Understanding OpenAI Plugin Licensing and Developer Terms: A Complete Guide

OpenAI plugins use a dual-layer legal model where each plugin carries its own MIT License while developer terms governing authentication, permissions, and acceptable use are defined in the mandatory .codex-plugin/plugin.json manifest.

The openai/plugins repository organizes integrations as self-contained packages, each establishing distinct legal permissions through decentralized licensing and operational constraints through machine-readable manifests. Understanding how OpenAI plugin licensing and developer terms interact ensures compliance whether you are publishing, consuming, or redistributing plugin code.

Repository Architecture and Licensing Structure

The repository eschews a monolithic license in favor of per-plugin ownership. Each plugin resides under plugins/<plugin-name>/ and maintains independent legal authority.

Per-Plugin MIT Licensing

Every plugin directory contains a LICENSE file (predominantly MIT) that grants explicit rights to use, copy, modify, merge, publish, distribute, sublicense, and sell the software. Because the repository root does not contain a single top-level LICENSE file, the plugins/<plugin-name>/LICENSE path serves as the authoritative source for each integration's legal terms.

When redistributing or forking code from the repository, you must preserve the copyright notice and license text found in the specific plugin's LICENSE file. This decentralized approach allows third-party developers to safely adapt individual plugins without inheriting complex monolithic licensing dependencies.

Marketplace Configuration Files

The repository uses JSON configuration files to define plugin availability without altering licensing terms:

• .agents/plugins/marketplace.json — Default marketplace definition pointing to the plugins/ directory
• .agents/plugins/api_marketplace.json — Alternative marketplace for API-key-authenticated users

These files reference plugin locations but do not modify the underlying MIT licenses or developer terms defined in individual manifests.

Understanding Developer Terms in the Manifest

The .codex-plugin/plugin.json file serves as the binding contract between the plugin and the OpenAI platform. This manifest encodes the developer terms that restrict how the plugin operates regardless of the permissive MIT license.

The plugin.json Schema

A valid manifest declares capabilities, authentication requirements, and usage policies. Here is the structural breakdown:

{
  "name": "figma",
  "description": "Design-to-code and Code Connect for Figma",
  "version": "1.0.0",
  "api": {
    "type": "openapi",
    "url": "https://api.figma.com/openapi.json"
  },
  "auth": {
    "type": "oauth2",
    "scopes": ["files:read", "files:write"]
  },
  "permissions": [
    "read:user",
    "write:files"
  ],
  "terms": {
    "allowed_use": "non-commercial and commercial projects",
    "prohibited_content": "illegal, hateful, or disallowed material"
  }
}

Authentication and Permissions

The auth field declares the security flow (OAuth 2, API key, etc.) and the specific scopes the plugin requests from users. The permissions array lists granular actions the plugin may perform on behalf of the user, such as read:user or write:files. These declarations function as operational constraints that the OpenAI platform enforces at runtime.

Usage Policies and Restrictions

The terms object outlines acceptable use cases and content restrictions. Typical fields include allowed_use (defining commercial viability) and prohibited_content (banning illegal or harmful material). These free-form policies constitute the binding developer terms that publishers must honor and users must accept before installation.

How Licensing and Terms Work Together

The separation of legal rights (MIT License) from operational constraints (manifest terms) creates a clear compliance framework:

1. Publishing — Contributors include both the LICENSE file and the plugin.json manifest. The MIT license grants code-level rights, while the manifest imposes platform-level restrictions.
2. Installation — The OpenAI platform reads the manifest to enforce declared permissions and usage terms before activating the plugin for a user.
3. Redistribution — Forks must preserve the MIT license text and cannot remove the terms object from the manifest, ensuring downstream users remain bound by the original developer terms.

This model ensures that while code remains open and modifiable, runtime behavior respects the original author's operational constraints.

Working with Licenses and Manifests in Code

When building tooling around the OpenAI plugins ecosystem, you can programmatically interact with both licensing and developer terms.

Loading Licenses at Runtime

To surface MIT license text to end-users, resolve the file path dynamically:

import fs from 'fs';
import path from 'path';

function getPluginLicense(pluginName) {
  const licensePath = path.join(
    __dirname,
    'plugins',
    pluginName,
    'LICENSE'
  );
  return fs.readFileSync(licensePath, 'utf8');
}

console.log(getPluginLicense('zoom'));

This Node.js approach satisfies the MIT requirement to include the license in all copies while allowing UI integration.

Validating Developer Terms

For CI pipelines, validate that manifests contain required terms fields:

import json
from pathlib import Path

def load_manifest(plugin):
    manifest_path = Path('plugins') / plugin / '.codex-plugin' / 'plugin.json'
    return json.loads(manifest_path.read_text())

def validate_terms(manifest):
    terms = manifest.get('terms', {})
    assert 'allowed_use' in terms, "Manifest must state allowed use"
    assert 'prohibited_content' in terms, "Manifest must list prohibited content"

manifest = load_manifest('figma')
validate_terms(manifest)
print("Manifest terms are valid.")

This validation step ensures compliance with repository standards before publishing, as enforced by the plugin-eval tooling documented in plugins/plugin-eval/README.md.

Displaying Terms in UIs

Embed legal transparency directly into React interfaces:

import React, { useEffect, useState } from 'react';
import axios from 'axios';

export const LicenseView: React.FC<{ plugin: string }> = ({ plugin }) => {
  const [license, setLicense] = useState('');

  useEffect(() => {
    axios.get(`/plugins/${plugin}/LICENSE`).then(res => setLicense(res.data));
  }, [plugin]);

  return (
    <div>
      <h2>{plugin} – MIT License</h2>
      <pre>{license}</pre>
    </div>
  );
};

This pattern helps users review open-source terms before enabling plugin functionality.

Key Files and Their Roles

• README.md — High-level repository overview and marketplace layout explanation
• plugins/<name>/LICENSE — Definitive MIT license for each individual plugin (e.g., plugins/zoom/LICENSE)
• plugins/<name>/.codex-plugin/plugin.json — Manifest encoding authentication, permissions, and developer-term policies
• .agents/plugins/marketplace.json — Default marketplace pointer for the plugin directory
• .agents/plugins/api_marketplace.json — API-key-user marketplace configuration
• plugins/plugin-eval/README.md — Documentation for CI validation of manifest correctness

Summary

• Each plugin carries its own MIT License in plugins/<plugin-name>/LICENSE, granting broad usage rights while requiring copyright notice preservation.
• Developer terms live in .codex-plugin/plugin.json, defining authentication flows, permission scopes, and acceptable use policies that the platform enforces.
• The repository uses marketplace JSON files to organize plugins without modifying individual licensing terms.
• Validation tooling in plugins/plugin-eval ensures manifests meet structural requirements before publication.
• When redistributing plugins, you must maintain both the MIT license file and the original manifest terms object.

Frequently Asked Questions

What license covers the OpenAI plugins repository?

Each plugin is individually licensed under the MIT License via its own LICENSE file. There is no single repository-wide license; you must check the specific plugins/<plugin-name>/LICENSE file for the exact terms governing that code.

Where are the developer terms defined for a specific plugin?

Developer terms are encoded in the .codex-plugin/plugin.json manifest file within each plugin directory. This JSON file specifies authentication requirements, permission scopes, and usage restrictions under the auth, permissions, and terms fields.

Can I modify and sell a plugin from this repository?

Yes, the MIT License explicitly grants rights to modify, sublicense, and sell the software. However, you must include the original copyright notice and license text. Additionally, if you redistribute the plugin, you must preserve the terms object in the manifest, which may impose operational restrictions on how the plugin functions within the OpenAI platform.

How does the platform enforce developer terms?

The OpenAI platform reads the plugin.json manifest during installation to validate authentication scopes and permissions. The CI pipeline also uses the plugin-eval tooling referenced in plugins/plugin-eval/README.md to check that manifests contain required fields like allowed_use and prohibited_content before accepting publication.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}