[gislig]

Plugin type / 插件类型（必填）

• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• UI Plugin / 是 UI 插件
• Not applicable / 不适用

Affected plugin name(s) / 涉及的插件名称：uteamup-zcode

What / 改动内容

Adds a new community plugin uteamup-zcode under external_plugins/, registered in the root marketplace.json, with a shared icon under assets/uteamup-zcode/icon.png.

UteamUP is a CMMS for maintenance and operations. This plugin lets a ZCode user ask about their UteamUP assets and work orders in natural language: "list my assets", "find work orders mentioning pump". It ships:

• one remote HTTP MCP server (uteamup) pointing at the production read-only endpoint https://api.uteamup.com/mcp/read-only;
• one skill (uteamup) teaching the agent when and how to use the five read tools and the consent flow.

User problem solved: UteamUP users could already connect Claude, ChatGPT, and Grok to their workspace via the same MCP endpoint (github.com/UteamUP/uteamup-mcp); this adds ZCode so they are not left out.

Visible behavior / testing:

• Verified end-to-end by the publisher before submission: the identical plugin source (same manifest, .mcp.json, and skill at UteamUP/uteamup-mcp → plugins/uteamup-zcode) was installed in ZCode from a local marketplace, OAuth sign-in against https://api.uteamup.com consent page completed, and the uteamup_* tools listed and returned live data.
• The endpoint's OAuth chain was verified directly: RFC 9728 WWW-Authenticate discovery → RFC 8414 authorization-server metadata → RFC 7591 dynamic client registration, PKCE S256, scope mcp:read.
• python3 scripts/validate.py → OK: 52 plugin(s) validated; git diff --check clean. Full build_dist.py in a fresh clone stops at the pre-existing excalidraw plugin (run pnpm build first); this plugin's tree packages cleanly through build_zip (5 files, 5.5 KB) with no build step of its own.

Version and marketplace registration: plugin 0.1.0, manifest and marketplace entry name/version/description_i18n identical.

Dependencies, network, permissions, side effects:

• Outbound HTTPS only: https://api.uteamup.com/mcp/read-only and UteamUP OAuth endpoints (/oauth/authorize, /oauth/token, /oauth/register). No other destinations.
• No bundled code, binaries, hooks, commands, file writes, or command execution — only the MCP server declaration, the skill, and bilingual READMEs.
• Authentication: each user signs in with their own UteamUP account (a tenant admin first enables "Allow members to connect AI assistants"); no API keys or secrets are bundled or requested. Access is read-only (mcp:read) and scoped to the member's own permissions.

Licensing / provenance: Published by UteamUP (plugin MIT-licensed); logo asset owned by UteamUP; the only contacted service is operated by the publisher. Canonical source maintained at github.com/UteamUP/uteamup-mcp, which also serves UteamUP's own marketplace listing of the same plugin.

Self-check / 自查清单

• Plugin name is unique kebab-case; new external plugin directory is external_plugins/<name>/
• Usage category is set independently of publisher ownership (productivity)
• Required files and both language READMEs are present (README.md, README_CN.md)
• Category is one of the supported values
• No secrets, private data, or machine-specific paths
• validate.py, build_dist.py, and git diff --check pass (see note above on build_dist.py fresh-clone behavior)

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.