BailingHub Tool Plugin for Dify

Use a Dify Agent or Workflow to submit business actions through a self-hosted
BailingHub control plane.

The plugin intentionally exposes only three control-plane tools:

• : submit an action to an administrator-configured route;
• : read the current state and terminal result of a job;
• : poll a job for a bounded period without waiting indefinitely.

It does not import governed business APIs into Dify and does not give Dify admin,
executor, or business-system credentials.

Simplified Chinese

Source and Support

• Source: github.com/bailinghub/bailinghub-dify-plugin
• Bug reports and support: GitHub Issues
• Security reports: use this repository's private Security Advisory channel as described in
  SECURITY.md.

Project Boundary

This repository is an independent integration adapter. It is not:

• part of the ACC normative specification;
• embedded in the BailingHub server distribution;
• versioned or released together with ACC or BailingHub;
• an official Dify partnership or certification.

The dependency is one-way: this plugin consumes BailingHub's public Client API.
See Project Boundaries and
Compatibility.

Requirements

• Dify with Tool Plugin support;
• a reachable self-hosted BailingHub instance;
• a dedicated BailingHub Client Token restricted to the routes Dify needs;
• HTTPS between Dify and BailingHub, except for loopback development.

Configure

1. In BailingHub, create a dedicated client for this Dify application.
2. Allow only the required routes and set an appropriate rate limit.
3. Install this plugin in Dify.
4. Configure:
   • : the BailingHub HTTPS origin;
   • : the raw client token, without a prefix.

Never use an admin token, executor token, tool-provider secret, or business-system
credential as the Client Token.

Workflow Pattern

1. Generate a deterministic in the workflow, for example
   .
2. Call with an administrator-provided route.
3. Save the returned .
4. Call for a short bounded wait, or call from a later step.
5. Treat as success. Treat and as terminal failures.

, , and are non-terminal. If a bounded wait times out,
query the same later. Do not submit a replacement action. When retrying the
same business request, reuse the same without changing its meaning or
arguments.

Security Model

• Route choice is constrained again by the BailingHub client allowlist.
• and are not plugin inputs and cannot be overridden by a model.
• Responses are limited to 1 MiB and filtered to job state and result fields.
• Arbitrary upstream response bodies are not exposed as errors.
• Non-loopback HTTP base URLs are rejected.
• Final business authorization remains in the business system.

The plugin is an adapter to governance enforcement; it is not the final authorization
boundary and does not make model output trustworthy.

The plugin sends requests only to the BailingHub base URL configured by the Dify
administrator. See PRIVACY.md for the complete data-flow disclosure.

Development

Python 3.12 and uv are recommended.

Package with a pinned Dify Plugin CLI as described in Releasing.

Related Documentation

• BailingHub Dify integration recipe
• BailingHub HTTP contract
• Dify Tool Plugin guide

License

Apache License 2.0. See LICENSE.