feat(third_party): add Gopuff plugin

[minupalaniappan]

Adds third_party/gopuff, a Grok Bot–only plugin for Gopuff's official MCP server (https://mcp.gopuff.com/mcp).

What's in it

• mcp.json: server key gopuff, type: http, placement: server, and Gopuff's public OAuth client auth.CLIENT_ID: mcp-grok-bot (no secret). Gopuff's sign-in server doesn't accept dynamic client registration for our redirects, so the plugin pins the client Gopuff issued for Grok Bot; sign-in uses PKCE.
• plugin.json v1.0.0: minClientVersions cursor never, grokbot/sand 0.49.0 (same as Finance, Shopify and Tailscale), category integrations.
• README with the data-handling disclosure (orders are real Gopuff orders charged to the user's Gopuff account), CHANGELOG, MIT LICENSE, 192×192 logo.
• Registered at the end of .cursor-plugin/marketplace.json (description identical to plugin.json) and the root README table.

Copied from the team marketplace repo minupalaniappan/gopuff-plugin at 599ff0e, which is what TeachX testers install today; only repository and the CHANGELOG wording changed.

Status / known limits

• Gopuff's MCP is limited to employees plus a manual user-ID allowlist for now; other accounts get 401/403.
• As of 2026-10-16, goauth.gopuff.com accepts https://www.cursor.com/agents/mcp/oauth/callback for mcp-grok-bot but still rejects the Grok Bot (grokbot://), /bot, localhost and grok.com redirect URIs. Gopuff is rolling those out; no change here is needed once they land.

Testing

• node scripts/validate-plugins.mjs → "All plugins validated successfully."
• Not verified here: an end-to-end sign-in and tool call from Grok Bot with this public listing.

---

Note

Medium Risk
Enables real-money Gopuff orders and OAuth account linking under the user’s Gopuff identity; risk is mostly operational (allowlist/OAuth redirect rollout) rather than in-repo code changes.

Overview
Adds a new gopuff third-party plugin so Grok Bot (not Cursor IDE) can shop via Gopuff’s hosted MCP at https://mcp.gopuff.com/mcp.

The plugin is Grok-only (minClientVersions: Cursor never, grokbot/sand 0.49.0), uses server-side HTTP MCP placement, and pins Gopuff’s public OAuth client mcp-grok-bot (no secret) for sign-in through Gopuff’s auth. Docs call out that searches, carts, and placed orders are real and bill the user’s Gopuff account.

Marketplace wiring: registers the plugin in .cursor-plugin/marketplace.json and adds a row to the root README integrations table. Ships standard plugin scaffolding (manifest, mcp.json, README disclosure, CHANGELOG, MIT license; logo referenced in manifest).

^{Reviewed by Cursor Bugbot for commit 719e4de. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Listing descriptions do not match
  • Updated the gopuff README plugin-table cell so its description matches plugin.json and marketplace.json verbatim.

Or push these changes by commenting:

@cursor push 00614a05d5

Preview (00614a05d5)

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -105,7 +105,7 @@
 | `finary` | [Finary](third_party/finary/) | Cursor | Integrations | Read your net worth, accounts, holdings, spending, and budgets. |
 | `tiktok-for-business` | [TikTok for Business](third_party/tiktok-for-business/) | Cursor | Integrations | Manage TikTok ad campaigns, ad groups, ads, audiences, creatives, and reports. |
 | `gusto` | [Gusto](third_party/gusto/) | Cursor | Integrations | Work with payroll, employees, contractors, time off, and reports. |
-| `gopuff` | [Gopuff](third_party/gopuff/) | Cursor | Integrations | Shop Gopuff from Grok Bot: search products, build a cart, get a quote, and place and track orders. |
+| `gopuff` | [Gopuff](third_party/gopuff/) | Cursor | Integrations | Shop Gopuff from Grok Bot through Gopuff's official MCP server. Sign in with your Gopuff account; Gopuff handles the sign-in, and your searches, carts, and orders go to Gopuff under that account, so any order you place is charged and delivered like a normal Gopuff order. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest).
 
 ## Repository structure

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 719e4de. Configure here.}

[cursor]

Listing descriptions do not match

Low Severity · Bugbot Rules

The root README plugin table uses a short shopping blurb for gopuff, while plugin.json and marketplace.json share a longer description that also discloses Gopuff sign-in and that placed orders are charged to the user's account. Listing description is required to match verbatim across those surfaces, so this table cell is out of date with the actual listing copy.

Additional Locations (2)

• third_party/gopuff/.cursor-plugin/plugin.json#L9-L10
• .cursor-plugin/marketplace.json#L578-L579

 

^{Triggered by learned rule: Plugin listing copy must match plugin.json and marketplace.json}

^{Reviewed by Cursor Bugbot for commit 719e4de. Configure here.}