Add Grok Build plugin - #24
Merged
Merged
Conversation
Copy the TinyFish Grok Build plugin into the integrations monorepo as grok/, a sibling of claude/. Ships five skills (web router, research, automation, authenticated, browser) plus reference docs and a security rules doc, backed by the hosted TinyFish MCP server (OAuth, no API key). Also document the previously-unlisted LangChain, Google ADK, and n8n integrations in the top-level README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop the batch web-automation feature (batch_create/batch_status/ batch_cancel) and all big-search references (run_big_search/ get_search_result) from the plugin's loaded surface: - Delete skills/tinyfish-automation/references/batch.md - Remove batch_create rows from the tinyfish-web and tinyfish-automation decision tables, and the batch-run guidance in goals.md and structured-output.md - Drop the "Don't call run_big_search" section and the research skill's big-search instruction - Trim the batch tool row from README and the batch tools from the .mcp.json note Generic "batch" guidance that is not the metered feature — fetch_content taking up to 10 URLs per call, grouping seeds per subagent — is retained. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughAdds a complete Grok Build integration for TinyFish, including plugin metadata, MCP configuration, licensing, marketplace documentation, safety rules, and skills for web tool selection, automation, authenticated browsing, remote browser sessions, and research workflows. The README also expands the repository integrations table with Grok, LangChain, Google ADK, and n8n entries. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The design-rationale snapshot still described batch_* as in-scope and discussed run_big_search/get_search_result. Those tools are removed from the plugin, so drop the doc to keep grok/ consistent with the shipped scope. Provenance remains in git history. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@grok/README.md`:
- Around line 81-82: Update the Network endpoints statement in the README to
describe only the plugin’s direct connection to https://agent.tinyfish.ai/mcp,
and remove the absolute claim that no other endpoint is contacted. Keep the
existing endpoint purpose description intact.
In `@grok/rules/security.md`:
- Line 24: Update the URL handling rule in the security guidance to state that
shell quoting alone is insufficient sanitization. Require a fixed HTTP client
with URLs passed as separate arguments; if shell execution is unavoidable,
require http/https scheme validation and structured argument passing instead of
interpolating untrusted URLs into shell source.
In `@grok/skills/tinyfish-automation/references/goals.md`:
- Around line 85-92: Update the contact-form example near “Submit the form” to
explicitly require user confirmation before submission, either by adding a
confirmation step or stating that confirmation must already be obtained;
preserve the existing form details and submission flow.
In `@grok/skills/tinyfish-browser/SKILL.md`:
- Around line 30-38: Update the Playwright usage example around the browser
interaction to wrap page navigation and title retrieval in try/finally, and call
browser.close() in the finally block so the remote browser is closed on both
normal completion and exceptions.
In `@grok/skills/tinyfish-research/references/fetching.md`:
- Around line 7-37: Update the fetching guide to document only the parameters
exposed by TinyFishFetchInput: urls, format, links, and image_links. Remove
purpose guidance, ttl, per_url_timeout_ms, include_selectors, exclude_selectors,
and any conditional-request fields from the examples and parameter table, while
preserving the batch-fetch guidance.
In `@grok/skills/tinyfish-research/SKILL.md`:
- Around line 101-102: Update the source-counting instructions in SKILL.md so
fetched URLs from search results are not double-counted; require
sources_reviewed to report unique source URLs across searches, retries, and
fetched pages, or replace it with separate search_results_seen and pages_fetched
metrics while preserving the exact final-line format.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c0608da9-3df7-4e67-927b-7210e7ef7394
📒 Files selected for processing (18)
README.mdgrok/.grok-plugin/plugin.jsongrok/.mcp.jsongrok/LICENSEgrok/README.mdgrok/rules/security.mdgrok/skills/tinyfish-authenticated/SKILL.mdgrok/skills/tinyfish-automation/SKILL.mdgrok/skills/tinyfish-automation/references/anti-bot.mdgrok/skills/tinyfish-automation/references/goals.mdgrok/skills/tinyfish-automation/references/structured-output.mdgrok/skills/tinyfish-browser/SKILL.mdgrok/skills/tinyfish-research/SKILL.mdgrok/skills/tinyfish-research/references/fan-out.mdgrok/skills/tinyfish-research/references/fetching.mdgrok/skills/tinyfish-research/references/searching.mdgrok/skills/tinyfish-research/references/synthesis.mdgrok/skills/tinyfish-web/SKILL.md
Two corrections to the Grok plugin's tool surface: - The MCP server exposes close_browser_session (idempotent, takes a session_id) on the default endpoint. Fix the tinyfish-browser skill, which wrongly claimed there was no terminate tool, and document it in the README and .mcp.json note. - Restore batch_status and batch_cancel (only batch_create is removed). They poll or cancel several runs at once by ID and pair with run_web_automation_async; the plugin still does not start batches. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an explicit Tools table to the tinyfish-browser skill listing create_browser_session, list_browser_sessions, and close_browser_session, and surface close_browser_session in the usage flow so it reads as a first-class exposed tool rather than an aside. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- README: scope the network-endpoints declaration to the plugin's single declared MCP connection instead of an absolute "no other endpoint" claim (OAuth and CDP sessions are carried out by TinyFish). - rules/security.md: strengthen URL handling — don't build shell commands from untrusted search/fetch output; quoting is not sufficient sanitization. Prefer a fixed HTTP client with the URL as an argument. - goals.md: note that the contact-form example needs prior user confirmation (submitting sends a message on the user's behalf), and label the fenced block. - tinyfish-browser: close the remote browser in the usage example via try/finally so the session isn't leaked on error. - tinyfish-research: count unique source URLs in sources_reviewed so a fetched search result isn't double-counted. Not applied: the fetching.md "unsupported parameters" finding — it was validated against the LangChain TinyFishFetchInput wrapper, but this plugin calls the MCP fetch_content tool, whose schema does expose purpose, ttl, per_url_timeout_ms, and selector scoping. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
KateZhang98
approved these changes
Jul 27, 2026
KateZhang98
left a comment
KateZhang98
left a comment
Contributor
There was a problem hiding this comment.
is there any way to we link the docs instead of rewriting the docs?
londondavila
approved these changes
Jul 27, 2026
…ng param tables The reference files re-tabulated the Search/Fetch API parameters, which duplicated the MCP tool schema and docs.tinyfish.ai and risked drift (the source of an earlier false "unsupported params" review flag). Replace the exhaustive parameter tables with a link to the canonical reference plus the "tool schema is authoritative" note, and keep only guidance the docs don't carry — query craft, filter combination traps, selector behaviors/failure handling, response handling, and the habit-forming params (purpose, ttl:0, format). - searching.md → links https://docs.tinyfish.ai/api-reference/search-the-web - fetching.md → links https://docs.tinyfish.ai/api-reference/fetch-and-extract-content-from-urls Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Grok Build plugin under
grok/, a sibling ofclaude/, bringing TinyFish to the xAI plugin marketplace. Backed by the hosted TinyFish MCP server (agent.tinyfish.ai/mcp, OAuth — no API key). Markdown + JSON only; nothing executes.The layout matches what Grok expects, verified against the marketplace spec and two accepted peer plugins (Firecrawl, Exa): manifest at
.grok-plugin/plugin.json,.mcp.jsonat root,skills/<name>/SKILL.md+references/, and a non-loadedrules/security.md.Skills
tinyfish-web— router that picks the right tool (and keeps free reads off metered automation)tinyfish-research— search + fetch research orchestrator with subagent fan-outtinyfish-automation— goal-driven browser automationtinyfish-authenticated— logged-in sites via Browser Context Profiles + Vaulttinyfish-browser— remote CDP browser sessionsScope trimmed vs. the source plugin
batch_create/batch_status/batch_canceland thereferences/batch.mddoc are gone from the plugin's loaded surface.run_big_search/get_search_resultreferences remain.Also documents the previously-unlisted LangChain, Google ADK, and n8n integrations in the top-level README.
Not included (deliberate)
The xAI marketplace catalog entry is a separate follow-up — it must pin this branch's merge SHA and reference the plugin via a remote
urlsource with"path": "grok"(the pattern Railway/Stripe use for monorepos).docs/RESEARCH.mdis kept as a dated design-rationale snapshot (non-loaded); it still describes the original tool scope as historical record.Verification
.grok-plugin/plugin.jsonand.mcp.jsonparseSKILL.mdfront-matter names match their directoriesbatch.md; nobatch_create/big_searchreferences remain in loaded components.DS_Storefiles🤖 Generated with Claude Code