feat(third_party): add eToro Trading plugin

[minupalaniappan]

Summary

Adds third_party/etoro-trading, a URL-only hosted-MCP plugin for eToro's account-scoped Public API server at https://mcp.public-api.etoro.com. Same shape as the Coinbase (#354) and Robinhood (#409) ports: OAuth via dynamic client registration, no credential variables, minClientVersions.cursor: 3.13.0.

Why a separate plugin from the vendor's etoro: eToro's own marketplace plugin (etoro, publisher eToro) is a developer plugin — API-building rules, skills, and a documentation-search MCP at api-portal.etoro.com/mcp. It does not connect to a user's account. This plugin targets the trading server eToro documents for Cursor in its Cursor integration guide; the README points API builders at the vendor plugin so the two are not confused.

Server probe (2026-09-22):

• Unauthenticated initialize → 401 with WWW-Authenticate: Bearer resource_metadata=https://mcp.public-api.etoro.com/.well-known/oauth-protected-resource.
• Authorization server https://www.etoro.com: RFC 8414 metadata with registration_endpoint https://www.etoro.com/api/sso/v1/register, PKCE S256, token_endpoint_auth_method: none supported.
• DCR with Cursor's redirect set (https://www.cursor.com/agents/mcp/oauth/callback, http://localhost:8787/callback) as a public client → 201, client issued with etoro-public:* scopes.
• 17 tools: portfolio summary, balances, positions/orders, watchlists, trading history, profile/scopes, instrument and trader research, prepare-trade/place-trade, prepare-close/place-close (confirmation-token gated), execute-read/execute-write, route catalog and specs.

Risk notes in the README: the server places real trades on Real accounts; the confirmation-token gate and the agent-approval instructions in the tool descriptions are documented, along with the Demo-vs-Real distinction and the reach of execute-write.

Logo is the mark eToro publishes for its own Cursor marketplace listing, resized to 192×192.

Test plan

• node scripts/validate-plugins.mjs → "All plugins validated successfully."
• Live probes above (401 challenge, AS metadata, DCR 201, tools/list).
• Not yet done: a real browser sign-in plus a read-only call (get-my-profile-and-scopes) from a Cursor client on the loopback redirect. eToro's docs mention no harness allowlist, unlike Coinbase.

---

Note

Medium Risk
New integration enables live trading and broad execute-write API access on user accounts; risk is mostly operational/user-consent rather than changes to core repo code.

Overview
Adds etoro-trading to the Cursor plugin marketplace: a new third_party/etoro-trading package that wires agents to eToro’s hosted MCP at https://mcp.public-api.etoro.com (HTTP-only mcp.json, OAuth/PKCE with no bundled secrets, minClientVersions.cursor: 3.13.0).

Marketplace wiring: etoro-trading is registered in .cursor-plugin/marketplace.json and the root README.md integrations table.

Plugin contents: manifest, mcp.json, README (install, Demo vs Real, prepare/place trade flow, distinction from eToro’s developer etoro plugin), CHANGELOG, and MIT license. Trading and account actions run on eToro’s remote server, not in this repo.

^{Reviewed by Cursor Bugbot for commit bcf813a. Bugbot is set up for automated code reviews on this repo. Configure here.}