We need an API access to plugins. Its an AI driven jungle out there.

I propose we do 2 API endpoints that can be linked to plugins:

1) an endpoint that describes what internal api usages are served by plugins (documentation/formats/pesmissions needed etc)
2) one generic endpoint to call any of the plugin api actions with the specs given by 1

This will give an option to have that all also exposed via an MCP to agentic with tool descriptions etc.

Since its a security sensitive thing, I propose to add a global allow flag disabled by default that will allow/deny all plugin api access.