feat(plugins): CoreSpeed as a Cursor plugin, for the Cursor Marketplace and Grok Bot

.cursor-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "corespeed",
+  "owner": {
+    "name": "CoreSpeed",
+    "email": "contact@corespeed.io"
+  },
+  "metadata": {
+    "description": "CoreSpeed plugins for coding agents."
+  },
+  "plugins": [
+    {
+      "name": "corespeed",
+      "source": "./plugins/corespeed",
+      "description": "Long-term memory shared across your agents and connector discovery through one MCP server with browser sign-in, the tools of your connected apps and the files in your organization's Drive through the cs CLI, plus skills for the CLI and the HTTP API."
+    }
+  ]
+}

.github/workflows/check.yml

@@ -17,8 +17,9 @@ jobs:
           persist-credentials: false
       - name: Manifests are valid JSON
         run: |
-          for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \
+          for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json .cursor-plugin/marketplace.json \
             plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \
+            plugins/corespeed/.cursor-plugin/plugin.json \
             plugins/corespeed/.mcp.json plugins/corespeed/.mcp.claude.json plugins/corespeed-cli/.codex-plugin/plugin.json; do
             jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; }
           done
@@ -69,11 +70,33 @@ jobs:
             jq -e '(.interface.defaultPrompt // []) | (type == "string") or (length <= 3 and all(type == "string" and length > 0))' "$f" > /dev/null \
               || { echo "::error file=$f::interface.defaultPrompt must be at most three non-empty strings"; exit 1; }
           done
-      - name: Both manifests carry the same version
+      - name: Short descriptions fit the Directory listing
+        # Final Directory submission refuses interface.shortDescription over 30
+        # characters (submission_subtitle_too_long), a tighter limit than the
+        # 240 package validation allows; held here so a manifest never passes
+        # review and fails at submission.
+        run: |
+          for f in plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed-cli/.codex-plugin/plugin.json; do
+            jq -e '.interface.shortDescription | type == "string" and length > 0 and length <= 30' "$f" > /dev/null \
+              || { echo "::error file=$f::interface.shortDescription must be 1–30 characters for Directory submission"; exit 1; }
+          done
+      - name: All corespeed manifests carry the same version
         run: |
           codex=$(jq -r .version plugins/corespeed/.codex-plugin/plugin.json)
           claude=$(jq -r .version plugins/corespeed/.claude-plugin/plugin.json)
-          [ "$codex" = "$claude" ] || { echo "::error::Codex manifest is $codex, Claude Code manifest is $claude"; exit 1; }
+          cursor=$(jq -r .version plugins/corespeed/.cursor-plugin/plugin.json)
+          [ "$codex" = "$claude" ] && [ "$codex" = "$cursor" ] \
+            || { echo "::error::Codex manifest is $codex, Claude Code manifest is $claude, Cursor manifest is $cursor"; exit 1; }
+      - name: The Cursor plugin uses the plugin surface
+        # Cursor reads the root .mcp.json through its manifest — the same
+        # fixed plugin surface Codex gets, since Cursor loads every tool of a
+        # server up front too — so the OAuth and surface checks above cover
+        # it. A second mcp.json would shadow .mcp.json in Cursor and drift.
+        run: |
+          jq -e '.mcpServers == "./.mcp.json"' plugins/corespeed/.cursor-plugin/plugin.json > /dev/null \
+            || { echo "::error file=plugins/corespeed/.cursor-plugin/plugin.json::mcpServers must be ./.mcp.json"; exit 1; }
+          test ! -e plugins/corespeed/mcp.json \
+            || { echo "::error::plugins/corespeed/mcp.json would shadow .mcp.json in Cursor; keep one MCP file"; exit 1; }
 
   scan:
     runs-on: ubuntu-latest

README.md

@@ -7,8 +7,8 @@ long-term memory shared across agents, a Drive every tool reads and writes,
 media generation and understanding, live web search, and public social data,
 all billed to one wallet with spend caps and an audit trail.
 
-This repository holds the CoreSpeed plugin for Claude Code and Codex, and the
-agent skills it bundles. The `cs` command-line tool is published to npm as
+This repository holds the CoreSpeed plugin for Claude Code, Codex and Cursor,
+and the agent skills it bundles. The `cs` command-line tool is published to npm as
 [`@corespeed/cs`](https://www.npmjs.com/package/@corespeed/cs).
 
 ## Claude Code
@@ -60,6 +60,22 @@ and move files in and out of the organization's Drive (`cs drive put`,
 list, or when you want every call to go through the shell. It is the plugin
 meant for the OpenAI Plugins Directory.
 
+## Cursor and Grok Bot
+
+In Cursor, open **Customize**, search the Marketplace for **CoreSpeed**, and
+install it. Pick the CoreSpeed MCP server and sign in in the browser when
+Cursor asks. Grok Bot loads plugins from the Cursor Marketplace, so the same
+plugin works there.
+
+Cursor reads the same root `.mcp.json` as Codex, so its server is the plugin
+surface `https://api.corespeed.io/mcp/plugin/chatgpt`: shared memory and
+connector discovery, a list no organization's connector count can grow past
+what Cursor loads. A connected app's tools and the organization's Drive are
+reached through the bundled `cs-cli` skill (`cs mcp call`, `cs drive`).
+
+To try this repository before a Marketplace release, copy `plugins/corespeed`
+to `~/.cursor/plugins/local/corespeed` and reload the window.
+
 ## The `cs` CLI
 
 ```bash
@@ -75,22 +91,22 @@ organizations, connects apps, and calls tools from a terminal. See the
 
 | Plugin | Part | What it does |
 | --- | --- | --- |
-| `corespeed` | MCP server | Browser sign-in (OAuth 2.1 + PKCE), never a pasted key. Claude Code: the full `https://api.corespeed.io/mcp`. Codex: the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory, connector discovery). |
+| `corespeed` | MCP server | Browser sign-in (OAuth 2.1 + PKCE), never a pasted key. Claude Code: the full `https://api.corespeed.io/mcp`. Codex and Cursor: the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory, connector discovery). |
 | `corespeed` | `cs-cli` skill | Using the `cs` CLI: sign-in, finding and calling tools from a shell, memory, files in the Drive, API keys, organizations, connectors, remote MCP servers, credit. |
 | `corespeed` | `cs-api` skill | Calling CoreSpeed over HTTP from code and CI: credentials, `tools/list` and `tools/call`, error codes, credits. |
 | `corespeed-cli` | `cs-cli` skill | The same skill, and nothing else: no MCP server is registered. |
 
-If you added CoreSpeed to your client by hand earlier (`claude mcp add` or
-`codex mcp add`), remove that entry before installing the plugin, so every
-tool is registered once.
+If you added CoreSpeed to your client by hand earlier (`claude mcp add`,
+`codex mcp add`, or an entry in Cursor's `mcp.json`), remove that entry
+before installing the plugin, so every tool is registered once.
 
 Sign-in happens at `login.corespeed.io`, and the plugins' only servers are
 `https://api.corespeed.io/mcp` and `https://api.corespeed.io/mcp/plugin/chatgpt`.
 Anything else claiming to be CoreSpeed is not this plugin.
 
 ## Other clients
 
-Cursor, Copilot in VS Code, Claude.ai, ChatGPT, and any client that speaks
+Copilot in VS Code, Claude.ai, ChatGPT, and any client that speaks
 Streamable HTTP with MCP authorization connect with the URL alone. Per-client
 setup is at https://corespeed.io/docs/mcp.
 

plugins/corespeed-cli/.codex-plugin/plugin.json

@@ -20,7 +20,7 @@
   "skills": "./skills/",
   "interface": {
     "displayName": "CoreSpeed CLI",
-    "shortDescription": "CoreSpeed tools and shared memory from the shell",
+    "shortDescription": "CoreSpeed tools from the shell",
     "longDescription": "CoreSpeed gives your organization one place for agent tools: long-term memory shared across agents, a Drive every tool reads and writes, the tools of the apps your organization has enabled, and API keys with spend caps and an audit trail. This plugin brings it to Codex through the cs command-line tool. Sign in once in the browser; after that the agent searches for a tool, reads its schema, and calls it from the shell, uploads and downloads Drive files with cs drive, with every call metered and, where your organization requires it, approved by a human first. It registers no MCP server.",
     "developerName": "CoreSpeed",
     "category": "Developer Tools",

plugins/corespeed-cli/skills/cs-cli/SKILL.md

@@ -10,12 +10,12 @@ under a member session stored on this machine. It needs Node.js 20 or Bun and
 has no runtime dependencies.
 
 If your client has the full CoreSpeed MCP server
-(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's
-server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and
-connector discovery only, so there a connected app's tools are called with
-`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a
-large tool list, when a human is at a terminal, or when a CI job needs an API
-key.
+(`https://api.corespeed.io/mcp`), call its tools directly. The Codex and
+Cursor plugins' server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries
+memory and connector discovery only, so there a connected app's tools and the
+Drive are reached with `cs`. Use `cs` as well when there is no MCP server, when
+a client cannot load a large tool list, when a human is at a terminal, or when
+a CI job needs an API key.
 
 The canonical reference is https://corespeed.io/docs/cli. When this skill and
 the docs disagree, the docs win.

plugins/corespeed/.codex-plugin/plugin.json

@@ -23,7 +23,7 @@
   "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "CoreSpeed",
-    "shortDescription": "Shared memory, connector discovery, and your apps' tools and files through the cs CLI",
+    "shortDescription": "Shared memory and app tools",
     "longDescription": "Connect Codex to CoreSpeed with a browser sign-in. The plugin's MCP server carries long-term memory shared across your organization's agents and connector discovery: the agent finds an app your organization uses, sees whether it is connected, and hands you a one-click link to connect it. The tools of connected apps are called through the bundled cs CLI skill (cs mcp search, cs mcp get, cs mcp call), and files move in and out of the organization's Drive with cs drive, so Codex loads a small, fixed tool list whatever your organization has connected. Every call is metered on one wallet with spend caps and an audit trail, and a human can be asked to approve a write first.",
     "developerName": "CoreSpeed",
     "category": "Developer Tools",

plugins/corespeed/.cursor-plugin/plugin.json

@@ -0,0 +1,32 @@
+{
+  "name": "corespeed",
+  "displayName": "CoreSpeed",
+  "version": "0.3.0",
+  "description": "Long-term memory shared across your agents and connector discovery through one MCP server with browser sign-in, the tools of your connected apps and the files in your organization's Drive through the cs CLI, plus skills for the CLI and the HTTP API.",
+  "author": {
+    "name": "CoreSpeed",
+    "email": "contact@corespeed.io"
+  },
+  "homepage": "https://corespeed.io/docs",
+  "repository": "https://github.com/corespeed-io/cs",
+  "license": "Apache-2.0",
+  "logo": "assets/app-icon.svg",
+  "keywords": [
+    "corespeed",
+    "mcp",
+    "memory",
+    "drive",
+    "connectors",
+    "cli",
+    "agents"
+  ],
+  "category": "integrations",
+  "tags": [
+    "corespeed",
+    "mcp",
+    "memory",
+    "connectors"
+  ],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json"
+}

plugins/corespeed/skills/cs-api/SKILL.md

@@ -8,9 +8,9 @@ description: Use when calling CoreSpeed over HTTP from code, CI, or a headless a
 CoreSpeed is one authenticated MCP server, `https://api.corespeed.io/mcp`,
 that carries the tools of the apps an organization has connected, long-term
 memory, media generation and understanding, live web search, and public social
-data. An agent with this plugin installed already has it — or, in Codex, the
-plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory and
-connector discovery), which takes the same credentials — as an MCP server; this
+data. An agent with this plugin installed already has it — or, in Codex and
+Cursor, the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory
+and connector discovery), which takes the same credentials — as an MCP server; this
 skill is for code that talks to it directly: a service, a CI job, a script, or
 a client without OAuth.
 
@@ -60,7 +60,7 @@ const res = await fetch("https://api.corespeed.io/mcp", {
     id: 1,
     method: "tools/call",
     params: {
-      name: "memory__search_memory",
+      name: "memory__search",
       arguments: { query: "rollout window" },
     },
   }),

plugins/corespeed/skills/cs-cli/SKILL.md

@@ -10,12 +10,12 @@ under a member session stored on this machine. It needs Node.js 20 or Bun and
 has no runtime dependencies.
 
 If your client has the full CoreSpeed MCP server
-(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's
-server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and
-connector discovery only, so there a connected app's tools are called with
-`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a
-large tool list, when a human is at a terminal, or when a CI job needs an API
-key.
+(`https://api.corespeed.io/mcp`), call its tools directly. The Codex and
+Cursor plugins' server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries
+memory and connector discovery only, so there a connected app's tools and the
+Drive are reached with `cs`. Use `cs` as well when there is no MCP server, when
+a client cannot load a large tool list, when a human is at a terminal, or when
+a CI job needs an API key.
 
 The canonical reference is https://corespeed.io/docs/cli. When this skill and
 the docs disagree, the docs win.