feat: goat-plugin-satohub — Preflight and search as a GOAT SDK plugin

[satohubai]

Adds packages/goat-plugin-satohub: Sato Hub Preflight and index search as a GOAT SDK plugin. Do not merge until the owner has reviewed it. It is not published to npm.

Why it lives here and not in goat-sdk/goat

Upstream is closed to new plugins:

• On 2026-07-02 the README got a banner saying the repo is archived, is "a read-only historical snapshot", and accepts no issues, pull requests or updates. Commit f2eedc2.
• The last merged PR was #523 on 2025-08-19. Third-party plugin PRs since then are still open with no review, for example #598 (2026-08-15), #596, #589, #587 and #581.
• @goat-sdk/core 0.5.0 (last published 2025-05-13) still gets about 1.6k downloads a week (api.npmjs.org, week ending 2026-09-21). People are still building on it, so the plugin ships as its own npm package.

What it is

Two tools, following GOAT's layout (satohub.plugin.ts, satohub.service.ts, parameters.ts, @Tool + createToolParameters):

Tool	Wraps
satohub_preflight	satohub-core preflight() → GET /api/preflight (Ed25519-signed)
satohub_search_resources	satohub-core searchResources() → MCP onchain_agent_search_resources

• Keyless and read-only. Neither tool takes the wallet client. The tests use a wallet that records every call and assert that nothing called it.
• Payload comes back verbatim, with provenance under _sato (signature state, source, citation ask), the same envelope the LangChain package uses. Descriptions and schemas are satohub-core's, imported as they are.
• unknown is labelled honestly. When the verdict is unknown, _sato.reading says Sato Hub holds no record, and that this is not a finding.
• Failures stay failures. A network error, a timeout or a non-2xx response throws SatohubRequestError, and its message says it is not a verdict. On a 4xx, Sato Hub's own one-line error is passed along (for example "?token= needs ?chain="). A signature that doesn't match still throws SatoSignatureError.
• The default User-Agent is goat-plugin-satohub/0.1.0. It does not start with SatoHub-, because Sato Hub's Observatory counts that prefix as our own traffic, and a GOAT agent using this plugin is not us.
• Chain-agnostic: supportsChain returns true.

Real output

This call went through GOAT's own getTools and hit satohub.ai on 2026-09-23. The first evidence list is cut to three lines:

$ satohub_preflight {"repo":"coinbase/agentkit"}
go R5 signature: verified
- Directory record: Listed as Coinbase AgentKit (Developer Tool).
- Public activity: Last public activity today (active).
- Sato Score: 88 of 100, tier High. The score measures how open, active and verifiable the project is, not safety or quality.
cite: https://satohub.ai/resources/coinbase-agentkit

$ satohub_preflight {"package":"some-unlisted-package-xyz"}
unknown R4 signature: verified
- Directory record: No listing matches this identifier.
reading: unknown means Sato Hub holds no record of this target. It is not a finding and not a sign that anything is wrong; it means this check has nothing to say, so decide by other means.
cite: null

$ satohub_search_resources {"query":"wallet","chain":"Base","limit":3}
keys: total, count, offset, has_more, next_offset, resources, meta, _sato
- Coinbase AgentKit — Sato Score 88 — https://satohub.ai/resources/coinbase-agentkit?utm_source=mcp&utm_medium=agent
- Zerion — Sato Score 85 — https://satohub.ai/resources/zerion?utm_source=mcp&utm_medium=agent
- Bankr — Sato Score 87 — https://satohub.ai/resources/bankr?utm_source=mcp&utm_medium=agent

Checks run locally (Node 25)

• npm run typecheck: all six workspaces clean
• npm test: 55/55 (goat-plugin-satohub 16, elizaos 14, core 14, ai-sdk 6, langchain 5). Every test uses a mocked fetch.
• biome check with GOAT's own typescript/biome.json: clean
• npm pack --dry-run -w goat-plugin-satohub ships only dist/, README.md, LICENSE and package.json

Owner step after merge

Run npm publish --access public -w goat-plugin-satohub (see PUBLISHING.md). satohub-core@0.1.0 is already on npm. There is no upstream registry PR to follow, because GOAT is archived.

🤖 Generated with Claude Code