Cusp Hub Developer Terms
Terms for publishers who list extensions — skills, plugins, MCP servers, agents, workflows and themes — on Cusp Hub.
Обновлено
These terms apply when you publish an extension on Cusp Hub (the "Hub"), operated by Wex Labs Limited ("we", "us"). They add to the Terms of Service and the Acceptable Use Policy. If you publish for an organisation, you confirm you can bind it, and "you" means that organisation.
1. Definitions
- Extension: anything you publish to the Hub, such as a skill, plugin, MCP server package, subagent, workflow, hook, crew role, blueprint or theme, with its manifest, README, images, eval suite and every version of it.
- Listing: the Hub page and metadata for an Extension, including its computed capability label, scan results, eval scores, reviews and install counts.
- User: anyone who views or installs your Extension.
2. Your account and identity
2.1 Publish under a publisher account with accurate details. Keep your publishing tokens and CI credentials secure, and tell security@cusp.run immediately if they're compromised.
2.2 Verified namespaces (for example a domain-verified publisher) must belong to you. Don't impersonate another person, company or project, or choose names designed to be confused with others (typosquatting). We may reserve, reassign or hold names to prevent confusion or abuse.
2.3 If you're a trader under EU law (you publish in the course of a business), you must give us the trader information we ask for, such as your legal name, address, email, phone number and company registration, and we may show it on your Listing as the EU Digital Services Act requires.
3. Licence to us
3.1 You keep ownership of your Extension. You grant us a worldwide, non-exclusive, royalty-free licence, for as long as your Extension is listed and afterwards as described in 3.2, to:
- host, store, copy, cache and distribute it to Users, and let Users install and run it;
- analyse it: scan its code and model-visible text, infer its capabilities, pin its tool descriptions, run its eval suite against models, and publish the results;
- countersign it, record it in our transparency log and include it in revocation lists;
- display your name, logos, README and screenshots on the Hub and in the app, and in materials promoting the Hub; and
- make technical changes needed to do the above (such as format conversion), without changing what it does.
3.2 Transparency log entries, signatures and revocation records are permanent by design, and we keep them after you remove an Extension. Users who already installed a version may keep using it under its licence, unless we revoke it for security reasons.
4. Licence to Users
4.1 Your Extension must include a licence for Users, stated as an SPDX identifier in the manifest. You may use an open-source licence or your own terms.
4.2 If you don't state a licence, you grant each User a non-exclusive, worldwide, royalty-free licence to install, use and copy your Extension for use with Cusp, for as long as they comply with its terms.
4.3 You must have all the rights needed to publish your Extension, including the right to distribute any third-party code, models, data or assets it contains, and you must comply with their licences and attribution requirements.
5. Requirements for Extensions
Your Extension must:
- do what its Listing says, and declare accurately the capabilities it needs (file access, shell, network hosts, secrets, credentials, communications) in its manifest. Don't hide behaviour from our analysis or behave differently when you detect review or evaluation;
- not contain malware, spyware, cryptominers, backdoors, obfuscated or remotely loaded code designed to avoid review, or anything that tries to escape the sandbox or the permission system;
- not contain hidden or deceptive instructions aimed at the agent (prompt injection), such as text that tells the model to ignore the user, exfiltrate data or approve actions;
- not collect, use or share Users' personal data, code or secrets except as needed for its stated purpose, disclosed in the Listing, and in line with the law (including UK and EU GDPR). If it sends data to your servers, publish a privacy notice and link it in the manifest;
- not change its capabilities, tool descriptions or behaviour in an update without publishing a new version (the app asks Users to re-consent when capabilities grow);
- comply with the Acceptable Use Policy and the law; and
- not include ads, tracking or affiliate links that Users haven't clearly opted into.
6. Reviews, scores and evidence
6.1 Listings show evidence: computed labels, scan verdicts, eval reports (marked Hub-run or self-reported), provenance and User reviews. You may comment on them and ask us to re-run checks, but you may not manipulate them, for example by posting fake reviews, buying installs or submitting false eval reports.
6.2 Our labels and scores describe what our analysis found at a point in time. They're not an endorsement or a guarantee, by us or to you.
7. Review, removal and revocation
7.1 We may hold, reject, delist, yank or revoke an Extension, or suspend a publisher account, if we reasonably believe:
- it breaks these terms, the Acceptable Use Policy or the law;
- it puts Users, their data or our systems at risk;
- we've received a credible notice that it infringes someone's rights or is illegal; or
- we're required to by law or by a platform we depend on.
7.2 Where we can, we'll tell you what we're doing and why, give you a chance to fix the problem, and tell you how to appeal. We may act without notice when there's an active security threat (for example, a compromised version) and will tell you afterwards. You can appeal a decision by replying to our notice or emailing hub@cusp.run; a person who wasn't involved in the original decision will review it.
7.3 If we revoke a version for security reasons, the app may disable it on Users' devices.
8. Mirrored listings
The Hub also shows metadata about extensions published elsewhere (for example in public MCP registries). If you own a mirrored project and want to claim, correct or remove its Listing, email hub@cusp.run. We list content whose licence forbids redistribution by link only.
9. Support and security
9.1 You're responsible for supporting your Extension. Give Users a way to contact you (an issue tracker or email).
9.2 Tell us at security@cusp.run within 72 hours if you learn of a vulnerability or compromise in your Extension that puts Users at risk, and publish a fixed version promptly.
10. Fees
The Hub is free for publishers and Users today. Paid Extensions aren't available. If we introduce them, we'll publish separate terms, including any revenue share, payout, tax and refund rules, and you'll need to accept them before selling.
11. Liability and indemnity
11.1 The Hub is provided "as is". To the extent the law allows, we aren't liable to you for loss of profits, revenue or goodwill, or for indirect or consequential loss, and our total liability to you under these terms is limited to £100. Nothing limits liability that can't be limited by law.
11.2 You'll defend and compensate us against third-party claims, and the resulting losses, costs and reasonable legal fees, arising from your Extension, your breach of these terms, or an allegation that your Extension infringes someone's rights or the law.
12. Ending these terms
You can remove your Extensions and close your publisher account at any time. We may end these terms by giving you 30 days' notice, or immediately under section 7. Sections 3.2, 11 and 12 survive.
13. General
These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. The general terms in section 24 of the Terms of Service also apply. Contact: hub@cusp.run.