Flocks Hub

Flocks Hub is Flocks' local plugin hub. It is used to browse, filter, preview, install, and uninstall plugin capabilities released locally with a Flocks version. It is not a cloud plugin marketplace. Plugins in the hub come from Flocks' local bundled directory or a locally configured plugin hub directory. After installation, they enter the local plugin directory and can be used immediately in the platform.

Flocks Hub manages Skills, Agents, Tools, Workflows, WebUI, and scenario suites from one entry point, letting users discover available capabilities on one page and use them immediately after installing them into the local plugin directory.

1. Purpose

1.1 What Flocks Hub Solves

Flocks Hub provides a secure way to discover and install local capabilities on the current host. It mainly solves four problems:

Capability discovery: centrally display Skills, Agents, Tools, Workflows, WebUI, and scenario suites released locally with the Flocks version.
Capability filtering: filter by plugin type, use case, Tag, status, trust level, and risk level.
Installation management: install, update, uninstall, and refresh plugins.
Pre-install preview: view plugin Manifest, file tree, dependencies, permissions, risks, and version information.

Its relationship with Skills, Agent, Tools, and Workflow is: Flocks Hub handles discovery and installation. After installation, capabilities enter their respective modules, where those modules handle configuration, running, and debugging.

1.2 Relationship with Other Modules

Module	Relationship
Skills	After Flocks Hub installs a Skill, it enters the Skills library and can be loaded by Rex.
Agent	After Flocks Hub installs an Agent, it enters the Agent list and can be delegated to by Rex or selected directly by users.
Tools	After Flocks Hub installs a Tool, Tools refreshes and loads the corresponding API / Python / MCP tool.
Workflow	After Flocks Hub installs a Workflow, the Workflow page can discover and run it.
Workspace	Project-level plugins are usually installed under `.flocks/plugins/` in the current project or Workspace.
WebUI and scenario suites	WebUI plugins provide pages or page components; scenario suites combine pages, tools, workflows, and other components into complete scenarios.

2. Plugin Types

2.1 Skill Plugins

Skill plugins preserve methodologies, operating standards, and domain knowledge. After installation, they usually appear on the Skills page and can be loaded by Rex in sessions as needed.

Typical uses:

Alert triage methods.
API tool generation standards.
Vulnerability investigation procedures.
Device inspection experience.

2.2 Agent Plugins

Agent plugins install expert roles. After installation, they usually appear on the Agent page, where they can be delegated to by Rex as sub-agents or selected directly by users for conversation.

Typical uses:

Intelligence analysis Agent.
Vulnerability triage Agent.
Device inspection Agent.
Data query Agent.

2.3 Tool Plugins

Tool plugins install executable tools. A tool plugin may be an API tool, local Python tool, MCP tool, or generated tool. After installation, the tool runtime refreshes so Rex, Agents, and Workflows can call it.

Tool plugins require particular attention to permission and risk information, such as whether they need network access, Shell permissions, file system read/write permissions, or external credentials.

2.4 Workflow Plugins

Workflow plugins install runnable workflows. After installation, they can be viewed, tested, run, or further modified on the Workflow page.

Typical uses:

NDR alert triage workflow.
Periodic asset verification workflow.
Fixed vulnerability investigation flow.
Data pull and report generation flow.

2.5 WebUI Plugins

WebUI plugins install pages or page components. After installation, related entry points appear in Flocks WebUI. They usually need to work with Tools, Workflows, or scenario suites to form a complete business capability.

Typical uses:

SOC Workspace page.
Device or data source management extension pages.
Scenario-specific result viewing and operation pages.

2.6 Scenario Suites

Scenario suites combine multiple plugins into a directly usable business scenario. They usually install pages, tools, workflows, or other components together. This is suitable for enabling a complete capability at once instead of installing individual plugins one by one.

Typical uses:

SOC Workspace scenario suite.
Alert operations capability bundle.
Packaged pages, tools, and workflows for a specific security scenario.

3. Page Structure

3.1 Top Action Area

The top of the Flocks Hub page provides:

Search box: search plugin names, descriptions, Tags, and use cases.
Directory view / table view switch: browse by plugin directory tree or by table list.
Refresh: reread the current local catalog and installation status.

3.2 Filter Area

Filters support:

Type: Skill, Agent, Tool, Workflow, WebUI, scenario suite.
Use case: filter by the use case declared by plugins.
Tag: filter by tags.
Status: available, installed, update available, incompatible, and so on.

When many filters are selected, you can expand more filters or clear all filters with one click.

3.3 Plugin List

Table view shows:

Plugin type.
Plugin name and description.
Tag.
Current status.
Install, update, or uninstall actions.

Directory view shows plugin locations according to the flockshub file tree, which helps you understand where the plugin actually comes from and where its Manifest is located.

3.4 Plugin Details

Click a plugin to view details. The details page usually includes:

Overview: plugin ID, name, description, type, category, tags, trust level, and risk level.
Flowchart: Workflow plugins can display a visual flow of workflow.json.
Files: view the plugin file tree and previewable file content.
Dependencies: view required Skills, Tools, Python packages, or external dependencies.
Permissions: view tool permissions, network permissions, Shell permissions, and file system access scope.
Version: view version number, installed version, source, and Manifest information.

4. Plugin Status

4.1 Status Meanings

Status	Description
`available`	Installable; not currently installed on this machine.
`installed`	Installed; current version matches the version in Flocks Hub.
`updateAvailable`	Installed, but a newer version exists in Flocks Hub.
`localOnly`	A local plugin exists, but there is no matching entry in the Flocks Hub catalog.
`broken`	Plugin manifest, directory, or installation state is abnormal.
`incompatible`	Incompatible with the current Flocks version, system, or dependencies.

4.2 Trust Level and Risk Level

The plugin Manifest contains trust level and risk level:

Trust level: official, verified, community, experimental, deprecated.
Risk level: low, medium, high.

Before installation, review permissions carefully for Tool plugins and high-risk plugins. If a plugin requires network, Shell, or file system read/write permissions, confirm that the source is trustworthy and the purpose is clear, and validate it in a test environment when possible.

5. Install, Update, and Uninstall

5.1 Install Plugins

Steps:

Go to Agent Studio -> Flocks Hub.
Search or filter for the target plugin.
Click the plugin to inspect Manifest, files, dependencies, permissions, and risks.
Click Install after confirmation.
After installation, go to the corresponding module to verify that the plugin appears.

After installation, Flocks refreshes the relevant runtime:

Skill: refresh Skill cache and invalidate Agent cache.
Agent: refresh Agent cache.
Tool: refresh tool registry, plugin tools, and API service descriptions.
Workflow: attempt to rescan workflows.
WebUI: refresh page components and frontend extension entry points.
Scenario suite: install the pages, tools, workflows, and other suite components, and refresh related runtimes item by item.

5.2 Update Plugins

When plugin status is updateAvailable, click Update. Update logic is equivalent to reinstalling the new version: it overwrites the old installation directory and refreshes the runtime.

Before updating, review release notes, permission changes, and dependency changes. In critical production environments, validate in a test environment first.

5.3 Uninstall Plugins

Installed plugins can be removed by clicking Uninstall. After uninstallation, Flocks removes the installation directory, deletes the Flocks Hub installation record, and refreshes the corresponding runtime.

Notes:

Project-bundled plugins cannot be deleted directly through Flocks Hub.
Only user-manageable Flocks Hub plugin installations can be uninstalled.
When uninstalling a Tool plugin that contains API service descriptions, the system cleans up API service configuration no longer used by other plugins.
When uninstalling a scenario suite, the pages, tools, workflows, and other components belonging to that suite are removed.

5.4 Install the SOC Workspace Scenario Suite

The SOC Workspace scenario suite is a composite plugin in Flocks Hub. Go to Agent Studio -> Flocks Hub, filter by Scenario Suite, find SOC Workspace Scenario Suite, and click Install. The installation process handles suite components one by one, including the SOC Workspace UI, SOC Workspace operation tools, alert denoising workflow stream_alert_denoise, and alert triage workflow stream_alert_triage.

If a component is already installed, the installation progress shows it as skipped or installed. After suite installation is complete, the list status changes to Installed, and the action button changes to Uninstall.

For the full operation and screenshots, see SOC Workspace Scenario Suite.

6. File Structure and Installation Location

6.1 Flocks Hub Catalog Sources

Flocks Hub reads the local bundled directory by default. The system searches in this order:

Directory specified by the FLOCKS_HUB_ROOT environment variable.
.flocks/flockshub/ under the current project directory.
.flocks/flockshub/ under the current working directory or its parent directories.
.flocks/flockshub/ within or alongside the Flocks installation package.

The current catalog is filesystem backed. Clicking refresh rereads the directory and returns the current plugin count.

6.2 Flocks Hub Directory Structure

A typical Flocks Hub directory structure:

text

.flocks/flockshub/
├── index.json
├── taxonomy.json
└── plugins/
    ├── skills/
    ├── agents/
    ├── tools/
    ├── workflows/
    └── components/

Each plugin usually contains a manifest.json, declaring plugin type, name, version, category, tags, use cases, dependencies, permissions, risks, entry files, and integrity information. Composite capabilities such as WebUI plugins and scenario suites are usually placed under components/.

6.3 Installation Locations

Flocks Hub installation supports user-level and project-level directories. The current page installs to the user-level plugin directory by default:

Plugin Type	User-Level Installation Directory
Skill	`~/.flocks/plugins/skills/<plugin_id>/`
Agent	`~/.flocks/plugins/agents/<plugin_id>/`
Workflow	`~/.flocks/plugins/workflows/<plugin_id>/`
Tool	`~/.flocks/plugins/tools/<plugin_id>/` or `~/.flocks/plugins/tools/<group>/<plugin_id>/`
WebUI	`~/.flocks/plugins/components/<plugin_id>/`
Scenario suite	Written to the corresponding plugin directories by component

If a Tool plugin comes from api/, python/, mcp/, or generated/ groups, the group directory is preserved to avoid losing API tool descriptions and Python tool load paths.

6.4 Installation Records

Flocks Hub maintains local installation records:

text

~/.flocks/data/hub/installed.json

Records include plugin ID, type, version, source, installation time, enablement status, installation scope, installation path, and other information. The Flocks Hub page combines the catalog and installation records to determine plugin status.

7. Security and Compatibility

7.1 Pre-Install Checks

Before installation, review:

Plugin source and trust level.
Risk level and risk reasons.
Dependent Skills, Tools, Python packages, and external components.
Whether network access is required.
Whether Shell permissions are required.
File system access scope.
Whether plugin file content matches expectations.

7.2 Package Security Checks

During Flocks Hub installation, plugin packages are checked and common irrelevant directories are skipped or blocked, such as __pycache__, .git, .svn, and .DS_Store. These directories are also excluded during installation to avoid copying development cache or version control directories into the user plugin directory.

7.3 Incompatible and Broken Plugins

If a plugin status is incompatible, it may not be suitable for the current Flocks version, operating system, or dependency environment. If the status is broken, the Manifest, directory, or installation record may be abnormal.

Troubleshooting steps:

Refresh the Flocks Hub catalog.
View brokenReason or Manifest in plugin details.
Check whether the installation directory exists.
Check installation records in ~/.flocks/data/hub/installed.json.
Uninstall and reinstall if necessary.

8. Real Example: Install an Alert Triage Skill

8.1 Find the Plugin

Open Flocks Hub and enter in the search box:

text

alert triage

Or filter by type Skill to find related skill plugins.

8.2 Pre-Install Review

Click the plugin and review:

Name, version, and description in the Manifest.
Use cases and tags.
SKILL.md in the file list.
Dependency and permission information.
Risk level.

8.3 Install and Verify

After clicking Install, go to Skills and confirm that the Skill appears. Then ask Rex in a session to run a related task, for example:

text

Based on the alert triage Skill, help me analyze this NDR alert.

If Rex loads the methodology correctly and produces results, the Flocks Hub installation has taken effect.

9. FAQ

9.1 What Is the Difference Between Flocks Hub and the Skills Page?

Flocks Hub is the plugin discovery and installation entry point. The Skills page is the management and usage entry point for installed Skills. After installing a Skill through Flocks Hub, go to the Skills page to view, test, edit, or uninstall that capability.

9.2 Why Do I Not See a Plugin Immediately After Installation?

First click the refresh button in the corresponding module, or refresh the browser page. If it still does not appear, check the installation directory, Flocks Hub installation record, and plugin Manifest. Tool plugins also require confirming that Tools has completed refresh.

9.3 Which Plugin Sources Does Flocks Hub Support?

It currently mainly supports bundled plugin directories released locally with Flocks versions and locally configured plugin hub directories. The source structure in Manifest also reserves github and cloud types for future expansion or external source descriptions. This page describes the local plugin hub, not a cloud plugin marketplace.

9.4 Can I Put My Own Plugins into Flocks Hub?

Yes. Organize the plugin directory under .flocks/flockshub/plugins/<type>/<plugin_id>/ and provide manifest.json. Then refresh Flocks Hub, and the system rereads the local catalog.

9.5 What Is the Difference Between Flocks Hub Installation and Manually Copying Plugins?

Manual copying only writes files to disk. Flocks Hub installation also records installation state, keeps version information, refreshes runtimes, and cleans up orphaned API service configuration when uninstalling Tool plugins.

Skills: Management entry after Flocks Hub installs a Skill.
Agent: Management entry after Flocks Hub installs an Agent.
Tools: Management entry after Flocks Hub installs a Tool.
Workflow: Management entry after Flocks Hub installs a Workflow.
Workspace: Organizational boundary for project-level plugins and outputs.
SOC Workspace Scenario Suite: Example of scenario suite installation, configuration, and uninstallation.

Flocks Hub

1. Purpose

1.1 What Flocks Hub Solves

1.2 Relationship with Other Modules

2. Plugin Types

2.1 Skill Plugins

2.2 Agent Plugins

2.3 Tool Plugins

2.4 Workflow Plugins

2.5 WebUI Plugins

2.6 Scenario Suites

3. Page Structure

3.1 Top Action Area

3.2 Filter Area

3.3 Plugin List

3.4 Plugin Details

4. Plugin Status

4.1 Status Meanings

4.2 Trust Level and Risk Level

5. Install, Update, and Uninstall

5.1 Install Plugins

5.2 Update Plugins

5.3 Uninstall Plugins

5.4 Install the SOC Workspace Scenario Suite

6. File Structure and Installation Location

6.1 Flocks Hub Catalog Sources

6.2 Flocks Hub Directory Structure

6.3 Installation Locations

6.4 Installation Records

7. Security and Compatibility

7.1 Pre-Install Checks

7.2 Package Security Checks

7.3 Incompatible and Broken Plugins

8. Real Example: Install an Alert Triage Skill

8.1 Find the Plugin

8.2 Pre-Install Review

8.3 Install and Verify

9. FAQ

9.1 What Is the Difference Between Flocks Hub and the Skills Page?

9.2 Why Do I Not See a Plugin Immediately After Installation?

9.3 Which Plugin Sources Does Flocks Hub Support?

9.4 Can I Put My Own Plugins into Flocks Hub?

9.5 What Is the Difference Between Flocks Hub Installation and Manually Copying Plugins?

10. Related Modules