp-marketplace.ts, apps/api/src/routes/marketplace/submit.ts, apps/api/src/services/marketplace-service.ts.

Submit an agent or bundle (Control Plane)

Required body fields: name, asset_type, manifest_json.

Supported asset_type values include agent, bundle, extension, capability_pack, applescript_catalog_entry (each validated separately in cp-marketplace.ts).

Agent submit with automated review

POST /v1/marketplace/submit runs the 13-check automated review before accepting:

const res = await fetch(${process.env.HUMAN_API_URL}/v1/marketplace/submit, {
  method: 'POST',
  headers: {
    Authorization: Bearer ${process.env.HUMAN_DELEGATION_TOKEN},
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    name: 'Support Triage Agent',
    manifest: {
      /* InstallManifest — validated by InstallManifestSchema */
    },
    trust_tier: 'community',
  }),
});
// 202 Accepted when automated review passes; 422 with report when it fails
console.log(res.status, await res.json());

Service: apps/api/src/services/marketplace/app-review-agent.ts.

After submit

Track status — browse Console marketplace or GET /v1/control-plane/marketplace.

Intake agent — marketplace.asset.submitted triggers Canon compliance review (apps/api/src/agents/cp/marketplace-intake.ts).

Install — only when review_status === 'approved' (see Install marketplace bundle).

Extensions and bundles also receive metadata.platform_extension_vetting classification at submit time.

Use cases

First agent publish — community blog flow: manifest → submit → wait for approval → install to eval org.

macOS catalog entry — applescript_catalog_entry with JXA template + params schema.

Capability pack — curated MCP tool collection (kb/132 §8).

Security considerations

See also

Install marketplace bundle

Companion integration manifest

Guide: Marketplace publisher

Community: Publish first agent

Same route in the other SDKs

The TypeScript tab above is the contract. These calls hit that same route.