feat(third_party): add Coinbase plugin

[minupalaniappan]

Warning

Blocked on Coinbase. Coinbase's remote MCP server is available only to harnesses on an explicit allowlist (ChatGPT, Grok, Perplexity Computer, Claude, Claude Code). Cursor is not on it, and login.coinbase.com publishes no registration_endpoint, so there is no client id Cursor can use and sign-in cannot complete in any plugin shape. Draft until Coinbase allowlists Cursor and Cursor has a client identity (a partner OAuth client wired as a static provider policy, or Client ID Metadata Document support against client_id_metadata_document_supported: true).

Summary

• Add Coinbase as a third_party/ marketplace plugin, in the Attio (Add Attio third-party MCP plugin #339) / Hunter (Add Hunter third-party MCP plugin (API key header auth) #340) shape.
• One of nine hosted-MCP connectors that grok.com offers publicly (GrowthBook visibility all) and the Cursor marketplace does not. The server URL matches Grok's production connector_catalog.mcp_server_url.
• Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
• URL-only OAuth, matching Coinbase's documented setup and the other eight connectors in this batch. The original CLIENT_ID / CLIENT_SECRET variables were dropped: Coinbase Developer Platform OAuth client creation is limited to approved partners, so users could not have supplied them (Bugbot finding).

Endpoint	https://agents.coinbase.com/mcp
Auth	OAuth via Coinbase sign-in. Probed: 401 → login.coinbase.com; PRM advertises mcp:* scopes; AS has no dynamic client registration.
Grok visibility	all

MCP

{
  "mcpServers": {
    "coinbase": {
      "type": "http",
      "url": "https://agents.coinbase.com/mcp"
    }
  }
}

Stack

Split from #345 into one PR per plugin.

1. gamma feat(third_party): add Gamma plugin #347 ✅ merged
2. webull feat(third_party): add Webull plugin #348 ✅ merged
3. sp-global feat(third_party): add S&P Global plugin #349 ✅ merged
4. interactive-brokers feat(third_party): add Interactive Brokers plugin #350 ✅ merged
5. meltwater feat(third_party): add Meltwater plugin #351 ✅ merged
6. daloopa feat(third_party): add Daloopa plugin #352 ✅ merged
7. excalidraw feat(third_party): add Excalidraw plugin #353 ✅ merged
   8. coinbase feat(third_party): add Coinbase plugin #354 ← this PR (blocked)
8. google-cloud-bigquery feat(third_party): add Google Cloud BigQuery plugin #355 ✅ merged

Test plan

• node scripts/validate-plugins.mjs passes on this branch
• Endpoint probed for OAuth discoverability and dynamic client registration
• README has Install / MCP / Availability / What agents can do / Notes / Docs / License, with capabilities sourced from vendor docs
• marketplace.json, plugin.json, and README table descriptions are identical
• Logo visually reviewed at 192×192
• Blocked: install from Cursor Settings → Plugins, complete Coinbase sign-in, and smoke test listing portfolios — requires Coinbase allowlisting Cursor

Notes

• Orders placed through this server are live; Coinbase recommends scoping the agent to a dedicated portfolio.

---

Note

Medium Risk
Introduces a live-trading crypto integration (OAuth to user accounts) via marketplace config; repo change is low-risk, but end-user impact is financial once allowlisting unblocks sign-in.

Overview
Adds a new Coinbase third-party marketplace plugin so agents can connect to Coinbase’s hosted remote MCP at https://agents.coinbase.com/mcp for balances, quotes, and trade preview/execution.

The change registers coinbase in .cursor-plugin/marketplace.json and the root README plugin table, and adds third_party/coinbase/ with manifest, URL-only mcp.json (no user API key variables), docs, changelog, and MIT license—same hosted-MCP pattern as other finance connectors. README and changelog call out OAuth sign-in and that the integration is blocked until Coinbase allowlists Cursor as an MCP harness; they also warn that orders through the server are live.

^{Reviewed by Cursor Bugbot for commit 07242f3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Invented Coinbase OAuth client credentials
  • Removed the required CLIENT_ID/CLIENT_SECRET pair so the plugin uses Coinbase's documented URL-only login OAuth against https://agents.coinbase.com/mcp.

Or push these changes by commenting:

@cursor push db37780599

Preview (db37780599)

diff --git a/third_party/coinbase/.cursor-plugin/plugin.json b/third_party/coinbase/.cursor-plugin/plugin.json
--- a/third_party/coinbase/.cursor-plugin/plugin.json
+++ b/third_party/coinbase/.cursor-plugin/plugin.json
@@ -31,24 +31,5 @@
     "crypto",
     "mcp"
   ],
-  "variables": {
-    "type": "object",
-    "properties": {
-      "CLIENT_ID": {
-        "type": "string",
-        "title": "Coinbase OAuth Client ID",
-        "description": "OAuth client ID from the Coinbase Developer Platform portal (portal.cdp.coinbase.com \u2192 OAuth)."
-      },
-      "CLIENT_SECRET": {
-        "type": "string",
-        "title": "Coinbase OAuth Client Secret",
-        "description": "OAuth client secret from the same Coinbase Developer Platform OAuth client."
-      }
-    },
-    "required": [
-      "CLIENT_ID",
-      "CLIENT_SECRET"
-    ]
-  },
   "mcpServers": "./mcp.json"
 }

diff --git a/third_party/coinbase/CHANGELOG.md b/third_party/coinbase/CHANGELOG.md
--- a/third_party/coinbase/CHANGELOG.md
+++ b/third_party/coinbase/CHANGELOG.md
@@ -5,5 +5,5 @@
 ## 1.0.0 — initial release
 
 - Added the `coinbase` MCP server pointing at Coinbase's hosted Streamable HTTP endpoint (`https://agents.coinbase.com/mcp`).
-- Auth uses OAuth with Coinbase user login. Declared `CLIENT_ID` and `CLIENT_SECRET` plugin variables and forwarded them through MCP auth, since `login.coinbase.com` does not support dynamic client registration.
+- Auth uses Coinbase user login OAuth against the hosted remote URL. No client ID or secret is required.
 - Logo: Coinbase's official mark, from the `coinbase` GitHub organization.

diff --git a/third_party/coinbase/README.md b/third_party/coinbase/README.md
--- a/third_party/coinbase/README.md
+++ b/third_party/coinbase/README.md
@@ -8,7 +8,7 @@
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Coinbase**.
-3. Click **Install**, then follow **Setup** below.
+3. Click **Install**, then complete the Coinbase sign-in prompt.
 
 Or run `/add-plugin coinbase` in chat.
 
@@ -18,29 +18,14 @@
 {
   "mcpServers": {
     "coinbase": {
-      "url": "https://agents.coinbase.com/mcp",
-      "auth": {
-        "CLIENT_ID": "${CLIENT_ID}",
-        "CLIENT_SECRET": "${CLIENT_SECRET}"
-      }
+      "url": "https://agents.coinbase.com/mcp"
     }
   }
 }

-## Setup
+Auth is OAuth against Coinbase. Cursor prompts for Coinbase user login when the plugin connects — there is no API key or client ID to configure. On the approval screen, select which portfolios to give the agent access to. Coinbase recommends scoping the agent to a dedicated portfolio.

-Coinbase's authorization server (login.coinbase.com) does not support dynamic client registration, so an OAuth client has to be registered before anyone can connect.

-1. In the Coinbase Developer Platform portal, create an OAuth client and enable the Coinbase for Agents (mcp:*) scopes you want to expose.
-2. Register both redirect URIs on that client:

• • Desktop: http://localhost:8787/callback
• • Web and Cloud Agents: https://www.cursor.com/agents/mcp/oauth/callback
    -3. In Dashboard → Plugins → Configure, set Coinbase OAuth Client ID and Coinbase OAuth Client Secret from that client.
    -4. Complete the Coinbase login when Cursor prompts.

-On a team marketplace an admin sets the client ID and secret once for everyone; each member still completes their own Coinbase login, so tool calls run against that member's account. Coinbase recommends scoping the agent to a dedicated portfolio.

What agents can do

| Category | Capabilities |

diff --git a/third_party/coinbase/mcp.json b/third_party/coinbase/mcp.json
--- a/third_party/coinbase/mcp.json
+++ b/third_party/coinbase/mcp.json
@@ -1,11 +1,7 @@
{
"mcpServers": {
"coinbase": {

•  "url": "https://agents.coinbase.com/mcp",
  

•  "auth": {
  

•    "CLIENT_ID": "${CLIENT_ID}",
  

•    "CLIENT_SECRET": "${CLIENT_SECRET}"
  

•  }
  

•  "url": "https://agents.coinbase.com/mcp"
  

  }
  }
  }

</details>


<sub>You can send follow-ups to the cloud agent <a href="https://cursor.com/agents/bc-4de60f60-e92a-42a3-8f20-7685d06ce582">here</a>.</sub>
<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END -->

<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 14ef85f2ae789a6ce4646bea543fe3b37b5198b5. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>