Add Suno plugin

[acedatacloud-dev]

Plugin Submission

Plugin information

• Author: Ace Data Cloud (acedatacloud)
• Plugin name: Suno (suno)
• Version: 0.0.1
• Source repository: https://github.com/AceDataCloud/SunoDify/tree/main
• Contact: dev@acedata.cloud

Submission type

• New plugin
• Version update

What changed

Adds the Suno plugin with service-specific branding from existing Ace Data Cloud system assets, bilingual tool metadata, structured inputs, public result variables and asynchronous task retrieval. The second audit aligns capabilities with the current API and first-party MCP implementation; CAPABILITIES.md records exact mapping and scoped differences. No logo was generated or redrawn.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package contains no secrets, .env, .git, virtual environments, caches, test evidence or executable binaries.
• The README includes setup, usage, credentials, network requirements and source links.
• PRIVACY.md is included and referenced by manifest.yaml.

Security and privacy notes

The plugin sends the user's service-authorized token and selected inputs to the fixed https://api.acedata.cloud API, with TLS and redirects disabled. Reference media URLs are inputs to that service; the plugin never fetches arbitrary references. Dify may separately render returned media URLs. Raw service errors, stored requests, private identifiers and routing metadata are excluded from normalized results. There is no shell/code/SQL execution, local-file access, browser automation, direct payment or asset-transfer operation in the runtime.

Paid operations are never retried automatically; only explicitly read-only queries may retry a transient transport error twice. Task polling uses the same accepted task ID. Persistent voice/persona/custom-model or project operations, where exposed, send authorized recordings, transcripts and user-selected configuration to the API and are disclosed in PRIVACY.md. Delete/archive operations require an explicit confirmation field. API billing prose describes service usage charges, not a payment integration.

Local validation

• Python 3.12, pinned Dify SDK 0.9.1, requests 2.34.2 and jsonschema 4.25.1.
• Unit/contract tests: 46 passed, 1 warning in 1.36s. Ruff and SDK registration passed.
• Official Dify CLI package generated; SHA256 1932c4d2e528d2145c05290deb4648ad4763ffaac3f214dd62125a3e9e276680. Marketplace Toolkit passed with zero blocking failures; the exact package passed its serverless installation check.
• Actual isolated Dify CE 1.17.1 / daemon 0.6.10-local, signature verification enabled, official remote-debug transport. Tests use real browser Test Run and inspect final service state. Specific completed/failed/pending cases and billing/media evidence are recorded in tests/e2e-results.json and tests/e2e-audit.json; no unrecorded model/action is claimed as live-tested.

Source audit merged in AceDataCloud/SunoDify#2. Verified source revision: https://github.com/AceDataCloud/SunoDify/tree/25d58c05252a40e78894bf54673dd2d8b9006346 . Every runtime file in this package was compared with that merged Git tree. Evidence: https://github.com/AceDataCloud/SunoDify/blob/main/tests/e2e-audit.json .

Reviewer notes

Dify Cloud and installation from an official Marketplace entry remain unverified pending publication. Submission does not mean Marketplace publication, default installation or featured placement. Current source, branding and MCP mapping evidence are at https://github.com/AceDataCloud/SunoDify . AI assistance was used in implementation and review.

The Developer Agreement remains unchecked: the documentation links Development Guidelines and Privacy Guidelines, but a separate agreement URL has not been identified. Please provide the canonical agreement if a separate attestation is required. No agreement has been signed or maintainer approval bypassed.