VRCNext Plugins

Build plugins for VRCNext — without modifying VRCNext.

VRCNext ships no plugin API. The plugin system adds one by installing itself as a VRCNext custom theme: a folder under ~/.config/VRCNext/custom-themes/ whose JavaScript VRCNext injects into its own page. That folder lives in the config directory, not the install tree, so app updates leave it alone.

The page runs one static bundle containing the host and every installed plugin. The VRCNext Bridge, a small native daemon, produces it: it clones plugin repositories over HTTPS with pure-Rust git, checks them, and runs a pinned esbuild. The page never evaluates code at runtime and never fetches anything on its own. Without the bridge there is no install, no state and no build — it is mandatory, and the installer sets it up in one command.

Users install a plugin by pasting its repository URL into the Plugins tab. One repository is one plugin: plugin.json and main.ts at the root.

Thirty-second version

import { definePlugin, type PluginId } from '@vrcnext/plugin-api';

export default definePlugin({
  id: 'my-plugin' as PluginId,
  activate(ctx) {
    ctx.gameLog.onType('gl_player_join', (entry) => {
      ctx.notifications.toast({ message: `${entry.message} joined.` });
    });
  },
});

Put that in main.ts, declare "permissions": ["gamelog"] in plugin.json, push, and paste the repository URL into the Plugins tab. The bridge compiles it; nothing is built on your side.

What plugins can do

Documentation

Using VRCNext plugins

Writing one — start here

Capabilities

Plugins

Reference

Contributing

Internals

Repositories

A note on trust

Plugins run inside the VRCNext page with the full authority of the user’s VRChat session. There is no sandbox. The permission model makes each capability declared and each concrete use confirmed, and the source policy keeps plugins on the ctx.* path — neither contains a plugin that is determined to misbehave. Every tree must also be signed by its author, and a plugin stays pinned to the key it was installed with, so a repository changing hands cannot quietly become an update. Installing a plugin is still equivalent to running a program from that repository. See the security model.