FastAF for Dify

Six Python tool integrations for FastAF, a public web data API
for agents. Use them in Dify Workflows, Chatflows, and Agents with your FastAF API
key, sent only as to .

• Author:
• Plugin version:
• Python: 3.12; Dify plugin SDK: 0.10.2
• Source: this local Git repository. The intended public source URL is
  fastaf-co/fastaf-dify-plugin,
  also recorded in the manifest. This repository has not been published yet.
  Publish it at that URL (or update both links) before Marketplace submission.
• Support: [email protected]
• API documentation | OpenAPI
• Plugin privacy policy | FastAF privacy

Installation and credentials

1. Use a Dify release with Python 3.12 tool-plugin support. This plugin uses the
   current SDK; installation inside Dify Community/Cloud still needs acceptance
   testing before public Marketplace release.
2. In Plugins, choose Install from local package and select
   . This is a locally built, unsigned package, not a
   Marketplace-approved release. Your instance's signature policy may refuse it;
   use an administrator-approved development instance rather than disabling
   production security checks.
3. Create a FastAF key at FastAF signup and enter the
   bare key in the FastAF provider's FastAF API key secret field. Do not enter
   , put the key into a tool input, or paste it into an agent prompt.
4. Credential validation calls , which does not spend credits.
5. Add a FastAF tool to your Workflow or Agent and map the required inputs.

The plugin runtime needs outbound HTTPS to api.fastaf.co:443 and working DNS.
There is no configurable API origin, OAuth, wallet, x402 payment, custom header,
proxy setting, or Dify reverse-invocation permission. Users need an active FastAF
key and available credits/free-request eligibility. This plugin does not purchase
credits or retry requests automatically.

Tools

Examples:

• Scrape: , .
• Web/news: , , .
• Maps: , .
• Amazon: , .
• Transcript: (availability is not guaranteed).

Only a small allowlisted subset of OpenAPI parameters is exposed. There is no
arbitrary endpoint passthrough. maps to ; Maps does not
receive an unsupported parameter. Request arguments are validated before
network access. Whole numbers from Dify are accepted as integers or integral floats.

Outputs and cost

Every successful call produces a Dify JSON message:

preserves the API JSON structure, except the credential is redacted if it
is unexpectedly echoed. Scraping returns . A text message is also
emitted for agents: raw Markdown for a page, serialized JSON otherwise. External
content is untrusted data, not instructions; downstream agents should not
execute commands or follow instructions found in retrieved content.

Page parsing preserves plain text/Markdown even if the API labels it .
It also unwraps a JSON string or an explicit top-level string; it rejects
HTML documents, error objects, empty content and ambiguous JSON instead of showing
a serialized envelope as the page. It does not synthesize titles: the observed
body contains its documentation-use paragraph without .

is read from , or is when absent. The
plugin does not estimate charges from result counts. FastAF's current pricing and
site rules apply; rendering can increase cost. Check the
pricing and usage dashboard.

Errors are raised as Dify tool errors with safe, actionable text. Raw error bodies,
request URLs and credentials are not included. A 402 indicates insufficient
credits; a 429 indicates rate/concurrency limits. Network timeouts are not proof
that a call was unbilled. The plugin never retries automatically. A successful
server response that exceeds the 4 MiB local response limit or fails local parsing
may already have been billed; check usage before repeating it.

Security boundary

• All outbound tool requests go to the fixed FastAF HTTPS origin, with TLS
  verification, redirects disabled, and environment proxy settings disabled.
• forwards a public URL as data to FastAF; it never fetches that URL
  itself. It rejects credentials in URLs, local/private literal addresses,
  nonstandard ports and fragments. FastAF additionally enforces DNS/redirect,
  target-access and site-specific policies. Do not request private/login-only
  pages, confidential content or sensitive personal data.
• is a configuration field and must be explicitly enabled by the user.
• Connect timeout: 10 seconds; read timeout: 75 seconds per read; Dify request
  timeout: 120 seconds. Responses are capped at 4 MiB of decoded bytes.
• No telemetry, disk cache, persistent Dify storage, command execution, model/app
  invocation, file-upload processing, or payment initiation is implemented.
• Conservative Marketplace risk classification: High, because the plugin
  delegates user-selected URL retrieval and returns location-related Maps data.
  See for the complete disclosure and remaining review steps.

Development and tests

Tests are mocked and do not consume credits. The committed OpenAPI snapshot is
public contract metadata, not a stored customer response.

For opt-in real API tests, set securely in your environment, then:

The smoke test validates the key via and calls each tool once,
sequentially, with no retries. It consumes FastAF credits. It prints only tool
names, success/failure, and credit metadata, never the key or response payloads.
Without a key it reports . It does not read unrelated secret files.

For Dify remote debugging, copy to , set your workspace's debug
address/key, and run . Configure the FastAF key through Dify.
Never commit either credential.

Packaging

Use the official Dify Plugin CLI (tested with 0.6.12), not :

uses the official CLI's command to extract the
archive, install dependencies and start over local stdio. It invokes
the tool's missing-input and blocked-target checks with no API credential and no
FastAF request. Installation evidence and remaining boundaries are recorded in
.

excludes tests, fixtures, development tools, caches, virtualenvs,
credentials, Git state, logs and existing packages. and
pin the runtime dependencies; locks the complete
resolution. No binaries or installed dependencies are bundled.

No submission automation is enabled. Packaging does not publish the plugin or
open a PR. Public source hosting, deployment-specific Dify/Workflow validation,
Marketplace namespace/version checks, and developer agreement acceptance remain
release gates.