From 5cee424a9957dc0b66d1bddc339e365067feebcc Mon Sep 17 00:00:00 2001 From: Agent Date: Wed, 14 Oct 2026 01:33:56 +0000 Subject: [PATCH 1/5] feat(plugins): Codex gets the plugin surface /mcp/plugin/chatgpt; Claude Code keeps the full /mcp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Codex manifest's mcpServers now points at its own file, .mcp.codex.json, whose one server is https://api.corespeed.io/mcp/plugin/chatgpt: the fixed surface corespeed-haas#1003 serves — shared memory, the caller's identity, connector discovery (connectors_search / connect / wait) and the approval wait — a small list no organization's connector count can push past Codex's 2,048-tool catalog limit, and the shape the OpenAI Plugins Directory reviews. A connected app's tools are called through the bundled cs-cli skill; the skill's intro (both copies) says so. Claude Code keeps the full /mcp through .mcp.json, unchanged. Manifest texts describe the Codex plugin as memory, connector discovery and the CLI; both manifests go to 0.3.0. CI gains a guard pinning the Codex server file and its URL; the README says which client gets which server. Verified in Codex 0.151.0 from this tree: codex plugin add corespeed@corespeed installs 0.3.0 and codex mcp list shows corespeed at https://api.corespeed.io/mcp/plugin/chatgpt. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/check.yml | 13 ++++++++++++- README.md | 15 +++++++++++---- plugins/corespeed-cli/skills/cs-cli/SKILL.md | 11 +++++++---- plugins/corespeed/.claude-plugin/plugin.json | 2 +- plugins/corespeed/.codex-plugin/plugin.json | 16 ++++++++-------- plugins/corespeed/.mcp.codex.json | 8 ++++++++ plugins/corespeed/skills/cs-cli/SKILL.md | 11 +++++++---- 7 files changed, 54 insertions(+), 22 deletions(-) create mode 100644 plugins/corespeed/.mcp.codex.json diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index d2a4386..68d2164 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,7 +19,7 @@ jobs: run: | for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \ plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \ - plugins/corespeed/.mcp.json plugins/corespeed-cli/.codex-plugin/plugin.json; do + plugins/corespeed/.mcp.json plugins/corespeed/.mcp.codex.json plugins/corespeed-cli/.codex-plugin/plugin.json; do jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; } done - name: The MCP server signs in with OAuth @@ -30,6 +30,17 @@ jobs: jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp"' \ plugins/corespeed/.mcp.json > /dev/null \ || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp"; exit 1; } + - name: Codex gets the plugin surface, Claude Code the full server + # The Codex manifest points at its own mcpServers file: the fixed + # plugin surface /mcp/plugin/chatgpt (memory, connector discovery), + # which no organization's connector count can push past a client's + # catalog limit. Claude Code keeps the full /mcp through .mcp.json. + run: | + [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.codex.json" ] \ + || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must point at ./.mcp.codex.json"; exit 1; } + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp/plugin/chatgpt"' \ + plugins/corespeed/.mcp.codex.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.codex.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } - name: The CLI plugin is skills-only and bundles the same cs-cli skill # corespeed-cli registers no MCP server: that is the point of it (a # client loads no tool list). Its cs-cli skill is a copy of the MCP diff --git a/README.md b/README.md index 9e3fdf5..402d5c4 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,13 @@ select **Authenticate** (or open **Settings → MCP servers → CoreSpeed**) and finish the sign-in in the browser. In the ChatGPT desktop app the plugin appears under the **CoreSpeed** marketplace once it has been added. +In Codex the plugin's server is `https://api.corespeed.io/mcp/plugin/chatgpt`: +a fixed, small tool list — shared memory and connector discovery — that no +organization's connector count can push past Codex's catalog limit. The agent +finds an app with `manage__connectors_search`, hands you a link to connect it, +and calls a connected app's tools through the bundled `cs-cli` skill +(`cs mcp search`, `cs mcp get`, `cs mcp call`). + ## Codex, CLI only ```bash @@ -63,7 +70,7 @@ organizations, connects apps, and calls tools from a terminal. See the | Plugin | Part | What it does | | --- | --- | --- | -| `corespeed` | MCP server | `https://api.corespeed.io/mcp` with browser sign-in (OAuth 2.1 + PKCE). You never paste an API key. | +| `corespeed` | MCP server | Browser sign-in (OAuth 2.1 + PKCE), never a pasted key. Claude Code: the full `https://api.corespeed.io/mcp`. Codex: the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory, connector discovery). | | `corespeed` | `cs-cli` skill | Using the `cs` CLI: sign-in, finding and calling tools from a shell, memory, API keys, organizations, connectors, remote MCP servers, credit. | | `corespeed` | `cs-api` skill | Calling CoreSpeed over HTTP from code and CI: credentials, `tools/list` and `tools/call`, error codes, credits. | | `corespeed-cli` | `cs-cli` skill | The same skill, and nothing else: no MCP server is registered. | @@ -72,9 +79,9 @@ If you added CoreSpeed to your client by hand earlier (`claude mcp add` or `codex mcp add`), remove that entry before installing the plugin, so every tool is registered once. -Sign-in happens at `login.corespeed.io`, and the plugins' only server is -`https://api.corespeed.io/mcp`. Anything else claiming to be CoreSpeed is not -this plugin. +Sign-in happens at `login.corespeed.io`, and the plugins' only servers are +`https://api.corespeed.io/mcp` and `https://api.corespeed.io/mcp/plugin/chatgpt`. +Anything else claiming to be CoreSpeed is not this plugin. ## Other clients diff --git a/plugins/corespeed-cli/skills/cs-cli/SKILL.md b/plugins/corespeed-cli/skills/cs-cli/SKILL.md index 99ae637..85e6e78 100644 --- a/plugins/corespeed-cli/skills/cs-cli/SKILL.md +++ b/plugins/corespeed-cli/skills/cs-cli/SKILL.md @@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. -If your client already has the CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it -does not: a plugin without an MCP server, a client that cannot load a large -tool list, a human at a terminal, or a CI job that needs an API key. +If your client has the full CoreSpeed MCP server +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's +server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and +connector discovery only, so there a connected app's tools are called with +`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a +large tool list, when a human is at a terminal, or when a CI job needs an API +key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. diff --git a/plugins/corespeed/.claude-plugin/plugin.json b/plugins/corespeed/.claude-plugin/plugin.json index a72f926..79f93cf 100644 --- a/plugins/corespeed/.claude-plugin/plugin.json +++ b/plugins/corespeed/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "corespeed", - "version": "0.2.1", + "version": "0.3.0", "description": "Connect Claude Code to CoreSpeed: your connected apps, shared memory, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.", "author": { "name": "CoreSpeed", diff --git a/plugins/corespeed/.codex-plugin/plugin.json b/plugins/corespeed/.codex-plugin/plugin.json index 187e148..ebe4c34 100644 --- a/plugins/corespeed/.codex-plugin/plugin.json +++ b/plugins/corespeed/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "corespeed", - "version": "0.2.1", - "description": "Connect Codex to CoreSpeed: your connected apps, shared memory, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.", + "version": "0.3.0", + "description": "Connect Codex to CoreSpeed: long-term memory shared across your agents and connector discovery through one MCP server, the tools of your connected apps through the cs CLI, plus skills for the CLI and the HTTP API.", "author": { "name": "CoreSpeed", "email": "contact@corespeed.io", @@ -19,11 +19,11 @@ "agents" ], "skills": "./skills/", - "mcpServers": "./.mcp.json", + "mcpServers": "./.mcp.codex.json", "interface": { "displayName": "CoreSpeed", - "shortDescription": "Connected apps, memory and tools for agents", - "longDescription": "Connect Codex to CoreSpeed's MCP server with a browser sign-in: the tools of every app your organization has connected, long-term memory shared across agents, media generation and understanding, live web search and public social data, all on one wallet with spend caps and an audit trail. Bundled skills cover the cs CLI and calling CoreSpeed over HTTP from code and CI.", + "shortDescription": "Shared memory, connector discovery, and your apps' tools through the cs CLI", + "longDescription": "Connect Codex to CoreSpeed with a browser sign-in. The plugin's MCP server carries long-term memory shared across your organization's agents and connector discovery: the agent finds an app your organization uses, sees whether it is connected, and hands you a one-click link to connect it. The tools of connected apps are called through the bundled cs CLI skill (cs mcp search, cs mcp get, cs mcp call), so Codex loads a small, fixed tool list whatever your organization has connected. Every call is metered on one wallet with spend caps and an audit trail, and a human can be asked to approve a write first.", "developerName": "CoreSpeed", "category": "Developer Tools", "capabilities": [ @@ -34,9 +34,9 @@ "websiteURL": "https://corespeed.io", "privacyPolicyURL": "https://corespeed.io/privacy", "defaultPrompt": [ - "Search my CoreSpeed memory for context relevant to this task.", - "Show my connected CoreSpeed tools and explain what I can do with them.", - "Set up this project's CI to call CoreSpeed with an API key." + "Search my CoreSpeed memory for context on this repository before we start.", + "Find out whether my organization has Notion connected on CoreSpeed, and give me the link if not.", + "Use the cs CLI to find the CoreSpeed tool for this task, show its schema, then call it." ], "brandColor": "#C2410C", "composerIcon": "./assets/icon.svg", diff --git a/plugins/corespeed/.mcp.codex.json b/plugins/corespeed/.mcp.codex.json new file mode 100644 index 0000000..5ffbf5c --- /dev/null +++ b/plugins/corespeed/.mcp.codex.json @@ -0,0 +1,8 @@ +{ + "mcpServers": { + "corespeed": { + "type": "http", + "url": "https://api.corespeed.io/mcp/plugin/chatgpt" + } + } +} diff --git a/plugins/corespeed/skills/cs-cli/SKILL.md b/plugins/corespeed/skills/cs-cli/SKILL.md index 99ae637..85e6e78 100644 --- a/plugins/corespeed/skills/cs-cli/SKILL.md +++ b/plugins/corespeed/skills/cs-cli/SKILL.md @@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. -If your client already has the CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it -does not: a plugin without an MCP server, a client that cannot load a large -tool list, a human at a terminal, or a CI job that needs an API key. +If your client has the full CoreSpeed MCP server +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's +server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and +connector discovery only, so there a connected app's tools are called with +`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a +large tool list, when a human is at a terminal, or when a CI job needs an API +key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. From a98aeb6897304ca4be06b9003c326b811579e1cc Mon Sep 17 00:00:00 2001 From: Agent Date: Wed, 14 Oct 2026 01:40:27 +0000 Subject: [PATCH 2/5] fix(plugins): the root .mcp.json is the plugin surface; Claude Code's manifest names the full server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OpenAI Plugins Directory accepts mcpServers only as ./.mcp.json at the plugin root (plugin_mcp_path_unsupported otherwise), so the surface Codex and the Directory need — https://api.corespeed.io/mcp/plugin/chatgpt — moves into the root file, and .mcp.codex.json goes. Claude Code's manifest declares "./.mcp.claude.json" with the full /mcp: Claude Code loads the root .mcp.json first, then the declared file, and a server declared later replaces an earlier one of the same name, so Claude Code keeps the full server. CI guards pin all four facts. cs-api says both URLs take the same credentials and that the Codex plugin's server is the surface. Verified: `claude plugin validate` passes; from this tree as a local marketplace, Codex 0.151.0 lists corespeed at /mcp/plugin/chatgpt and Claude Code 2.1.251 lists plugin:corespeed:corespeed at /mcp. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/check.yml | 41 +++++++++++-------- README.md | 9 ++-- plugins/corespeed/.claude-plugin/plugin.json | 10 ++++- plugins/corespeed/.codex-plugin/plugin.json | 2 +- .../{.mcp.codex.json => .mcp.claude.json} | 2 +- plugins/corespeed/.mcp.json | 2 +- plugins/corespeed/skills/cs-api/SKILL.md | 6 ++- 7 files changed, 46 insertions(+), 26 deletions(-) rename plugins/corespeed/{.mcp.codex.json => .mcp.claude.json} (55%) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 68d2164..9a289af 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,28 +19,35 @@ jobs: run: | for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \ plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \ - plugins/corespeed/.mcp.json plugins/corespeed/.mcp.codex.json plugins/corespeed-cli/.codex-plugin/plugin.json; do + plugins/corespeed/.mcp.json plugins/corespeed/.mcp.claude.json plugins/corespeed-cli/.codex-plugin/plugin.json; do jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; } done - - name: The MCP server signs in with OAuth + - name: The MCP servers sign in with OAuth # The plugin must never ask for an API key: the client discovers the - # authorization server from the /mcp challenge (RFC 9728), so the entry - # carries only the URL — no headers, no token env var, no oauth_resource. + # authorization server from the server's challenge (RFC 9728), so each + # entry carries only the URL — no headers, no token env var, no oauth_resource. run: | - jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp"' \ - plugins/corespeed/.mcp.json > /dev/null \ - || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp"; exit 1; } - - name: Codex gets the plugin surface, Claude Code the full server - # The Codex manifest points at its own mcpServers file: the fixed - # plugin surface /mcp/plugin/chatgpt (memory, connector discovery), - # which no organization's connector count can push past a client's - # catalog limit. Claude Code keeps the full /mcp through .mcp.json. + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url}"; exit 1; } + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.claude.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.claude.json::expected exactly {type, url}"; exit 1; } + - name: Codex and the Directory get the plugin surface; Claude Code the full server + # The OpenAI Plugins Directory accepts mcpServers only as the root + # ./.mcp.json, so that file is the fixed plugin surface + # /mcp/plugin/chatgpt (memory, connector discovery), which no + # organization's connector count can push past Codex's catalog limit. + # Claude Code loads .mcp.json first and then the file its manifest + # names; the later `corespeed` entry replaces the earlier one, so it + # gets the full /mcp from .mcp.claude.json. run: | - [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.codex.json" ] \ - || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must point at ./.mcp.codex.json"; exit 1; } - jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp/plugin/chatgpt"' \ - plugins/corespeed/.mcp.codex.json > /dev/null \ - || { echo "::error file=plugins/corespeed/.mcp.codex.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } + [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.json" ] \ + || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must be ./.mcp.json (the Directory accepts no other path)"; exit 1; } + [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.json)" = "https://api.corespeed.io/mcp/plugin/chatgpt" ] \ + || { echo "::error file=plugins/corespeed/.mcp.json::must point at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } + [ "$(jq -r .mcpServers plugins/corespeed/.claude-plugin/plugin.json)" = "./.mcp.claude.json" ] \ + || { echo "::error file=plugins/corespeed/.claude-plugin/plugin.json::mcpServers must be ./.mcp.claude.json"; exit 1; } + [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.claude.json)" = "https://api.corespeed.io/mcp" ] \ + || { echo "::error file=plugins/corespeed/.mcp.claude.json::must point at https://api.corespeed.io/mcp"; exit 1; } - name: The CLI plugin is skills-only and bundles the same cs-cli skill # corespeed-cli registers no MCP server: that is the point of it (a # client loads no tool list). Its cs-cli skill is a copy of the MCP diff --git a/README.md b/README.md index 402d5c4..12a75a4 100644 --- a/README.md +++ b/README.md @@ -34,9 +34,12 @@ select **Authenticate** (or open **Settings → MCP servers → CoreSpeed**) and finish the sign-in in the browser. In the ChatGPT desktop app the plugin appears under the **CoreSpeed** marketplace once it has been added. -In Codex the plugin's server is `https://api.corespeed.io/mcp/plugin/chatgpt`: -a fixed, small tool list — shared memory and connector discovery — that no -organization's connector count can push past Codex's catalog limit. The agent +In Codex the plugin's server (the root `.mcp.json`, the one file the OpenAI +Plugins Directory accepts) is `https://api.corespeed.io/mcp/plugin/chatgpt`: a +fixed, small tool list — shared memory and connector discovery — that no +organization's connector count can push past Codex's catalog limit. Claude Code +gets the full `https://api.corespeed.io/mcp` from `.mcp.claude.json`, which its +manifest declares and which replaces the root entry by name. The agent finds an app with `manage__connectors_search`, hands you a link to connect it, and calls a connected app's tools through the bundled `cs-cli` skill (`cs mcp search`, `cs mcp get`, `cs mcp call`). diff --git a/plugins/corespeed/.claude-plugin/plugin.json b/plugins/corespeed/.claude-plugin/plugin.json index 79f93cf..0ab694c 100644 --- a/plugins/corespeed/.claude-plugin/plugin.json +++ b/plugins/corespeed/.claude-plugin/plugin.json @@ -10,5 +10,13 @@ "homepage": "https://corespeed.io/docs", "repository": "https://github.com/corespeed-io/cs", "license": "Apache-2.0", - "keywords": ["corespeed", "mcp", "memory", "connectors", "cli", "agents"] + "keywords": [ + "corespeed", + "mcp", + "memory", + "connectors", + "cli", + "agents" + ], + "mcpServers": "./.mcp.claude.json" } diff --git a/plugins/corespeed/.codex-plugin/plugin.json b/plugins/corespeed/.codex-plugin/plugin.json index ebe4c34..0ee8ed5 100644 --- a/plugins/corespeed/.codex-plugin/plugin.json +++ b/plugins/corespeed/.codex-plugin/plugin.json @@ -19,7 +19,7 @@ "agents" ], "skills": "./skills/", - "mcpServers": "./.mcp.codex.json", + "mcpServers": "./.mcp.json", "interface": { "displayName": "CoreSpeed", "shortDescription": "Shared memory, connector discovery, and your apps' tools through the cs CLI", diff --git a/plugins/corespeed/.mcp.codex.json b/plugins/corespeed/.mcp.claude.json similarity index 55% rename from plugins/corespeed/.mcp.codex.json rename to plugins/corespeed/.mcp.claude.json index 5ffbf5c..6891df4 100644 --- a/plugins/corespeed/.mcp.codex.json +++ b/plugins/corespeed/.mcp.claude.json @@ -2,7 +2,7 @@ "mcpServers": { "corespeed": { "type": "http", - "url": "https://api.corespeed.io/mcp/plugin/chatgpt" + "url": "https://api.corespeed.io/mcp" } } } diff --git a/plugins/corespeed/.mcp.json b/plugins/corespeed/.mcp.json index 6891df4..5ffbf5c 100644 --- a/plugins/corespeed/.mcp.json +++ b/plugins/corespeed/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "corespeed": { "type": "http", - "url": "https://api.corespeed.io/mcp" + "url": "https://api.corespeed.io/mcp/plugin/chatgpt" } } } diff --git a/plugins/corespeed/skills/cs-api/SKILL.md b/plugins/corespeed/skills/cs-api/SKILL.md index 31e9fcd..441926e 100644 --- a/plugins/corespeed/skills/cs-api/SKILL.md +++ b/plugins/corespeed/skills/cs-api/SKILL.md @@ -8,7 +8,9 @@ description: Use when calling CoreSpeed over HTTP from code, CI, or a headless a CoreSpeed is one authenticated MCP server, `https://api.corespeed.io/mcp`, that carries the tools of the apps an organization has connected, long-term memory, media generation and understanding, live web search, and public social -data. An agent with this plugin installed already has it as an MCP server; this +data. An agent with this plugin installed already has it — or, in Codex, the +plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory and +connector discovery), which takes the same credentials — as an MCP server; this skill is for code that talks to it directly: a service, a CI job, a script, or a client without OAuth. @@ -26,7 +28,7 @@ decides which tools, accounts, and memories the response contains. | Credential | Who is calling | Use it for | | --- | --- | --- | -| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` only | +| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` and `POST /mcp/plugin/` (one token, the URL picks the surface) | | `sk-cs-…` API key | The member who created it | CI, services, clients without OAuth | | `sk-csa-…` agent key | An agent principal with its own identity | Unattended agents; reaches the organization's shared accounts only | | Session JWT | A member, from the `cs` CLI or the dashboard | One-off scripts (`cs token`); lives five minutes | From 86a374da5c4ed5e407e19014c2968811cca768b0 Mon Sep 17 00:00:00 2001 From: Sprite Date: Thu, 15 Oct 2026 05:42:34 +0000 Subject: [PATCH 3/5] feat(plugins): CoreSpeed as a Cursor plugin, for the Cursor Marketplace and Grok Bot Grok Bot loads plugins only from the Cursor Marketplace. A Cursor plugin is the way CoreSpeed gets into Grok Bot and its bot templates. - plugins/corespeed/.cursor-plugin/plugin.json: the same plugin. It reuses .mcp.json and skills/, so all three clients get one MCP entry. - .cursor-plugin/marketplace.json at the repo root, as Cursor needs for a multi-plugin repo. It lists only corespeed. corespeed-cli is a Codex workaround. - assets/app-icon.svg: the square icon from corespeed.io. The old logos use currentColor and vanish on a dark page. - CI: validate the new JSON, keep the three versions equal, and block a second MCP file. - README: a Cursor and Grok Bot section. Co-Authored-By: Claude Opus 5.5 --- .cursor-plugin/marketplace.json | 17 +++++++++++++++ .github/workflows/check.yml | 17 ++++++++++++--- README.md | 22 ++++++++++++++------ plugins/corespeed/.cursor-plugin/plugin.json | 19 +++++++++++++++++ plugins/corespeed/assets/app-icon.svg | 6 ++++++ 5 files changed, 72 insertions(+), 9 deletions(-) create mode 100644 .cursor-plugin/marketplace.json create mode 100644 plugins/corespeed/.cursor-plugin/plugin.json create mode 100644 plugins/corespeed/assets/app-icon.svg diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json new file mode 100644 index 0000000..a163aea --- /dev/null +++ b/.cursor-plugin/marketplace.json @@ -0,0 +1,17 @@ +{ + "name": "corespeed", + "owner": { + "name": "CoreSpeed", + "email": "contact@corespeed.io" + }, + "metadata": { + "description": "CoreSpeed plugins for coding agents." + }, + "plugins": [ + { + "name": "corespeed", + "source": "./plugins/corespeed", + "description": "Your connected apps, shared memory, media, web and social tools through one MCP server with browser sign-in, plus skills for the cs CLI and the HTTP API." + } + ] +} diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index d2a4386..2e5a656 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -17,8 +17,9 @@ jobs: persist-credentials: false - name: Manifests are valid JSON run: | - for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \ + for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json .cursor-plugin/marketplace.json \ plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \ + plugins/corespeed/.cursor-plugin/plugin.json \ plugins/corespeed/.mcp.json plugins/corespeed-cli/.codex-plugin/plugin.json; do jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; } done @@ -41,11 +42,21 @@ jobs: || { echo "::error file=plugins/corespeed-cli/.codex-plugin/plugin.json::skills-only plugin: no mcpServers"; exit 1; } cmp -s plugins/corespeed/skills/cs-cli/SKILL.md plugins/corespeed-cli/skills/cs-cli/SKILL.md \ || { echo "::error::cs-cli skill differs between the plugins; plugins/corespeed/skills/cs-cli/SKILL.md is the source — copy it over"; exit 1; } - - name: Both manifests carry the same version + - name: All corespeed manifests carry the same version run: | codex=$(jq -r .version plugins/corespeed/.codex-plugin/plugin.json) claude=$(jq -r .version plugins/corespeed/.claude-plugin/plugin.json) - [ "$codex" = "$claude" ] || { echo "::error::Codex manifest is $codex, Claude Code manifest is $claude"; exit 1; } + cursor=$(jq -r .version plugins/corespeed/.cursor-plugin/plugin.json) + [ "$codex" = "$claude" ] && [ "$codex" = "$cursor" ] \ + || { echo "::error::Codex manifest is $codex, Claude Code manifest is $claude, Cursor manifest is $cursor"; exit 1; } + - name: The Cursor plugin uses the same MCP entry + # Cursor reads the shared .mcp.json through the manifest, so the OAuth + # check above covers it too. A second MCP file would drift. + run: | + jq -e '.mcpServers == "./.mcp.json"' plugins/corespeed/.cursor-plugin/plugin.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.cursor-plugin/plugin.json::mcpServers must be ./.mcp.json"; exit 1; } + test ! -e plugins/corespeed/mcp.json \ + || { echo "::error::plugins/corespeed/mcp.json would shadow .mcp.json in Cursor; keep one MCP file"; exit 1; } scan: runs-on: ubuntu-latest diff --git a/README.md b/README.md index 9e3fdf5..bbe8579 100644 --- a/README.md +++ b/README.md @@ -7,8 +7,8 @@ long-term memory shared across agents, media generation and understanding, live web search, and public social data, all billed to one wallet with spend caps and an audit trail. -This repository holds the CoreSpeed plugin for Claude Code and Codex, and the -agent skills it bundles. The `cs` command-line tool is published to npm as +This repository holds the CoreSpeed plugin for Claude Code, Codex and Cursor, +and the agent skills it bundles. The `cs` command-line tool is published to npm as [`@corespeed/cs`](https://www.npmjs.com/package/@corespeed/cs). ## Claude Code @@ -48,6 +48,16 @@ Pick it when Codex cannot load your organization's full tool list, or when you want every call to go through the shell. It is the plugin meant for the OpenAI Plugins Directory. +## Cursor and Grok Bot + +In Cursor, open **Customize**, search the Marketplace for **CoreSpeed**, and +install it. Pick the CoreSpeed MCP server and sign in in the browser when +Cursor asks. Grok Bot loads plugins from the Cursor Marketplace, so the same +plugin works there. + +To try this repository before a Marketplace release, copy `plugins/corespeed` +to `~/.cursor/plugins/local/corespeed` and reload the window. + ## The `cs` CLI ```bash @@ -68,9 +78,9 @@ organizations, connects apps, and calls tools from a terminal. See the | `corespeed` | `cs-api` skill | Calling CoreSpeed over HTTP from code and CI: credentials, `tools/list` and `tools/call`, error codes, credits. | | `corespeed-cli` | `cs-cli` skill | The same skill, and nothing else: no MCP server is registered. | -If you added CoreSpeed to your client by hand earlier (`claude mcp add` or -`codex mcp add`), remove that entry before installing the plugin, so every -tool is registered once. +If you added CoreSpeed to your client by hand earlier (`claude mcp add`, +`codex mcp add`, or an entry in Cursor's `mcp.json`), remove that entry +before installing the plugin, so every tool is registered once. Sign-in happens at `login.corespeed.io`, and the plugins' only server is `https://api.corespeed.io/mcp`. Anything else claiming to be CoreSpeed is not @@ -78,7 +88,7 @@ this plugin. ## Other clients -Cursor, Copilot in VS Code, Claude.ai, ChatGPT, and any client that speaks +Copilot in VS Code, Claude.ai, ChatGPT, and any client that speaks Streamable HTTP with MCP authorization connect with the URL alone. Per-client setup is at https://corespeed.io/docs/mcp. diff --git a/plugins/corespeed/.cursor-plugin/plugin.json b/plugins/corespeed/.cursor-plugin/plugin.json new file mode 100644 index 0000000..22c9131 --- /dev/null +++ b/plugins/corespeed/.cursor-plugin/plugin.json @@ -0,0 +1,19 @@ +{ + "name": "corespeed", + "displayName": "CoreSpeed", + "version": "0.2.1", + "description": "Your connected apps, shared memory, media, web and social tools through one MCP server with browser sign-in, plus skills for the cs CLI and the HTTP API.", + "author": { + "name": "CoreSpeed", + "email": "contact@corespeed.io" + }, + "homepage": "https://corespeed.io/docs", + "repository": "https://github.com/corespeed-io/cs", + "license": "Apache-2.0", + "logo": "assets/app-icon.svg", + "keywords": ["corespeed", "mcp", "memory", "connectors", "cli", "agents"], + "category": "integrations", + "tags": ["corespeed", "mcp", "memory", "connectors"], + "skills": "./skills/", + "mcpServers": "./.mcp.json" +} diff --git a/plugins/corespeed/assets/app-icon.svg b/plugins/corespeed/assets/app-icon.svg new file mode 100644 index 0000000..005d265 --- /dev/null +++ b/plugins/corespeed/assets/app-icon.svg @@ -0,0 +1,6 @@ + + + + + + From 41604901488ac6e19c095ac368c878bc3c151fa2 Mon Sep 17 00:00:00 2001 From: Agent Date: Mon, 26 Oct 2026 01:51:49 +0000 Subject: [PATCH 4/5] docs(skills): the cs-cli and cs-api skills say Cursor gets the plugin surface too Co-Authored-By: Claude Fable 5.1 --- plugins/corespeed-cli/skills/cs-cli/SKILL.md | 12 ++++++------ plugins/corespeed/skills/cs-api/SKILL.md | 6 +++--- plugins/corespeed/skills/cs-cli/SKILL.md | 12 ++++++------ 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/plugins/corespeed-cli/skills/cs-cli/SKILL.md b/plugins/corespeed-cli/skills/cs-cli/SKILL.md index 9624064..2092b5b 100644 --- a/plugins/corespeed-cli/skills/cs-cli/SKILL.md +++ b/plugins/corespeed-cli/skills/cs-cli/SKILL.md @@ -10,12 +10,12 @@ under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. If your client has the full CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's -server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and -connector discovery only, so there a connected app's tools are called with -`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a -large tool list, when a human is at a terminal, or when a CI job needs an API -key. +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex and +Cursor plugins' server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries +memory and connector discovery only, so there a connected app's tools and the +Drive are reached with `cs`. Use `cs` as well when there is no MCP server, when +a client cannot load a large tool list, when a human is at a terminal, or when +a CI job needs an API key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. diff --git a/plugins/corespeed/skills/cs-api/SKILL.md b/plugins/corespeed/skills/cs-api/SKILL.md index 441926e..7c68e4e 100644 --- a/plugins/corespeed/skills/cs-api/SKILL.md +++ b/plugins/corespeed/skills/cs-api/SKILL.md @@ -8,9 +8,9 @@ description: Use when calling CoreSpeed over HTTP from code, CI, or a headless a CoreSpeed is one authenticated MCP server, `https://api.corespeed.io/mcp`, that carries the tools of the apps an organization has connected, long-term memory, media generation and understanding, live web search, and public social -data. An agent with this plugin installed already has it — or, in Codex, the -plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory and -connector discovery), which takes the same credentials — as an MCP server; this +data. An agent with this plugin installed already has it — or, in Codex and +Cursor, the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory +and connector discovery), which takes the same credentials — as an MCP server; this skill is for code that talks to it directly: a service, a CI job, a script, or a client without OAuth. diff --git a/plugins/corespeed/skills/cs-cli/SKILL.md b/plugins/corespeed/skills/cs-cli/SKILL.md index 9624064..2092b5b 100644 --- a/plugins/corespeed/skills/cs-cli/SKILL.md +++ b/plugins/corespeed/skills/cs-cli/SKILL.md @@ -10,12 +10,12 @@ under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. If your client has the full CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's -server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and -connector discovery only, so there a connected app's tools are called with -`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a -large tool list, when a human is at a terminal, or when a CI job needs an API -key. +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex and +Cursor plugins' server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries +memory and connector discovery only, so there a connected app's tools and the +Drive are reached with `cs`. Use `cs` as well when there is no MCP server, when +a client cannot load a large tool list, when a human is at a terminal, or when +a CI job needs an API key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. From 285b971af4f4de8c84d25b989738e782ba92f8cc Mon Sep 17 00:00:00 2001 From: Agent Date: Mon, 26 Oct 2026 01:52:54 +0000 Subject: [PATCH 5/5] fix(plugins): short descriptions fit the Directory's 30-character limit; cs-api calls memory__search Final Directory submission refuses a shortDescription over 30 characters (submission_subtitle_too_long); both Codex manifests are shortened and check.yml holds the limit. The cs-api sample uses the current memory tool name, as the cs-cli skill does. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/check.yml | 10 ++++++++++ plugins/corespeed-cli/.codex-plugin/plugin.json | 2 +- plugins/corespeed/.codex-plugin/plugin.json | 2 +- plugins/corespeed/skills/cs-api/SKILL.md | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index fbe2de3..05fcbbd 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -70,6 +70,16 @@ jobs: jq -e '(.interface.defaultPrompt // []) | (type == "string") or (length <= 3 and all(type == "string" and length > 0))' "$f" > /dev/null \ || { echo "::error file=$f::interface.defaultPrompt must be at most three non-empty strings"; exit 1; } done + - name: Short descriptions fit the Directory listing + # Final Directory submission refuses interface.shortDescription over 30 + # characters (submission_subtitle_too_long), a tighter limit than the + # 240 package validation allows; held here so a manifest never passes + # review and fails at submission. + run: | + for f in plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed-cli/.codex-plugin/plugin.json; do + jq -e '.interface.shortDescription | type == "string" and length > 0 and length <= 30' "$f" > /dev/null \ + || { echo "::error file=$f::interface.shortDescription must be 1–30 characters for Directory submission"; exit 1; } + done - name: All corespeed manifests carry the same version run: | codex=$(jq -r .version plugins/corespeed/.codex-plugin/plugin.json) diff --git a/plugins/corespeed-cli/.codex-plugin/plugin.json b/plugins/corespeed-cli/.codex-plugin/plugin.json index acd7cee..94f324c 100644 --- a/plugins/corespeed-cli/.codex-plugin/plugin.json +++ b/plugins/corespeed-cli/.codex-plugin/plugin.json @@ -20,7 +20,7 @@ "skills": "./skills/", "interface": { "displayName": "CoreSpeed CLI", - "shortDescription": "CoreSpeed tools and shared memory from the shell", + "shortDescription": "CoreSpeed tools from the shell", "longDescription": "CoreSpeed gives your organization one place for agent tools: long-term memory shared across agents, a Drive every tool reads and writes, the tools of the apps your organization has enabled, and API keys with spend caps and an audit trail. This plugin brings it to Codex through the cs command-line tool. Sign in once in the browser; after that the agent searches for a tool, reads its schema, and calls it from the shell, uploads and downloads Drive files with cs drive, with every call metered and, where your organization requires it, approved by a human first. It registers no MCP server.", "developerName": "CoreSpeed", "category": "Developer Tools", diff --git a/plugins/corespeed/.codex-plugin/plugin.json b/plugins/corespeed/.codex-plugin/plugin.json index 82ffcad..d706251 100644 --- a/plugins/corespeed/.codex-plugin/plugin.json +++ b/plugins/corespeed/.codex-plugin/plugin.json @@ -23,7 +23,7 @@ "mcpServers": "./.mcp.json", "interface": { "displayName": "CoreSpeed", - "shortDescription": "Shared memory, connector discovery, and your apps' tools and files through the cs CLI", + "shortDescription": "Shared memory and app tools", "longDescription": "Connect Codex to CoreSpeed with a browser sign-in. The plugin's MCP server carries long-term memory shared across your organization's agents and connector discovery: the agent finds an app your organization uses, sees whether it is connected, and hands you a one-click link to connect it. The tools of connected apps are called through the bundled cs CLI skill (cs mcp search, cs mcp get, cs mcp call), and files move in and out of the organization's Drive with cs drive, so Codex loads a small, fixed tool list whatever your organization has connected. Every call is metered on one wallet with spend caps and an audit trail, and a human can be asked to approve a write first.", "developerName": "CoreSpeed", "category": "Developer Tools", diff --git a/plugins/corespeed/skills/cs-api/SKILL.md b/plugins/corespeed/skills/cs-api/SKILL.md index 7c68e4e..11d385a 100644 --- a/plugins/corespeed/skills/cs-api/SKILL.md +++ b/plugins/corespeed/skills/cs-api/SKILL.md @@ -60,7 +60,7 @@ const res = await fetch("https://api.corespeed.io/mcp", { id: 1, method: "tools/call", params: { - name: "memory__search_memory", + name: "memory__search", arguments: { query: "rollout window" }, }, }),