A neutral index of add-ons that plug into the same core. It belongs to the ecosystem, not to any one vendor. Anyone can publish, every add-on is signed and integrity-checked, and each enterprise decides how much to trust. Neo Control lists its own products here on exactly the same rails as everyone else.
A small core plus six extension slots. An add-on reads and writes only ACA objects.
| Open track | Curated track | |
|---|---|---|
| Who publishes | Anyone, permissionless | Reviewed submissions only |
| Certification | ACA-Compatible | ACA-Verified ACA-Certified |
| Vetting | Automated | Automated, security, behavioural (plus assurance for Certified) |
| Runtime | Always sandboxed, permission-prompted | Sandboxed; may be pre-trusted per enterprise policy |
| Paid add-ons | Not the place for them | Yes, this is where commercial add-ons live |
| Best for | The long tail, velocity, experimentation | Enterprise-safe adoption and monetisation |
An enterprise can set a policy of curated-only. An individual builder can live entirely in the open track.
Transparency is the point. The decision an enterprise makes is "can I trust this," and each listing answers it up front.
Under the hood, every package carries a deterministic content hash and is signed with Ed25519. Consumers verify the signature and re-check integrity on install, so a package changed since publish is rejected. A compromised add-on can be revoked centrally, and installed instances are disabled on the next check. The same registry serves a self-hosted core and a hosted one.
Signed, verifiable add-ons in the registry. These are the open reference add-ons today; third-party and curated listings appear here as the registry fills.
The curated track, reviewed and enterprise-safe and where paid add-ons live, opens as the first commercial add-ons are certified.
Scaffold from the reference core, then publish through the signed registry.
npx @aca/core new collector yourorg/your-connector
aca-registry keygen --out mykey
aca-registry publish ./your-connector --track open --key mykey.key.pem --publisher yourorgCertification tells an enterprise what an add-on is and how far it has been checked. These are ACA marks, kept separate from any single vendor's product claims.
How it works: publishing to the open track earns Compatible immediately. Verified and Certified are granted by the curated review board against published, versioned criteria, with an appeals path. A compromised or non-conforming add-on can be revoked and its mark withdrawn. Support tiers (Community, Verified, Certified, Neo-supported) sit alongside the certification mark.
The marketplace is deployment-neutral: the same registry serves a self-hosted core and a hosted one, and no vendor owns the shelf. Neo Control is the founding steward and the first participant. Its own products, such as AI Supply Chain, Vendor Risk, Shadow AI, and the Action Fabric, list here as curated add-ons on the same rails as anyone else's, and compete on how well they work, not on owning the marketplace.