Add AI NetCafe plugin (6 deterministic tools, mainland-China reachable)

[mario03690]

【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）

Plugin Submission

Plugin information

• Author: mario03690
• Plugin name: netcafe (AI NetCafe)
• Version: 0.0.1
• Source repository: https://github.com/mario03690/dify-netcafe
• Contact: https://ainetcafe.com

Submission type

• New plugin
• Version update

What changed

First submission. Six deterministic tools for Dify workflows and agents:

Tool	What it does
China Reachability Check	Test whether a URL is reachable from mainland China: HTTP status, latency, DNS from a Chinese resolver. Measured from a real mainland network.
Reconcile Bank vs Ledger	Reconcile a bank statement against a ledger with no shared reference number — matches on amount, date window and references found in free text; handles instalments (1:N) and combined payments (N:1); reports ambiguous cases instead of forcing a match.
Diff Two Tables	Compare two tables on a key column: only in A, only in B, changed values.
Find Duplicate Companies	Detect the same company written under different names, cross-checked against tax-ID checksums, phone, domain and address. Never auto-merges — returns evidence, and flags look-alike pairs that are provably different.
Look Up US HS Code	Look up a US HS/HTS tariff code against the official USITC schedule and verify the exact code exists.
Read Excel File	Read an .xlsx from a URL: dates as YYYY-MM-DD instead of serial numbers, leading zeros preserved, merged cells reported.

Every tool is deterministic — no model call inside, so results are repeatable, and each result
involving counts or money carries an arithmetic self-check computed in code. If the numbers do
not reconcile, the response says so rather than returning a table nobody can verify.

No API key is required. Anonymous calls draw on a free quota; an optional AllRouter key removes
the quota limit.

Risk level

• Low risk
• Medium risk
• High risk

Selected High deliberately, per "when more than one level seems possible, choose the higher
level". Two triggers apply: the plugin fetches user-provided URLs, and the reconciliation tools
process financial data (bank statements).

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below. See limitation below — please read.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries.
• The plugin README includes setup steps, usage instructions, credential requirements, and the source repository link.
• The plugin includes PRIVACY.md, and manifest.yaml references it.
• All user-facing text is primarily in English; the Chinese README is at readme/README_zh_Hans.md.

Testing limitation (stated plainly)

I have not installed this on a running Dify Community Edition or Dify Cloud instance. What I
did verify:

• All six tools invoked successfully against the live API through the plugin's own client code.
• Every tool YAML resolves to an existing module and Tool subclass; provider credential
  validation path exercised.
• pip install -r requirements.txt clean; packaged with dify-plugin CLI v0.6.10; the packaged
  archive re-opens with all six tool YAML/PY pairs present.

If the reviewer would prefer an install test on a live instance before merging, say so and I will
run one and report back rather than leave this box ambiguous.

Security and privacy notes

Sensitive capabilities, disclosed:

• User-provided URL fetching. China Reachability Check requests a user-supplied URL, and
  Read Excel File downloads a user-supplied file URL. Both are forwarded to the AI NetCafe API,
  which performs the fetch; the plugin itself does not proxy or crawl.
• Financial data. The reconciliation and table tools accept bank statement and ledger content
  as CSV text supplied by the user.

Boundary and mitigations:

• Client code uses the Python standard library only — no third-party HTTP stack, nothing bundled.
• All requests go to a single fixed host, https://ainetcafe.com, over HTTPS. No user-controlled
  network destination: the URL parameter is data sent to that host, not a destination.
• Request timeout is set (120s) on every call.
• The optional API key is read from Dify's encrypted credential store and sent only as an
  Authorization header. It is never written to logs and never included in error text.
• Table contents are processed in memory and not retained as files. Tools that produce a file
  return a hosted URL — this is documented in README.md and PRIVACY.md so users know not to
  pass data they are unwilling to have hosted.
• Errors surface the API's own guidance text; they do not echo credentials.

Privacy policy: PRIVACY.md in the package.