Add X Money plugin for Grok Bot

.cursor-plugin/marketplace.json

@@ -442,6 +442,16 @@
       "name": "etoro-trading",
       "source": "third_party/etoro-trading",
       "description": "View your eToro portfolio, balances, positions, and watchlists, research instruments and traders, and prepare and place trades."
+    },
+    {
+      "name": "x-money",
+      "source": "third_party/x-money",
+      "description": "Use your X Money Card, send money to users on X, manage your finances, view your balance and browse through your transaction history.",
+      "minClientVersions": {
+        "cursor": "never",
+        "grokbot": "0.52.0",
+        "sand": "0.52.0"
+      }
     }
   ]
 }

README.md

@@ -89,6 +89,7 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc
 | `robinhood` | [Robinhood](third_party/robinhood/) | Cursor | Integrations | View portfolios, positions, orders, watchlists, and market data, and trade in a Robinhood Agentic account. |
 | `coinbase` | [Coinbase](third_party/coinbase/) | Cursor | Integrations | Check balances, get quotes, and preview or place trades. |
 | `etoro-trading` | [eToro Trading](third_party/etoro-trading/) | Cursor | Integrations | View your eToro portfolio, balances, positions, and watchlists, research instruments and traders, and prepare and place trades. |
+| `x-money` | [X Money](third_party/x-money/) | Cursor | Integrations | Use your X Money Card, send money to users on X, manage your finances, view your balance and browse through your transaction history. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest).
 
 ## Repository structure

third_party/x-money/.cursor-plugin/plugin.json

@@ -0,0 +1,42 @@
+{
+  "name": "x-money",
+  "displayName": "X Money",
+  "version": "1.0.0",
+  "minClientVersions": {
+    "cursor": "never",
+    "grokbot": "0.52.0",
+    "sand": "0.52.0"
+  },
+  "description": "Use your X Money Card, send money to users on X, manage your finances, view your balance and browse through your transaction history.",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://x.com/i/money",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "logo": "assets/logo.png",
+  "keywords": [
+    "x money",
+    "xmoney",
+    "x",
+    "payments",
+    "balance",
+    "transactions",
+    "send money",
+    "p2p",
+    "virtual card",
+    "wallet",
+    "finance",
+    "mcp"
+  ],
+  "category": "integrations",
+  "tags": [
+    "x-money",
+    "payments",
+    "finance",
+    "mcp"
+  ],
+  "mcpServers": "./mcp.json",
+  "skills": "./skills/"
+}

third_party/x-money/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+All notable changes to this plugin will be documented here.
+
+## 1.0.0 — initial release
+
+- Added the `x-money` MCP server pointing at X Money's hosted Streamable HTTP endpoint (`https://mcp.money.x.com/mcp`), declared `placement: "server"` because the OAuth grant and tool calls live on the Cursor backend.
+- Auth is OAuth 2.1 with PKCE. The Cursor backend is a registered confidential client of X Money, so the plugin ships no client ID, secret, or variables. Consent is a connection code approved with a passkey in the X app.
+- Added the X Money guide skill: how the connection-code and passkey flow works, how to guide a user through connect, reconnect, and revoke at `x.com/i/money/settings/connections`, what each refusal means, and the approval rule for actions that move money.
+- Grok Bot only (`grokbot` / `sand` 0.52.0 or newer, `cursor: "never"`).
+- Logo: X Money's official mark.

third_party/x-money/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

third_party/x-money/README.md

@@ -0,0 +1,82 @@
+# X Money
+
+Grok Bot plugin that connects agents to [X Money](https://x.com/i/money) through X Money's hosted [Model Context Protocol](https://modelcontextprotocol.io/) server at `https://mcp.money.x.com/mcp`.
+
+Use your X Money Card, send money to users on X, manage your finances, view your balance and browse through your transaction history.
+
+## Who can use it
+
+- Grok Bot **0.52** or newer.
+- An active X Money account. X Money is available to eligible customers in the United States.
+- Not available in Cursor. Cursor must not list or install this plugin.
+
+## Install
+
+1. Open **Grok Bot → Plugins**.
+2. Search for **X Money**.
+3. Click **Install**, then complete the X Money connection when prompted.
+
+Or ask the agent to connect your X Money account.
+
+## MCP
+
+```json
+{
+  "mcpServers": {
+    "x-money": {
+      "type": "http",
+      "url": "https://mcp.money.x.com/mcp",
+      "placement": "server"
+    }
+  }
+}
+```
+
+## Connecting
+
+Auth is OAuth. There is no client ID, API key, or token to paste. Cursor completes the sign-in on your behalf.
+
+1. Grok Bot opens the **Connect Grok Bot to X Money** page in a browser. It shows a connection code and a QR code.
+2. Enter the code in the X Money app, or scan the QR code, and approve with your passkey.
+3. The page confirms the connection and Grok Bot picks it up on its own.
+
+The code is valid for about 5 minutes. You can revoke the connection at any time from **X → Money → Settings → Connections**.
+
+## What agents can do
+
+| Category | Capabilities |
+| --- | --- |
+| Balances | Available balance of your X Money accounts |
+| Transactions | Your transaction history, with optional filters |
+| Payments | Send money to another X user, or ask another X user to pay you |
+| Purchases | Pay a merchant online with an X Money virtual card |
+
+X Money decides which actions are available for each account, so the set can differ between users.
+
+## Approval
+
+Every action that moves money is confirmed with you first. Before sending money, requesting money, or paying a merchant, the agent shows an Approve / Cancel prompt that states exactly who, how much, and what for. Nothing happens until you approve, and each action needs its own approval. X Money also enforces this on its side and refuses any such call that was not approved.
+
+## Skill
+
+`skills/x-money-guide/SKILL.md` gives the agent the approval rule above, the connection flow, how to guide you through connect, reconnect, and revoke, and what each X Money failure message means.
+
+## Notes
+
+- Payments and purchases made through this plugin are live and move real money.
+- Every action passes the same X Money checks as the app, plus separate limits for agents. When X Money refuses an action, the agent relays the reason and does not retry.
+- Higher-risk transfers stay in the X app and are not available to agents.
+- Card details used for a purchase go straight to the merchant checkout and are never shown in chat.
+- The agent never sees your X Money password, passkey, or bank credentials.
+
+## Docs
+
+- X Money: https://x.com/i/money
+- Manage connected agents: https://x.com/i/money/settings/connections
+- Server URL: https://mcp.money.x.com/mcp
+
+Logo is X Money's official mark.
+
+## License
+
+MIT

third_party/x-money/mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "x-money": {
+      "type": "http",
+      "url": "https://mcp.money.x.com/mcp",
+      "placement": "server"
+    }
+  }
+}

third_party/x-money/skills/x-money-guide/SKILL.md

@@ -0,0 +1,172 @@
+---
+name: X Money guide
+description: >-
+  Read this before the first X Money action in a session and again on any
+  X Money error, refusal, or missing capability. Covers the approval rule for
+  every action that moves money (always ask, every time, no exceptions), how
+  the connection works (connection code plus passkey in the X app), how to
+  guide the user through connect, reconnect, and revoke at
+  x.com/i/money/settings/connections, and what each failure message means.
+---
+
+# X Money guide
+
+This plugin connects the agent to the user's X Money account through the **X Money MCP** at `https://mcp.money.x.com/mcp`. The user connects once in Grok Bot, and the agent then acts on their X Money account on their behalf.
+
+Discover what the user can do from the server's tool list. The list is decided per account by X Money, so do not assume an action exists because it is mentioned here. Every result carries a `message` written for the user. Relay it in your own words instead of describing internals.
+
+## Always confirm before moving money
+
+Some actions move real money or create a way to spend it: sending money, requesting money, and paying a merchant. For each one:
+
+1. **Ask first, every time.** Send a `SendToUser` widget with **Approve** and **Cancel**. The prompt is one sentence that states exactly what the user is approving: who gets paid or is asked, how much, and what for. For a purchase: the item, the merchant, and the total. Put the breakdown (items, shipping, tax, fees) in the help text. If the amount is an estimate, say so.
+2. **Wait for the answer.** Call the tool only after the user picks Approve. If they pick Cancel, or do not answer, do nothing and say so.
+3. **Approve one action at a time.** Never batch several payments under one approval. Never carry an approval over from an earlier message, an earlier session, or a general instruction such as "handle it".
+4. **Re-ask when anything changes.** A different amount, recipient, merchant, or purpose is a new action and needs a new approval.
+5. **Never fake it.** Every money-moving tool has an approval input. The server rejects the call when it is not set and confirms that nothing was done. Set it only after a real Approve in this conversation.
+
+Ask for balances and transactions freely. Those are read-only.
+
+## How the connection works
+
+1. The user taps **Connect** on the X Money plugin in Grok Bot.
+2. A page titled **Connect Grok Bot to X Money** opens. It shows a **connection code** and a QR code.
+3. The user enters the code in the **X Money app** (or scans the QR code) on the X account that owns the X Money account, then approves with their **passkey**.
+4. The page shows **Connected. You can return to Grok Bot.** and the connection completes on its own.
+
+The code is valid for about 5 minutes. The connection then stays active until the user revokes it or stops using it for a long period. There is no client ID, API key, or token for the user to handle, and the agent never sees one.
+
+## Connections screen
+
+`https://x.com/i/money/settings/connections` — in the X app: **Money → Settings → Connections**.
+
+Send the user here to:
+
+- see which agents are connected to X Money and what each one can do,
+- revoke Grok Bot's access,
+- confirm that a connection they just approved is listed.
+
+Revoking ends the connection at once. The next X Money action fails with an authorization error and the user must connect again.
+
+## Troubleshooting
+
+Match the situation, say the quoted line in your own voice, then give the one next step. Do not explain OAuth, tokens, or how the connection works internally.
+
+### Not connected, or authorization error on a call
+
+Signals: X Money shows as needing authorization, no X Money tools are listed, or a call fails with `401` or `invalid bearer token`.
+
+> Your X Money connection is not active. Open the X Money plugin in Grok Bot and tap Connect, then enter the connection code in the X Money app and approve it with your passkey.
+
+If the user says they did not revoke anything, still reconnect. There is no other way to restore a connection.
+
+### "This code has expired. Start again from Grok Bot."
+
+The consent page says this after about 5 minutes.
+
+> The connection code expired. Tap Connect again in Grok Bot to get a new code, then approve it in the X Money app right away.
+
+### "This connection was not approved."
+
+The user declined in the X Money app.
+
+> The connection was declined. If you still want to connect, tap Connect again in Grok Bot and approve the new code.
+
+### "The connection code is invalid, expired, or already used."
+
+The X Money app says this when the code was claimed on another account, was already used, or expired.
+
+Ask which X account they are signed into in the X Money app. The code must be approved from the X account that holds the X Money account. Each code works once. Tell them to start again from Connect.
+
+### Passkey step fails
+
+The X Money app cannot complete the passkey challenge.
+
+> Approving an agent connection needs a passkey on your X account. Set one up in X → Settings → Security, then approve the connection again.
+
+### "New customer connections are not currently accepted."
+
+The connection was approved but X Money did not activate it. This is a staged rollout, not an account problem.
+
+> X Money is not accepting new agent connections for your account right now. Try again later.
+
+Do not suggest workarounds.
+
+### "Something went wrong. Refresh this page to try again." or "Something went wrong. Try again."
+
+A transient error on the consent page.
+
+> Refresh the page. If it fails again, tap Connect in Grok Bot to start over.
+
+### "This X Money MCP tool isn't ready for you yet." or an action is missing
+
+X Money enables actions per account. A missing tool, or this message on a call, means the action is not turned on for this user.
+
+> That X Money action is not enabled for your account yet.
+
+Offer the actions that are present. Do not tell the user to reinstall or reconnect.
+
+### "Not authorized to call tool"
+
+The user's role on the account does not allow this action, for example a member of a joint account.
+
+> Your X Money account does not allow that action from here. You can do it in the X Money app.
+
+### "MCP is not enabled"
+
+X Money has paused agent access for everyone.
+
+> X Money is temporarily unavailable to agents. Try again later.
+
+### User has no X Money account
+
+The consent page or the X Money app says the user cannot use X Money, or the user says they never set it up.
+
+> X Money is available to eligible customers in the United States. Set up X Money in the X app first, then connect it here.
+
+## Reading payment results
+
+Every send or request returns an `outcome` and a `message`.
+
+| Outcome | Meaning | What to do |
+| --- | --- | --- |
+| `completed` | The money moved, or the request reached the other person | Relay the message |
+| `pending` | X Money is reviewing it, or the other person has to act | Relay the message. Do not send again. The user can watch it in the X Money app |
+| `refused` | X Money did not make it | Relay the message. **Never retry a refusal** and never change the amount to get around it |
+
+Common refusal messages and what to add:
+
+| Message contains | Add |
+| --- | --- |
+| `verify this payment in the X Money app` | Agents cannot complete verification. The user can send it themselves in the X app. |
+| `per-payment limit for agents` or `Agents can't move money for this account` | Agent payments have their own limits. The user can do this in the X Money app. |
+| `sending limits` or `Too many transfers` | Try again later or pay in the X Money app. |
+| `balance is too low` | Check the balance and offer a smaller amount, or adding funds in the X app. |
+| `No X user named` | Confirm the @handle. Handles change; a numeric X user id is more stable. |
+| `isn't on X Money yet` | The other person has to set up X Money before they can be paid or asked. |
+| `own X account` | Pick another X user. |
+| `only accepts money from people they follow` | Nothing to fix from here. |
+| `different currencies` or `can't receive` or `can't send` | Nothing to fix from here. Pay in the X Money app. |
+| `X Money did not allow this payment` | X Money blocked it and gives no further reason. Do not retry. |
+
+Two results are not outcomes but errors, and both matter:
+
+- **`X Money could not process this right now; try again later`** — a transient failure. Nothing moved. Tell the user. Retry once later only if they still want it, with a fresh approval.
+- **`X Money accepted this payment but could not confirm it. Do not send it again`** — the payment may have gone through. **Never send it again.** Tell the user to check the transaction in the X Money app.
+
+When you retry the very same payment after a network failure, reuse the same idempotency key so X Money never makes it twice. A reused key returns the earlier result and says so.
+
+## Purchases with a card
+
+- Approve the purchase itself: item, merchant, and total. The card X Money issues is not what the user approves.
+- If the result says **no card was created** because a daily limit is reached, it names when limits reset. Tell the user and stop. Do not try again today.
+- `failed to create card, try again` is transient. One retry is fine, with the same approval.
+- Card details go straight into the merchant checkout. Never print the card number, CVC, or expiry in chat, and never store them.
+
+## Never
+
+- Never ask the user for an X Money password, passkey, card number, or bank login.
+- Never ask the user to paste a token or code into chat.
+- Never move money, request money, or create a card without a fresh approval for that exact action.
+- Never retry a refusal, an unconfirmed payment, or a limit result.
+- Never explain tokens or how the connection works internally. Name the situation and the next step.