feat(third_party): add PostHog plugin

[minupalaniappan]

What this adds

A URL-only marketplace plugin for PostHog's hosted MCP server (https://mcp.posthog.com/mcp), so agents can query product analytics and HogQL/SQL, manage feature flags and experiments, triage error tracking issues, and work with session replays, surveys, dashboards, logs, and CDP destinations. Tracked in Linear PGT-4565; 715 Grok Bot users hand-added this MCP URL in the last 30 days, so a first-party listing removes a recurring manual step.

Tools (1,033 across 72 categories per PostHog's tools reference): the README documents the main ones by category — insight-query, query-trends/query-funnel/query-retention/query-paths, execute-sql, read-data-schema, dashboards-get-all/dashboard-create, feature-flag-get-all/create-feature-flag/update-feature-flag/feature-flag-enable/feature-flag-set-release-condition-rollout, experiment-create/experiment-launch/experiment-results-get/experiment-ship-variant, query-error-tracking-issues-list/query-error-tracking-issue/error-tracking-issues-assign-partial-update, query-session-recordings-list/session-recording-get, survey-create/surveys-responses-list/surveys-summarize-responses-create, query-logs/logs-patterns, query-apm-spans/apm-trace-get, query-web-overview/query-web-stats, persons-list/cohorts-create, cdp-functions-create/data-warehouse-source-setup, organizations-get/switch-project, docs-search, generate-app-url. The full list is at https://posthog.com/docs/model-context-protocol/tools; the hosted runtime is the source of truth. Note Cursor is a "tools mode" client for this server, so every tool is registered individually.

Auth verification

• Anonymous initialize against https://mcp.posthog.com/mcp returns 401 with a WWW-Authenticate header carrying a resource_metadata pointer (protected resource metadata per the MCP auth spec).
• The authorization server is https://oauth.posthog.com, supporting PKCE and dynamic client registration.
• DCR returned 201 for every redirect set Cursor and Grok send, including Grok Bot mobile (grokbot://mcp/oauth/callback + https://www.cursor.com/bot/mcp/oauth/callback) and grok.com — no vendor allowlist work needed.

What to review

• plugin.json keeps the eToro/TinyFish shape (URL-only mcpServers, minClientVersions.cursor: 3.13.0, category: integrations) so it lists in Cursor and Grok Bot alike.
• Logo provenance: PostHog's official hedgehog mark from https://posthog.com/favicon.svg (white-on-black in the source), rendered as the black mark on a white 192×192 tile with 16px padding. Updated: the favicon is now used as published (white mark on PostHog's black tile) rather than inverted onto white.
• node scripts/validate-plugins.mjs passes for all plugins; both JSON files parse.
• Sibling plugin PRs opened the same day also append to .cursor-plugin/marketplace.json, so expect a trivial conflict on the array tail when merging in sequence.

Out of scope

• The grok.com catalog connector.
• Verifying hosted SERVER placement after publish so the row appears on Grok Bot iOS.
• The account-based end-to-end sign-in test, which the reviewer will do once a PostHog account is available.

---

Note

Low Risk
Marketplace metadata and a new third-party plugin directory only; no changes to core Cursor code or shared runtime.

Overview
Adds a PostHog integration to the official plugin marketplace and ships a new third_party/posthog package that wires Cursor to PostHog’s hosted MCP at https://mcp.posthog.com/mcp (HTTP, OAuth via oauth.posthog.com—no API keys in the plugin).

The listing follows other URL-only third-party integrations (plugin.json, mcp.json, README with capability categories, changelog, MIT license). .cursor-plugin/marketplace.json gains a posthog entry after buffer so users can install via Settings or /add-plugin posthog instead of pasting the MCP URL manually.

^{Reviewed by Cursor Bugbot for commit ae3e4fb. Bugbot is set up for automated code reviews on this repo. Configure here.}