README: what the Claude Code plugin runs, sends, and stores

[ottomarilves]

Why

We're about to submit the display-dev plugin to Anthropic's directory (developer portal, Plugin bundle). The directory's security scan expects the README to describe everything a plugin runs, sends, or fetches. The README described the hooks but didn't say what each part sends or stores.

What changes

The README gets one section, What the Claude Code plugin runs and sends: a table with one row each for the display.dev skill, the bundled MCP server, the publish guard hook, the comment note hook, /display-dev:feedback, and Visualize. Every row is checked against the code:

• Hooks: the hook script names, and the state file open-thread-counts.json in the plugin data folder.
• Endpoints: the anonymous publish endpoint, and the MCP URL with its X-Client-Source header.
• Visualize: its opt-in image routes read OPENAI_API_KEY or GEMINI_API_KEY and call api.openai.com or generativelanguage.googleapis.com, but only when the user explicitly picks that provider. Mermaid diagrams run @mermaid-js/mermaid-cli@11.12.0 through npx.

README only. No behavior change, so no version bump.

What to expect from the directory review

From the plugin pre-submission checklist, measured on main:

• Passes: repo 22 MiB zipped and 64.5 MiB unpacked, 905 files, no file over 256 KiB, no system files or symlinks, license and README present, https MCP URL, no secrets.
• Likely held for a reviewer (not blocking):
  • 905 files in the plugin, against a limit of 512. Visualize alone is 800.
  • 30 bundled jq binaries.
  • Visualize reading a provider API key from the environment for its opt-in image routes.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}