Skip to content

Commit 0fbc3f6

Browse files
committed
docs: correct the plugin pages against the current code
A sweep over the plugin documentation, checking every factual claim against the backend and the frontend that consumes it, plus the pages elsewhere that repeat those facts. The corrections that change what a reader would write: the Action return contract, where every example returned a bare content dictionary that the frontend ignores, so the examples silently did nothing; the confirmation and input examples that used the event emitter instead of the event caller and therefore could never receive an answer; the code execution example that was Python in a slot that runs JavaScript in the browser; a metadata field used on two pages to tell WebUI requests from API ones that has never existed; the Responses API stream event shape, which was undocumented, along with the fact that editing only the deltas is undone before the message is saved; and reserved arguments whose type, shape or hook scope was wrong. Also refreshed against renamed UI (Integrations, Model Defaults, Import From Link, the iframe sandbox toggles), removed a citation flag that has done nothing since the 2025 tools refactor, corrected the event caller timeout, which has no default rather than 300 seconds and returns an error dictionary rather than raising, and documented that a function whose module fails to load is switched off automatically.
1 parent 1fb467d commit 0fbc3f6

25 files changed

Lines changed: 296 additions & 264 deletions

File tree

docs/ecosystem/knowledge-base-sync/daemon.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ It serves a spec at `GET /openapi.json` exposing exactly three actions (the dash
223223
To connect it:
224224

225225
1. **Secure it first.** Set `OIKB_API_KEY` so `/sync` and `/history` are not open to anyone who can reach the daemon.
226-
2. Add the daemon's URL (for example `http://oikb:8080`) as a tool server: **Admin Settings → External Tools** for an instance-wide connection, or **Settings → Tools** for a personal one. Supply the same `OIKB_API_KEY` as the connection's API key.
226+
2. Add the daemon's URL (for example `http://oikb:8080`) as a tool server: **Admin Settings → Integrations** for an instance-wide connection, or **Settings → Integrations** for a personal one. Supply the same `OIKB_API_KEY` as the connection's API key.
227227

228228
This is a standard OpenAPI tool-server connection, the same mechanism described on the [OpenAPI / MCP tool servers](/features/extensibility/mcp) page; oikb just happens to be the thing on the other end.
229229

docs/features/chat-conversations/chat-features/code-execution/artifacts.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ If you encounter an issue where the code preview in the chat interface does not
126126
**Solution:**
127127

128128
1. Go to **Settings > Interface**.
129-
2. Toggle on **Allow Iframe Sandbox Same-Origin Access**.
129+
2. Toggle on **iframe Sandbox Allow Same Origin**.
130130
3. Save your settings.
131131

132132
### Artifact Preview Is Blank After Setting a CSP

docs/features/extensibility/community.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,12 +60,12 @@ A hand-picked set to show what is possible, grouped by plugin type. **Highlighti
6060

6161
| Plugin | What it does |
6262
| :--- | :--- |
63-
| **[Inline Visualizer (Streaming)](https://github.com/Classic298/open-webui-plugins/tree/main/inline-visualizer-v2)** | Renders dashboards, charts, diagrams and interactive HTML/SVG **live as the model streams them**, painted inline in the chat instead of after the reply finishes. Includes 46-language localization, light/dark theming, a configurable Content Security Policy, and interactive bridges (`sendPrompt()`, `copyText()`, toasts, state save/load). Requires the **Allow iframe same origin** user setting; ships with a companion [Skill](/features/workspace/skills). |
63+
| **[Inline Visualizer (Streaming)](https://github.com/Classic298/open-webui-plugins/tree/main/inline-visualizer-v2)** | Renders dashboards, charts, diagrams and interactive HTML/SVG **live as the model streams them**, painted inline in the chat instead of after the reply finishes. Includes 46-language localization, light/dark theming, a configurable Content Security Policy, and interactive bridges (`sendPrompt()`, `copyText()`, toasts, state save/load). Requires the **iframe Sandbox Allow Same Origin** user setting; ships with a companion [Skill](/features/workspace/skills). |
6464
| **[MCP App Bridge](https://github.com/Classic298/open-webui-plugins/tree/main/mcp-app-bridge)** | Discovers and calls tools on any [MCP](/features/extensibility/mcp) server, then renders the app's UI resources as **sandboxed interactive embeds inline in the chat** via Open WebUI's Rich UI pipeline. Honors server-declared CSP and domain policies (connect/resource/frame) and auto-resizes the iframe. Needs a reachable MCP server with a streamable HTTP endpoint. |
65-
| **[Email Composer](https://github.com/Classic298/open-webui-plugins/tree/main/email-composer)** | Turns a natural-language request into a ready-to-send email in an **interactive Rich UI card**: rich-text body with formatting toolbar, To/CC/BCC management, priority badges, word/character count, copy-as-rich-text, download as `.eml`, and one-click send via `mailto:`. Needs native function calling; autosave uses the **Allow iframe same origin** setting. |
65+
| **[Email Composer](https://github.com/Classic298/open-webui-plugins/tree/main/email-composer)** | Turns a natural-language request into a ready-to-send email in an **interactive Rich UI card**: rich-text body with formatting toolbar, To/CC/BCC management, priority badges, word/character count, copy-as-rich-text, download as `.eml`, and one-click send via `mailto:`. Needs native function calling; autosave uses the **iframe Sandbox Allow Same Origin** setting. |
6666
| **[Sub Agent](https://github.com/Skyzi000/open-webui-extensions/blob/main/tools/sub_agent.py)** | Delegates tool-heavy, multi-step tasks to autonomous **sub-agents that run in an isolated context** and return only the final result, so the main conversation does not fill with intermediate tool calls. Runs sub-agents in parallel, with allow/exclude lists controlling which tools (regular, MCP, terminal, builtin) and skills each one may use. Needs native function calling. |
6767
| **[Ollama Model Card Generator](https://openwebui.com/posts/ollama_model_card_generator_ee80d7a1)** | **Admin tool.** Auto-generates rich model cards for installed Ollama models from `/api/show` metadata: descriptions, display names, tags, capabilities, inference params (with VRAM-aware context capping), system and suggestion prompts, and vendor profile images, and can wrap each in a fully-enriched workspace model. 31 toggleable valves with overwrite protection; it writes to the database, so preview first. |
68-
| **[Reveal.js Slide Deck Builder](https://openwebui.com/posts/revealjs_presentation_slide_deck_builder_rich_ui_59243191)** | Lets the model generate and render fully interactive [Reveal.js](https://revealjs.com/) HTML5 slide decks inline in the chat, with 9 themes, keyboard and arrow navigation, and fullscreen. Loads Reveal.js from a CDN; requires the **Allow iframe same origin** user setting. |
68+
| **[Reveal.js Slide Deck Builder](https://openwebui.com/posts/revealjs_presentation_slide_deck_builder_rich_ui_59243191)** | Lets the model generate and render fully interactive [Reveal.js](https://revealjs.com/) HTML5 slide decks inline in the chat, with 9 themes, keyboard and arrow navigation, and fullscreen. Loads Reveal.js from a CDN; requires the **iframe Sandbox Allow Same Origin** user setting. |
6969
| **[Ask User](https://openwebui.com/posts/ask_user_14182520)** | Lets the model pause and ask 1-5 clarifying questions in sequential pop-up dialogs before it answers, then feeds the collected answers back into its context. Bounded by design (max 5 questions, no open-ended follow-up loops), so vague requests get pinned down cleanly. |
7070

7171
### Actions

docs/features/extensibility/mcp.mdx

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ You **MUST** set the `WEBUI_SECRET_KEY` environment variable in your Docker setu
1515

1616
## 🚀 Quick start
1717

18-
1. Open **⚙️ Admin Settings → External Tools**.
18+
1. Open **⚙️ Admin Settings → Integrations**.
1919
2. Click **+ (Add Server)**.
2020
3. Set **Type** to **MCP (Streamable HTTP)**.
2121
4. Enter your **Server URL** and **Auth** details (OAuth 2.1, if required).
@@ -36,9 +36,9 @@ Entering MCP-style configuration (with `mcpServers` in JSON) into an OpenAPI con
3636

3737
## 🔒 MCP servers are admin-only {#mcp-servers-are-admin-only}
3838

39-
MCP servers can only be added by **administrators**, under **Admin Settings → External Tools**. Regular users cannot register their own, by design.
39+
MCP servers can only be added by **administrators**, under **Admin Settings → Integrations**. Regular users cannot register their own, by design.
4040

41-
This is **not** the same restriction as OpenAPI. When you grant the **Direct Tool Servers** permission (per user or per group, off by default), users can add their own **OpenAPI** tool servers under **Settings → Tools**, but that path is OpenAPI-only: the connection type is locked, with no MCP option.
41+
This is **not** the same restriction as OpenAPI. When you grant the **Direct Tool Servers** permission (per user or per group, off by default), users can add their own **OpenAPI** tool servers under **Settings → Integrations**, but that path is OpenAPI-only: the connection type is locked, with no MCP option.
4242

4343
The difference is capability. A user-supplied OpenAPI server is a stateless HTTP URL exposing a fixed set of declared endpoints. An MCP server is far more powerful: it is stateful and capability-rich (sampling, elicitation, persistent sessions and arbitrary host command execution over stdio transports), and it runs inside Open WebUI's trust boundary with the connecting user's full scope. In practice a malicious or compromised MCP server could execute code and read or exfiltrate data with that user's access, so the capability stays admin-gated. Open WebUI's own MCP support is Streamable HTTP only, but the protocol's privileged nature is why adding one is reserved for admins.
4444

@@ -105,7 +105,7 @@ With either OAuth mode, an **OAuth Scopes** setting controls which scopes Open W
105105

106106
Use this when you already have a client ID/client secret from your identity provider.
107107

108-
1. Open **Admin Settings → External Tools**.
108+
1. Open **Admin Settings → Integrations**.
109109
2. Click **+ (Add Server)**.
110110
3. Set **Type** to **MCP (Streamable HTTP)**.
111111
4. Enter your MCP server **URL**.
@@ -200,7 +200,7 @@ After adding an External Tool connection, the frontend gets stuck on a loading s
200200
You likely configured an **MCP server** using the **OpenAPI** connection type, or entered MCP-style JSON (containing `mcpServers`) into an OpenAPI connection.
201201

202202
**Solution**:
203-
1. Open **Admin Settings → External Tools** (the sidebar still loads)
203+
1. Open **Admin Settings → Integrations** (the sidebar still loads)
204204
2. **Disable** or **delete** the problematic tool connection
205205
3. Refresh the page (Ctrl+F5)
206206
4. Re-add the connection with the correct **Type** set to **MCP (Streamable HTTP)**
@@ -225,4 +225,4 @@ Yes. Many deployments do both.
225225

226226
**Can users add their own MCP servers?**
227227

228-
No. Adding MCP servers is admin-only (**Admin Settings → External Tools**). Users with the **Direct Tool Servers** permission can add their own **OpenAPI** tool servers, but not MCP. See [MCP servers are admin-only](#mcp-servers-are-admin-only) for the reasoning.
228+
No. Adding MCP servers is admin-only (**Admin Settings → Integrations**). Users with the **Direct Tool Servers** permission can add their own **OpenAPI** tool servers, but not MCP. See [MCP servers are admin-only](#mcp-servers-are-admin-only) for the reasoning.

0 commit comments

Comments
 (0)