Add 27 third-party MCP plugins

[roshansada]

Summary

Adds 27 third-party MCP plugins under third_party/, one commit per plugin. Each ships a plugin.json, mcp.json, README, changelog, license, and logo, and is registered in .cursor-plugin/marketplace.json and the root README table.

Every server URL is taken from the vendor's own documentation. 26 of the 27 connect to a hosted server over Streamable HTTP. Xero is the exception and runs locally, because Xero does not publish a hosted endpoint.

Plugins

Marketing and messaging

Plugin	Server	Auth
Klaviyo	https://mcp.klaviyo.com/mcp	OAuth
Customer.io	https://mcp.customer.io/mcp	OAuth
MailerLite	https://mcp.mailerlite.com/mcp	OAuth
Brevo	https://mcp.brevo.com/v1/brevo/mcp	MCP token

Forms

Plugin	Server	Auth
Typeform	https://api.typeform.com/mcp	OAuth
Jotform	https://mcp.jotform.com	OAuth

SEO, web and domains

Plugin	Server	Auth
Semrush	https://mcp.semrush.com/v2/mcp	OAuth
Ahrefs	https://api.ahrefs.com/mcp/mcp	OAuth
Similarweb	https://mcp.similarweb.com	API key
GoDaddy	https://api.godaddy.com/v1/domains/mcp	None — public data

Hiring

Plugin	Server	Auth
Upwork	https://mcp.upwork.com/mcp	OAuth
Workable	https://mcp.workable.com/mcp	OAuth

Finance

Plugin	Server	Auth
Brex	https://api.brex.com/mcp	OAuth
Mercury	https://mcp.mercury.com/mcp	OAuth, read-only
Xero	npx @xeroapi/xero-mcp-server	Client ID and secret

Work management

Plugin	Server	Auth
Todoist	https://ai.todoist.net/mcp	OAuth
Calendly	https://mcp.calendly.com/	OAuth
Smartsheet	https://mcp.smartsheet.com	API token
Wrike	https://mcp.wrike.com/v2	Access token
Coda	https://docs.superhuman.com/apis/mcp	OAuth
Guru	https://mcp.api.getguru.com/mcp	OAuth

Meetings and notes

Plugin	Server	Auth
Fireflies	https://api.fireflies.ai/mcp	OAuth
Otter.ai	https://mcp.otter.ai/mcp	OAuth
Fathom	https://api.fathom.ai/mcp	OAuth
Craft	https://mcp.craft.do/my/mcp	OAuth
Mem	https://mcp.mem.ai/mcp	OAuth
Readwise	https://mcp2.readwise.io/mcp	OAuth

Plugins that take a setting

Most of these are URL-only: install, sign in, done. Five need a value from the user, declared in plugin.json under variables the same way the existing github and salesforce plugins do.

Plugin	Setting
Brevo	MCP token from Account → SMTP & API → API Keys, created with "Create MCP server API key" enabled
Smartsheet	API access token
Wrike	Permanent access token — Wrike's server does not offer dynamic client registration
Similarweb	API key, sent in an api-key header rather than Authorization
Xero	Custom Connection client ID and secret

Notes for review

• Coda is listed at docs.superhuman.com/apis/mcp, not coda.io/apis/mcp. Coda became Superhuman Docs in July and their changelog directs new setups to the new address while the old one is wound down.
• Regional servers default to US or global, with the alternates documented in each README: Customer.io (EU), Typeform (EU), Smartsheet (EU and AU).
• Smartsheet, Wrike, and Similarweb document Cursor setup through npx mcp-remote. They ship here as native remote entries instead, which is equivalent and avoids the subprocess.
• No plugin sets "type": "sse". Guru, Wrike, Semrush, Typeform, Customer.io, Workable, and Similarweb all document that they do not serve SSE.
• Setup gates, each covered in the relevant README: Brex and Customer.io need an account admin to enable MCP before anyone can connect, Jotform needs a workspace admin to install the app, and Workable's OAuth checks redirect URIs against an allowlist.
• Logos are each vendor's official GitHub organisation mark, normalised to 192×192 PNG.

Test plan

• Plugin schema validation passes (node scripts/validate-plugins.mjs)
• Install and authenticate a representative sample: Calendly (OAuth with dynamic client registration), Customer.io (OAuth behind an admin toggle), Smartsheet (API token), Xero (local server), GoDaddy (no auth)
• Run a read-only tool against each

  

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Coda ships unreliable OAuth auth
  • Switched the Coda plugin to Superhuman's recommended PAT via a required CODA_API_TOKEN Configure field and Authorization Bearer header, matching the other token plugins.

Or push these changes by commenting:

@cursor push 1a59c7355f

Preview (1a59c7355f)

diff --git a/third_party/coda/.cursor-plugin/plugin.json b/third_party/coda/.cursor-plugin/plugin.json
--- a/third_party/coda/.cursor-plugin/plugin.json
+++ b/third_party/coda/.cursor-plugin/plugin.json
@@ -29,5 +29,18 @@
     "mcp",
     "knowledge"
   ],
+  "variables": {
+    "type": "object",
+    "properties": {
+      "CODA_API_TOKEN": {
+        "type": "string",
+        "title": "Coda personal access token",
+        "description": "API token created in Superhuman Docs (Coda) under Account \u2192 API settings with restriction type MCP."
+      }
+    },
+    "required": [
+      "CODA_API_TOKEN"
+    ]
+  },
   "mcpServers": "./mcp.json"
 }

diff --git a/third_party/coda/CHANGELOG.md b/third_party/coda/CHANGELOG.md
--- a/third_party/coda/CHANGELOG.md
+++ b/third_party/coda/CHANGELOG.md
@@ -5,5 +5,5 @@
 ## 1.0.0 — initial release
 
 - Added the `coda` MCP server pointing at `https://docs.superhuman.com/apis/mcp`.
-- Auth uses OAuth — no API key or client ID to configure.
+- Auth uses a Superhuman Docs personal access token supplied by the user as a request header.
 - Logo: Coda's official mark, from the `coda` GitHub organization.

diff --git a/third_party/coda/README.md b/third_party/coda/README.md
--- a/third_party/coda/README.md
+++ b/third_party/coda/README.md
@@ -2,13 +2,13 @@
 
 Cursor plugin that connects agents to [Coda](https://coda.io) through Coda's official remote [Model Context Protocol](https://modelcontextprotocol.io/) server.
 
-Search and read Coda docs, pages, and tables, and create or update pages and rows with the same access the signed-in user has.
+Search and read Coda docs, pages, and tables, and create or update pages and rows under the permissions of a personal access token you provide.
 
 ## Install
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Coda**.
-3. Click **Install**, then complete the Coda sign-in prompt.
+3. Click **Install**, then set your Coda personal access token (below).
 
 Or run `/add-plugin coda` in chat.
 
@@ -19,13 +19,16 @@
   "mcpServers": {
     "coda": {
       "type": "http",
-      "url": "https://docs.superhuman.com/apis/mcp"
+      "url": "https://docs.superhuman.com/apis/mcp",
+      "headers": {
+        "Authorization": "Bearer ${CODA_API_TOKEN}"
+      }
     }
   }
 }

-Auth is OAuth 2 with PKCE. Cursor prompts for sign-in when the plugin connects. An OAuth connection is automatically scoped to both read and write.
+Auth is a Superhuman Docs personal access token sent as a bearer token. Create one under Account → API settings with restriction type MCP, then set it in Dashboard → Plugins → Configure. A token can be scoped read-only, write-only, or read+write.

Before you connect

@@ -46,9 +49,9 @@

Notes

-- Tool calls run as the user who authorizes the connection.
+- Tool calls run with the permissions of the personal access token.

• The older https://coda.io/apis/mcp address still serves existing connections, but Superhuman's changelog says new setups should use docs.superhuman.com/apis/mcp — so that is what this plugin ships.
  -- Superhuman also accepts a personal access token sent as Authorization: Bearer <token>, which lets you pick read-only, write-only, or read+write instead of OAuth's read+write. The token must be created with restriction type MCP or the server returns 401. Superhuman currently recommends the token path for Cursor because of refresh-token handling.
  +- Superhuman also supports OAuth 2 with PKCE, but Cursor's refresh-token handling against this server is unreliable, so this plugin ships the token path Superhuman recommends for Cursor. The token must be created with restriction type MCP or the server returns 401.
• The coda-mcp npm package is a community local server by a third-party maintainer, unrelated to this hosted endpoint.

Docs

diff --git a/third_party/coda/mcp.json b/third_party/coda/mcp.json
--- a/third_party/coda/mcp.json
+++ b/third_party/coda/mcp.json
@@ -2,7 +2,10 @@
"mcpServers": {
"coda": {
"type": "http",

•  "url": "https://docs.superhuman.com/apis/mcp"
  

•  "url": "https://docs.superhuman.com/apis/mcp",
  

•  "headers": {
  

•    "Authorization": "Bearer ${CODA_API_TOKEN}"
  

•  }
  

  }
  }
  }

</details>


<sub>You can send follow-ups to the cloud agent <a href="https://cursor.com/agents/bc-2ff73351-1e44-40d0-8675-b5a4df3e10b0">here</a>.</sub>
<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END -->

<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e0c412ff59bf0b42a613142f79cfb298de0cb584. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

[cursor]

Coda ships unreliable OAuth auth

Medium Severity · Logic Bug

The coda plugin connects with OAuth only, but Superhuman’s own Cursor guidance recommends a personal access token because Cursor’s refresh-token handling fails against this server. Install and first sign-in can succeed, then the connection degrades after token refresh. The README already notes the token path and Authorization: Bearer shape used by other token plugins here.

Additional Locations (1)

• third_party/coda/README.md#L48-L51

 

^{Reviewed by Cursor Bugbot for commit e0c412f. Configure here.}