// the take
A reference implementation of a ChatGPT plugin (the OpenAI plugin standard from early 2023) that lets ChatGPT read, add, and delete items on a per-user TODO list via a small Quart HTTP API. It's aimed at developers learning the plugin manifest/OpenAPI/auth conventions OpenAI required at the time, not at anyone who wants an actual TODO app.
Minimal and readable — main.py, manifest.json, and openapi.yaml are each small enough to read end to end in a few minutes, which makes it a decent skeleton to fork for a different plugin. The auth middleware (before_request bearer check) and the ai-plugin.json/openapi.yaml templating via Host header are a faithful, working example of what OpenAI's plugin spec actually demanded. CORS is scoped to localhost and chat.openai.com rather than left wide open.
Storage is a plain Python dict (TODOS) with no persistence — a Replit restart or redeploy wipes every user's list. The ChatGPT plugin platform this targets was deprecated by OpenAI in 2024 in favor of GPTs/Actions, so the thing it's a reference for no longer exists; nothing has been pushed since March 2023 and there are no tests. Auth is a single shared bearer token for all users (SERVICE_AUTH_KEY), so there's no per-user authorization — anyone with the token can read or delete any other user's todos by username. The delete endpoint also indexes todos by position (todo_idx), which is a race condition waiting to happen under concurrent requests.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →