Extend StreamForce with Customer-Hosted Plugins

StreamForce agents are powerful, but they’re limited to the integrations and tools that Stream supports.

What about the rest of your world? The internal CMDB. That partner API. The service only your team remembers the name of.

Now your agents can reach all of it. Custom Plugins connect StreamForce to any tool or API you've got, securely, and in a single sitting.

With customer plugins, you can host custom tools and their secrets as functions inside your own cloud environment. This allows StreamForce agents to securely interact with your internal systems, repositories, APIs, and infrastructure without exposing credentials outside your control.

How It Works

Start with the StreamForce plugin template: Github

Open the repository in your preferred AI coding solution and describe the tool or integration you want to build. The coding assistant can use the template to generate the required plugin implementation.

Once the plugin is ready:

1. Package it as a ZIP file.
2. Upload it to StreamForce.
3. Deploy the plugin.
4. Add its tools to any StreamForce agent.

After deployment, the plugin becomes available as a toolset that StreamForce agents can discover and use as part of their workflows.

‍

Agent Example: Validate CVEs Against Your Actual Code

Suppose you want an agent to review newly discovered CVEs and determine whether the affected components are actually used in your codebase.

To do this, the agent needs secure access to your GitHub organization so it can inspect repositories, branches, files, dependencies, and code references.

‍

A customer-hosted GitHub plugin could expose tools such as:

• listRepos  List repositories in the organization
• listBranches  List branches in a repository
• getRepoTree  Retrieve the file tree of a repository
• getFileContent  Read the contents of a file
• searchCode  Search code across the organization

Using these tools, a StreamForce agent can move beyond simple CVE matching. It can inspect the actual codebase, confirm whether vulnerable libraries or functions are present, and determine whether the vulnerable code path is reachable.

‍

Agent Example: Validate External Exploitability

Finding a vulnerable component in the code is only part of the picture. The next step is determining whether it can be reached and exploited through the external attack surface.

A StreamForce attack validation plugin can provide tools for safely simulating a breach against a targeted resource.

• tcp_probe  Perform a TCP connection probe against in-scope ports
• tls_inspect  Inspect TLS certificates and configuration
• http_fingerprint  Fingerprint an in-scope HTTP or HTTPS service
• cve_detect  Check whether the conditions for a specific CVE are present
• exposure_scan  Identify exposed sensitive paths
• http_request Send a controlled HTTP request to an in-scope target
• tcp_flow  Run a multi-step TCP or TLS exchange
• udp_send  Send a UDP datagram to an in-scope target
• graphql_introspect  Inspect a GraphQL schema
• graphql_audit  Run non-destructive GraphQL security checks
• openapi_discover  Discover OpenAPI or Swagger specifications and enumerate endpoints
• rest_audit  Run non-destructive REST API authorization checks
• capabilities  List available tools, validation modes, and proof levels

‍

With these capabilities, an agent can validate whether a CVE found in the code is externally reachable, determine whether the vulnerable condition is present in the running environment, and safely simulate relevant attack activity.

The agent can also evaluate CVE chaining risks by identifying combinations of weaknesses that may create a viable attack path, even when no single vulnerability is sufficient on its own.

Build Tools for Any Use Case

The same model can be used to connect StreamForce agents to almost any internal or external system.

You define the tools. You control the environment and secrets. StreamForce agents use those tools to investigate, validate, and act with the context of your organization.

Your stack just joined the team

‍