Add invinoveritas plugin: independent pre-action review via remote MCP

[babyblueviper1]

What

Adds invinoveritas to third_party/ — a Cursor plugin connecting to invinoveritas's official remote MCP server (https://api.babyblueviper.com/mcp, Bearer-token auth) for an independent, signed verdict (approve/approve_with_concerns/reject) before an irreversible or high-consequence agent action: a destructive shell command, a production deploy, a merge to main. Advisory only — never blocks, the agent stays fully autonomous and decides.

Why

Most of this ecosystem's own tools already answer "can this agent do X" (authorization/eligibility). This answers a different question: "is this specific action, right now, actually sound" — a judgment call, not a policy lookup. That matters more as agent-driven merge/branch workflows scale past what a human can review per-action; a signed, independently-checkable pre-action verdict is a real second opinion on that path, not a human gate.

What's included

• .cursor-plugin/plugin.json — manifest, IVV_API_KEY variable forwarded via Authorization: Bearer header (same pattern as the github plugin).
• mcp.json — points at the live production MCP endpoint.
• skills/pre-action-review/SKILL.md — teaches the agent when to call review (destructive commands, merges, deploys, migrations — not routine reversible edits) and how to act on the verdict without silently dropping concerns.
• README.md, CHANGELOG.md, LICENSE (MIT), assets/logo.png (256×256).
• Registered in .cursor-plugin/marketplace.json.

Verification

• Real MCP initialize handshake against production, Bearer-authenticated: succeeded.
• Real tools/call for review against production through the exact transport this plugin configures: returned a correct reject verdict with structured, severity-ranked issues on a genuinely destructive test artifact (not a mock).
• plugin.json validated against schemas/plugin.schema.json (jsonschema in Python + inspected by hand).
• node scripts/validate-plugins.mjs — the actual CI check — passes clean locally.
• Free to install and try: POST /register (no payment) → free try-it calls on review before any billing.

Docs

• Live tool list + schemas: https://api.babyblueviper.com/.well-known/mcp/server-card.json
• Free, no-auth proof verification: POST /verify-proof
• Public signed-verdict track record: https://api.babyblueviper.com/ledger

---

Note

Low Risk
Marketplace and third-party plugin scaffolding only; no core platform code changes. Risk to users is limited to optional install and outbound calls to the external MCP when the skill is used.

Overview
Adds invinoveritas as a new third-party Cursor plugin and lists it in .cursor-plugin/marketplace.json.

The plugin wires agents to invinoveritas’s remote HTTP MCP server (https://api.babyblueviper.com/mcp) using a required IVV_API_KEY plugin variable passed as Authorization: Bearer in mcp.json, matching the existing third-party MCP pattern (e.g. GitHub).

It ships the pre-action-review skill, which instructs the agent to call the remote review tool before irreversible or high-impact work (destructive commands, merges, deploys, migrations) and to honor reject / approve_with_concerns / approve without hiding concerns. Optional signed proofs via verify_proof are documented in the skill.

Also included: plugin.json manifest, README/setup docs, MIT LICENSE, and CHANGELOG for the 1.0.0 release.

^{Reviewed by Cursor Bugbot for commit ac1bf39. Bugbot is set up for automated code reviews on this repo. Configure here.}