feat(third_party): add TinyFish plugin

[minupalaniappan]

What this adds

A URL-only marketplace plugin for TinyFish — third_party/tinyfish — pointing at their hosted Streamable HTTP MCP server https://agent.tinyfish.ai/mcp, plus the marketplace.json entry. Same shape as etoro-trading. Requested by TinyFish (existing Grok Build plugin author and customer) to reach Grok Bot users, especially on mobile.

Tools (17): run_web_automation / _async, get_run, list_runs, cancel_run, batch_status, batch_cancel, search, get_search_usage, fetch_content, list_fetch_usage, create_browser_session, list_browser_sessions, close_browser_session, get_wallet. Search and fetch are free; automation and browser sessions bill the user's TinyFish wallet — called out in the README and description.

Auth verification

• POST /mcp unauthenticated → 401 with WWW-Authenticate: Bearer resource_metadata="https://agent.tinyfish.ai/.well-known/oauth-protected-resource/mcp" (standard MCP OAuth discovery).
• Authorization server https://clerk.tinyfish.ai: PKCE S256, authorization_code + refresh_token, DCR at /oauth/register.
• DCR probed with every redirect set Cursor and Grok send — all returned 201: desktop loopback (portal + localhost:8787), desktop deep link (cursor://…), cloud/backend, Grok Bot mobile (grokbot://mcp/oauth/callback + /bot bounce), desktop IPv4 (127.0.0.1), and grok.com (connectors-oauth-exchange-code). No vendor allowlist work needed.

What to review

• plugin.json keeps the eToro shape (minClientVersions.cursor: 3.13.0, no Grok-Bot-only gating) so it lists in Cursor and Grok Bot alike. Real review question: do we want cursor: "never" like the recent Grok-Bot-only entries (x-money, shopify-store), or is Cursor availability desired here too? TinyFish already documents a manual Cursor MCP setup, so listing it seems a net positive.
• Logo is TinyFish's app icon from tinyfish.ai on a 192×192 white tile with 16px padding, matching sibling logos.
• node scripts/validate-plugins.mjs passes for all 89 plugins.

Out of scope

• grok.com catalog connector for TinyFish (connectors-manager) and its grok_connector_routing twin entry — follow-up.
• Verifying hosted (SERVER) placement after publish so the row appears on Grok Bot iOS.

---

Note

Low Risk
Marketplace and third-party MCP wiring only; no auth, billing, or data-path changes in this repo.

Overview
Adds a new TinyFish marketplace integration under third_party/tinyfish, wired to TinyFish’s hosted HTTP MCP at https://agent.tinyfish.ai/mcp via mcp.json and plugin.json (minClientVersions.cursor: 3.13.0, same broad availability as etoro-trading rather than Grok-only gating).

Registers the plugin in .cursor-plugin/marketplace.json with a short capability blurb (web automation, search, content extraction, remote browser sessions). Ships MIT license, changelog, README (OAuth sign-in, wallet billing for paid tools), and logo assets.

No application runtime code changes—only plugin metadata and documentation.

^{Reviewed by Cursor Bugbot for commit aec5b5c. Bugbot is set up for automated code reviews on this repo. Configure here.}