feat(third_party): SharePoint and Finance as MCP plugins

[minupalaniappan]

Summary

Turns the two Grok-routed connector cards into real MCP plugins so Grok Bot consumes them the same way it consumes every other marketplace connector (one HTTP MCP server per plugin, no backend special-casing of a component-less card).

Plugin	Change	MCP URL	Who serves it
finance	1.0.0 → 1.1.0: add mcp.json	https://connectors-gateway.grok.com/gateway/v1/finance/mcp	xAI connectors gateway (streamable-HTTP transport of the Grok Finance connector, xai-org/xai#288511)
sharepoint	new, 1.0.0	https://api.cursor.com/rest-mcp/sharepoint/mcp	Cursor REST-MCP translator (SHAREPOINT_PROVIDER, read-only Sites.Read.All)

Finance

• minClientVersions unchanged: cursor: "never", grokbot / sand 0.49.0. The gateway endpoint speaks gateway bearer auth, not MCP OAuth (no RFC 9728 metadata), so only the backend dial path can authenticate it. Cursor desktop dialing the URL directly would 401 with nothing to do about it, so Cursor must keep not listing it.
• Auth is transparent: the Cursor backend attaches the caller's linked-account partner JWT when the dialed URL is exactly this origin + path (isGrokFinanceMcpUrl / grokFinanceMcpPartnerAuthHeaders in backendHttpMcpManager.createClient, fail-closed on xaiGrokGatewayBaseUrl). README says so and points account linking at grok.com.
• Prerequisites on the serving side, not in this repo: xaiGrokGatewayBaseUrl must be https://connectors-gateway.grok.com, and enable_finance_mcp plus the /gateway/v1/finance/mcp route on mcp_gw_hades_ingress are only in xAI's staging helm values today (production.yaml does not have them yet). Until prod flips, the row indexes fine but the dial 404s.

SharePoint

• Mirrors third_party/onedrive / third_party/teams exactly: plugin.json, mcp.json, README, CHANGELOG, LICENSE, official Fluent brand icon on a padded white tile, same minClientVersions (cursor: 3.19.0, sand: 0.30.0).
• Tools listed in the README are the translator's tool set (search_sites, get_site, list_site_drives, list_site_drive_items, search_site_drive_items, get_site_drive_item, list_site_lists, get_list, list_list_items, get_list_item).
• Serving-side prerequisites (backend restMcp README): Sites.Read.All added to the shared Entra app's static permissions, then a sharepoint entry in rest_mcp_provider_settings. Absent entry = 404, same as every other translator provider.
• Supersedes Add SharePoint third-party MCP plugin (Microsoft Agent 365, preview) #321, which registers the same sharepoint name against Microsoft's tenant-scoped Agent 365 preview server with per-tenant TENANT_ID / CLIENT_ID variables. One name can hold one row; the translator needs no tenant setup and matches the rest of the Microsoft set. Closes the SharePoint half of feat(third_party): add SharePoint and Finance cards for Grok-routed connectors #346.

Test plan

• node scripts/validate-plugins.mjs passes (same command as validate-plugins.yml).
• Finance URL satisfies the backend matcher: origin https://connectors-gateway.grok.com, path /gateway/v1/finance/mcp.
• SharePoint logo rendered at 192×192 and reviewed.
• After merge: finance row re-indexes with mcpServers set and Grok Bot ≥ 0.49 lists finance tools for a linked account once the prod gateway route is on.
• After merge: sharepoint row indexes into cursor-public; install in Cursor completes Microsoft sign-in once the provider is enabled.

---

Note

Medium Risk
Introduces OAuth-backed SharePoint read access and documents Finance MCP against a financial-data gateway; repo changes are manifests/docs only, but runtime depends on correct backend provider and gateway configuration.

Overview
Adds a new SharePoint marketplace plugin that wires agents to Cursor’s REST-MCP endpoint (https://api.cursor.com/rest-mcp/sharepoint/mcp) for read-only Microsoft Graph access (sites, libraries, files, lists via Sites.Read.All), following the same packaging as OneDrive/Teams. SharePoint is registered in .cursor-plugin/marketplace.json and the root plugin table.

Finance is bumped to 1.1.0 so it is no longer a component-less marketplace card: it now declares mcpServers and mcp.json pointing at the xAI connectors gateway (https://connectors-gateway.grok.com/gateway/v1/finance/mcp), with README/CHANGELOG updated to describe backend-attached Grok account auth and Grok Bot–only availability (cursor: never unchanged).

^{Reviewed by Cursor Bugbot for commit 90b852d. Bugbot is set up for automated code reviews on this repo. Configure here.}