Adapter Registry

The first registry should be local and forkable. A hosted marketplace can come later.

SiteKit adapters are versioned artifacts. If one team has already mapped a destination portal, another team should be able to start from that work instead of recording the same flows from scratch.

Registry Entry

name: destination_portal
label: Destination Portal
version: 0.1.4
site:
  appUrl: https://app.example.test
  apiHosts:
    - api.example.test
auth:
  strategies:
    - captured_headers
    - browser_login
operations:
  verified: 10
  unverified: 1
  sideEffects:
    read: 9
    update: 1
    create: 1
runtime:
  backends:
    - http
packages:
  typescript: packages/destination-portal-ts
  python: packages/destination-portal-py
trust:
  signature: ed25519:example-signature
  capabilities:
    transforms: pure_json
    browserHosts:
      - app.example.test

Local Commands

sitekit registry list
sitekit registry show destination_portal
sitekit registry import ./adapters/destination_portal
sitekit registry fork destination_portal --as destination_portal-team

The registry should make adapter state visible:

[email protected]
  auth: captured_headers
  verified operations: 10
  unverified operations: records.create
  latest live test: 2026-08-27
  package targets: typescript, python, mcp

Trust Model

Imported adapters should not become fully trusted automatically. Adapters may contain executable transforms and browser-backed scripts, so the registry needs a trust model before broad sharing becomes safe.

The registry should track:

• Source repository or local path.
• Adapter version and generated package versions.
• Verification status by operation.
• Capture and fixture provenance.
• Last successful fixture and live test.
• Required auth strategy and connection requirements.
• Declared capabilities for transforms and browser scripts.
• Signature and provenance metadata when available.

capabilities:
  transforms:
    network: none
    filesystem: none
    environment: none
    timers: none
  browser:
    allowHosts:
      - app.example.test
    allowDownloads: false
    blockNavigationOutsideAllowlist: true

provenance:
  source: registry://example-org/[email protected]
  captureIds:
    - cap_2026_08_27_a91f
  llm:
    provider: openai
    model: gpt-5
  signature: ed25519:example-signature
  importedAt: 2026-08-27T14:02:00Z

Two rules make registry sharing safer:

• Verify signatures at import and again at generation.
• Unsigned or unverifiable adapters may be imported for raw exploration, but cannot auto-expose operations to MCP or pipeline surfaces.

Transform sandboxing should be enforced by the runtime. A transform is a pure function over JSON with no network, filesystem, environment, or timer access. A browser script runs only against its declared host allowlist.

Hosted Later

A hosted registry can add collaboration features:

• Organization-approved adapter versions.
• Shared drift telemetry.
• Maintainer ownership.
• Review history.
• Usage-based live probe scheduling.

Those are control-plane features. The adapter package should remain useful as a local artifact.