# Plugin MCP artifacts are validated before packing

Plugin SDK v0.3.2 serializes Connect service descriptors into
`PluginManifest.mcp_tools`. Without a CLI gate, an artifact could carry
inconsistent procedures, missing RBAC coverage, invalid schemas, unstable
names, or no runtime HTTP handler and fail only after installation.

Decision: both `ninja plugin build` and `ninja plugin verify` validate the MCP
surface. Descriptor procedures must agree with service and method fields, be
unique, map to supported RBAC roles, contain object input schemas, and derive a
scoped name no longer than 128 bytes. The protobuf package must end in an API
major such as `v1`, `plugin.mod` must provide scope and plugin identity, and any
descriptor-bearing manifest must set `has_http_handler`. The CLI pins Plugin
SDK v0.3.2 so builds preserve the typed descriptor field.

Relying only on the CMS loader was rejected because it lets known-invalid
artifacts reach the registry. Validating only during build was rejected because
`verify` must independently gate externally supplied artifacts.

Consequences:

- Invalid MCP artifacts fail before upload or installation.
- The CLI and CMS enforce the same descriptor and runtime invariants.
- Wiki artifacts built with this CLI retain all typed MCP descriptors.

Keywords: ninja plugin build, ninja plugin verify, Plugin SDK v0.3.2,
MCPToolDescriptor, mcp_tools, has_http_handler, plugin.mod scope, RBAC, JSON
Schema, plugin_ninja_wiki_v1