Add Gong and Salesforce MCP plugins

[SamSokolin]

Summary

Adds two MCP integration plugins to the public marketplace, and extends the plugin schema with a variables block so manifests can declare user-configured values.

Supersedes #168, which added Gong only and was closed.

• third_party/gong/ — Gong's official hosted MCP server at https://mcp.gong.io/mcp. Declares CLIENT_ID / CLIENT_SECRET and forwards both into MCP auth.
• third_party/salesforce/ — Salesforce Hosted MCP. Declares SALESFORCE_MCP_URL / CLIENT_ID.
• schemas/plugin.schema.json — new variables property. The schema sets additionalProperties: false, so neither manifest validates without it.

Both live under a new third_party/ directory to group vendor integrations separately from Cursor-authored plugins. Nested marketplace source paths work: resolvePluginSourcePath treats source as a relative path and only strips a leading ./. The already-published gmail, google-drive, and google-calendar plugins move there too, so all vendor integrations sit together. That move is safe for published plugins: the indexer keys identity on (marketplaceId, name), so a re-index updates gitPath in place instead of creating a new row, and deprecation is name-based as well. Their logo values stay relative to the plugin root and re-resolve against the new base path; their tree/main/... homepage URLs were updated.

Why Salesforce is shaped differently from Gong

Three things make it not a copy of the Gong manifest:

No client secret. Salesforce Hosted MCP authenticates Cursor as a public client over PKCE. Salesforce's own docs recommend against secrets for desktop clients, and their Cursor setup page shows CLIENT_ID alone. Adding a secret variable would be a footgun.

The whole URL is templated, not just credentials. The server URL encodes both org type and server kind, so there are four shapes and no useful default:

Org type	Standard server	Custom server
Production / Developer / Enterprise	…/mcp/v1/platform/sobject-all	…/mcp/v1/custom/myserver
Sandbox / scratch	…/mcp/v1/sandbox/platform/sobject-all	…/mcp/v1/sandbox/custom/myserver

One ${SALESFORCE_MCP_URL} variable covers all four. This also lets a team point at sobject-reads or sobject-mutations instead of full CRUD.

Scopes are pinned to mcp_api and refresh_token. Cursor otherwise auto-fetches scopes from discovery. Both are needed: mcp_api for access, refresh_token so sessions renew instead of dying at token expiry. Verified against the live endpoint:

GET https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all/.well-known/oauth-protected-resource
{"scopes_supported": ["mcp_api", "refresh_token"]}

Verification

• node scripts/validate-plugins.mjs → All plugins validated successfully.
• git diff --check → clean
• Salesforce config exercised end to end against a live sandbox org (getUserInfo, soqlQuery, getObjectSchema, find) using the exact url + auth shape in salesforce/mcp.json.

The salesforce/README.md setup section is written from that live setup, not just the docs — it calls out the four failure modes we actually hit: 30-minute External Client App propagation (invalid_client_id), the refresh_token scope hiding behind the label "Perform requests at any time", opaque-vs-JWT tokens (JWT Token is required), and JWT Bearer Flow being the wrong setting.

Open question for reviewers

Neither plugin sets minClientVersions. The Google plugins pin cursor: 3.13.0, and variables plus static-CLIENT_ID auth presumably have their own floor — I didn't want to guess a number. Happy to add one if someone knows the right minimum.

Both plugins now ship a logo. Gong uses its official 180×180 apple-touch-icon unmodified. Salesforce publishes no square icon larger than a 32px favicon, so theirs is built from Salesforce's official vector cloud mark centered on a 192×192 white tile — the same treatment the Google plugins use. Both marks are trademarked and were taken from vendor CDNs rather than a redistribution-licensed source, so flag if that needs brand or legal sign-off before merge.

---

Note

Medium Risk
Adds OAuth-backed third-party MCP integrations and a schema change for credential variables; impact is limited to plugin packaging and external API access, not core Cursor runtime code.

Overview
Introduces Gong and Salesforce marketplace plugins under third_party/, each wiring a hosted MCP server with user-configured credentials via new manifest variables (OAuth client IDs/secrets for Gong; org-specific MCP URL and consumer key for Salesforce, with pinned mcp_api / refresh_token scopes).

Extends schemas/plugin.schema.json with a variables object so those manifests validate. Gmail, Google Drive, and Google Calendar move into third_party/ as well; .cursor-plugin/marketplace.json and README point at the new paths and list the two new integrations.

^{Reviewed by Cursor Bugbot for commit 912a7c6. Bugbot is set up for automated code reviews on this repo. Configure here.}