[cursor]

Unreviewed third-party plugin submission. This PR was generated from a submission form and has not been reviewed. Do not merge until someone checks the plugin, its MCP server, and its skills.

Submission

• Publisher handle: corsair
• Company: Corsair
• Contact: Pranay Haldiya [email protected]
• plugin_url: https://github.com/corsairdev/agent-plugins
• Website: https://corsair.dev
• Logo URL: https://raw.githubusercontent.com/corsairdev/agent-plugins/main/plugins/corsair/assets/icon.png
• Listing targets: Grok, Grok Bot, Cursor

Corsair connects your agent to the apps you use, such as Gmail, Slack, GitHub, Linear and Notion (about 400 in all), through one MCP server at https://mcp.corsair.dev/mcp. It searches data synced from those apps, reads them live, makes changes through a separate write tool, and sets up automations that run on a schedule or when an app sends an event. Sign-in is OAuth, and each app is connected once on Corsair.

Changes

• third_party/corsair/, copied from plugins/corsair in the publisher's repo:
  • mcp.json pointing at https://mcp.corsair.dev/mcp. The upstream file uses "type": "streamable-http"; it's "http" here to match the other plugins.
  • The four upstream skills (corsair-connect-apps, corsair-data, corsair-automations, corsair-approvals), unchanged.
  • assets/logo.png, downloaded from the submitted logo URL (512x512 PNG, the same file the repo ships).
  • LICENSE (Apache-2.0, from upstream). plugin.json sets license to Apache-2.0.
  • .cursor-plugin/plugin.json (category integrations, mcpServers: ./mcp.json, skills: ./skills/) and a README.
• Added one entry to .cursor-plugin/marketplace.json and one row to the root README integrations table. .claude-plugin/marketplace.json is unchanged.
• The upstream repo also has a corsair-sdk plugin. It isn't included because the submission is for the corsair MCP plugin.

node scripts/validate-plugins.mjs passes.

Testing instructions (from the submitter)

Add https://mcp.corsair.dev/mcp as a remote MCP server (or install the corsair plugin from the repo). On Corsair's sign-in page pick the Password tab and sign in with the review account [email protected]. The password is not included here because this PR is public; get it from the original submission. Pick the link "Claude", then Allow.

The account has Slack (#all-corsair-review), a GitHub repo with open issues, Firecrawl and Hacker News.

Try:

• "What apps do I have connected in Corsair?"
• "List open issues in the corsair-review repo"
• "Post 'hello' in #all-corsair-review on Slack"
• "Every Friday at 5pm post new GitHub issues to Slack"

  

---

Note

Medium Risk
Third-party remote MCP with OAuth and skills that guide writes, automations, and cross-app actions; merge should wait on security review of the hosted server and submission, not just manifest validation.

Overview
Adds the Corsair third-party integration plugin to the marketplace: a new third_party/corsair/ package plus listings in .cursor-plugin/marketplace.json and the root README integrations table.

The plugin wires agents to Corsair’s hosted MCP at https://mcp.corsair.dev/mcp via mcp.json (type: "http"), with manifest plugin.json (v0.1.2, integrations category, Apache-2.0). It ships four agent skills—connect apps, data (search_data / read_data / run_script), automations (add_triggers, schedules, run debugging), and approvals (permission modes and retry behavior)—plus README, LICENSE, and logo assets. No application runtime code in this repo changes; behavior lives on Corsair’s remote server after OAuth sign-in.

^{Reviewed by Cursor Bugbot for commit 3626d92. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}

^{Reviewed by Cursor Bugbot for commit 3626d92. Configure here.}

[cursor]

Listing logo exceeds size limit

High Severity · Bugbot Rules

The listing logo assets/logo.png is a 512×512 8-bit RGBA PNG whose IDAT stream uses zlib method x\x01 (no compression). That payload is about 1MB, over the marketplace 512KiB cap, so the Corsair listing is rejected.

 

^{Reviewed by Cursor Bugbot for commit 3626d92. Configure here.}

[cursor]

Bugbot Autofix determined this is a false positive.

third_party/corsair/assets/logo.png is a valid 512×512 RGBA PNG of 177,059 bytes, under the 524,288-byte marketplace cap; zlib header 0x78 0x01 marks fastest compression, not an uncompressed ~1MB payload.

_{You can send follow-ups to the cloud agent here.}