feat(third_party): add Robinhood plugin

[minupalaniappan]

Summary

Adds a robinhood third-party plugin for Robinhood's official remote MCP server, the Robinhood Trading MCP (https://agent.robinhood.com/mcp/trading). Same URL-only OAuth shape as the other hosted-MCP ports (webull, interactive-brokers, meltwater, daloopa, coinbase).

• third_party/robinhood/ — plugin.json (v1.0.0, minClientVersions.cursor 3.13.0), mcp.json, README, CHANGELOG, MIT LICENSE, 192×192 logo from Robinhood's official icon.
• Registered in .cursor-plugin/marketplace.json and the root README plugin table.
• No vendor plugin exists on cursor.com/marketplace for Robinhood.

Auth readiness

Probed with the same recipe used for the earlier finance ports:

Check	Result
Unauthenticated initialize	401 with WWW-Authenticate resource_metadata
Protected-resource metadata	issuer https://agent.robinhood.com/mcp/trading, scopes_supported: ["internal"]
Authorization server metadata	/.well-known/oauth-authorization-server/mcp/trading — PKCE S256, token_endpoint_auth_methods_supported: ["none"], authorization_code + refresh_token
Dynamic client registration	200 as a public client with both https://www.cursor.com/agents/mcp/oauth/callback and http://localhost:8787/callback

Robinhood's docs list Cursor as a supported platform: https://robinhood.com/us/en/support/articles/agentic-trading-overview/

Notes for reviewers

• Trading is write-capable: the server exposes place_*_order / cancel_*_order tools, scoped by Robinhood to a separately funded Agentic account that the user opens on first sign-in (desktop browser only). The README calls this out along with Robinhood's responsibility disclosure.
• Tool list source: https://robinhood.com/us/en/support/articles/trading-with-your-agent/

Testing

• node scripts/validate-plugins.mjs → All plugins validated successfully.
• Not yet done: a real browser sign-in + tool call from a Cursor client (requires opening a Robinhood Agentic account).

---

Note

Medium Risk
New write-capable brokerage MCP exposure (order placement/cancellation) increases user financial risk if misused, though scope is limited to Robinhood’s Agentic account and auth is OAuth-hosted.

Overview
Adds a new robinhood marketplace integration that wires Cursor agents to Robinhood’s hosted Trading MCP at https://agent.robinhood.com/mcp/trading via URL-only HTTP mcp.json and OAuth (PKCE / dynamic client registration), matching other hosted finance plugins.

The PR introduces third_party/robinhood/ (manifest v1.0.0, minClientVersions.cursor 3.13.0, README, CHANGELOG, MIT license) and registers the plugin in .cursor-plugin/marketplace.json and the root README plugin table. Docs stress that agents can place and cancel trades only in a separately funded Agentic account, with broader read access across accounts.

^{Reviewed by Cursor Bugbot for commit c0e9cfc. Bugbot is set up for automated code reviews on this repo. Configure here.}