webull: require Cursor 3.22.0 (single-redirect DCR retry)

[minupalaniappan]

Webull's authorization server (u1suserauth.webullfintech.com) rejects dynamic client registration with more than one redirect URI (417 redirectUris only supports 1 URI). Cursor registers [https://www.cursor.com/agents/mcp/oauth/callback, http://localhost:8787/callback]; only Cursor 3.22.0+ (everysphere #1045801, client-3.22.0-pre.12+) retries registration with the loopback URI alone, so on 3.13–3.21 the sign-in fails after the plugin is installed.

This raises minClientVersions.cursor from 3.13.0 to 3.22.0 so Webull is hidden from clients that cannot complete sign-in, and reappears automatically once they update. Version bumped to 1.0.1 with a changelog entry.

Verified 2026-09-21: POST https://api.webull.com/mcp initialize → 401 with OAuth discovery; DCR with the two-URI redirect set still returns 417. Grok Bot is unaffected (no grokbot key in this manifest).

node scripts/validate-plugins.mjs: all plugins validated.

---

Note

Low Risk
Manifest and changelog-only change that gates plugin visibility by client version; no security or runtime logic changes.

Overview
Bumps the Webull plugin to 1.0.1 and raises minClientVersions.cursor from 3.13.0 to 3.22.0 so the integration is only offered on clients that can finish OAuth sign-in.

Webull’s dynamic client registration accepts a single redirect URI; older Cursor builds register two URIs and fail with 417, while 3.22.0+ retries registration with the loopback redirect alone. The changelog documents that behavior; no MCP server or auth implementation code changes.

^{Reviewed by Cursor Bugbot for commit ab9a817. Bugbot is set up for automated code reviews on this repo. Configure here.}