Apps, dashboards and packages
Turn Blop Cloud features on or off for your workspace, and share dashboards between workspaces.
Every Blop Cloud feature is an app built into the release: its pages, navigation, settings, dashboard panels and the operations agents can call. Workspace members build dashboards from the queries and panels of enabled apps; each has a draft and published revisions, with history to revert. A package is a JSON manifest that carries dashboards to another workspace. Packages are data, never code: you cannot upload executable plugins.
Prerequisites
Section titled “Prerequisites”- The owner role in a Blop Cloud workspace. Only owners see Settings → Apps and publish packages; members build dashboards.
Turn an app on or off
Section titled “Turn an app on or off”- Open Settings → Apps.
- Open the app. Its page lists what it contributes, what it depends on, and the scopes and approval rules of its operations.
- Turn it off, or back on. Blop names the apps that depend on it before you confirm.
Turning an app off applies only to this workspace. Its pages and API answer 404, its operations leave blop cloud operations, and cached calls from the browser, CLI or MCP are refused. Its data is kept: turning it back on restores access for those still authorized. Settings → Data lifecycle shows what each app stores and for how long.
Apps the deployment needs, such as sign-in, permissions, the navigation shell, organization memory and management, cannot be turned off.
Share dashboards as a package
Section titled “Share dashboards as a package”- Open Overview → Workspace → New app. Build with an agent gives you a prompt to paste into your coding agent, with the workspace’s queries, panels and a valid manifest. Blop sends nothing to a model at this step.
- Upload the result as a ZIP or as
manifest.jsonin Settings → Apps, then check, preview and publish it.
A package has one root manifest.json with format: "blop.package/1" and its dashboards inline:
| Limit | Value |
|---|---|
| Manifest | 256 KiB, at most 10 dashboards |
| ZIP | 320 KiB, only the manifest: no other files, folders or links |
| Refused | Code keys (main, scripts, bin, hooks, plugins), scripts or javascript: URLs, WebAssembly, credentials, encrypted archives |
Dashboards in a package may use only queries and panels the workspace has enabled. Publishing creates or updates ordinary dashboards, each as a new revision, and goes through owner approval. Download app ZIP exports the package as installed. Removing a package keeps its dashboards.
Connections and exports
Section titled “Connections and exports”Owners add GitHub, GitLab, Slack, Linear, Jira, Discord, analytics, storage and webhook destinations in Connections → Add connection. Credentials are encrypted and never shown again or given to agents. A saved destination stays off until an owner approves activation; saving is not a test. Automatic destinations receive only finished check run metadata (IDs, project, status, timestamps, duration), never local telemetry, prompts, failure messages or artifacts, and only for runs after activation.
Webhook receivers must check that X-Blop-Timestamp is recent, compute HMAC-SHA256 with the signing secret over timestamp + "." + raw body before parsing it, compare the hex digest in constant time with X-Blop-Signature: v1=<digest>, and deduplicate on X-Blop-Event-Id. Disabling a destination stops unsent deliveries; it cannot recall data already sent. Schedule the delivery worker when you self-host.
Check it worked
Section titled “Check it worked”After turning an app off, its pages answer 404 and its operations are missing from blop cloud operations --profile work --json.
- Blop Cloud: scopes and owner approval.
- Organization memory.