feat(third_party): add Plaud plugin

[minupalaniappan]

What this adds

A marketplace plugin for Plaud (AI wearable notetaker) backed by Plaud's official hosted Streamable HTTP MCP server at https://mcp.plaud.ai/mcp. Agents can list and search the user's recordings, read full transcripts with speaker labels, and pull AI summaries, action items, and key topics. Tracked in Linear PGT-4567.

Demand signal: 213 Grok Bot users hand-added mcp.plaud.ai as a custom MCP server in the last 30 days.

Tools (5): list_files, get_file, get_transcript, get_note, get_current_user — from Plaud's MCP docs. The docs also list login / logout, which belong to the local @plaud-ai/mcp npm package; on the hosted server Cursor's OAuth flow handles sign-in, so they are not documented in the README. The hosted runtime is the source of truth for tool names and schemas.

Auth verification

• Anonymous initialize against https://mcp.plaud.ai/mcp returns 401 with a WWW-Authenticate header pointing at protected-resource metadata.
• The authorization server is https://mcp.plaud.ai/ and advertises PKCE and dynamic client registration.
• DCR returned 201 for every redirect set Cursor and Grok send, including Grok Bot mobile (grokbot://mcp/oauth/callback + https://www.cursor.com/bot/mcp/oauth/callback) and grok.com — no vendor allowlist work needed.

What to review

• plugin.json keeps the eToro / TinyFish shape (same fields, minClientVersions.cursor 3.13.0, category: integrations).
• Logo: Plaud's official "A" mark from the 256×256 app icon published on plaud.ai (/cdn/shop/files/plaud-fa.png), composed on a white 192×192 tile with 16px padding.
• node scripts/validate-plugins.mjs passes ("All plugins validated successfully.").
• Sibling plugin PRs opened the same day also append to .cursor-plugin/marketplace.json, so expect a trivial array-tail conflict when merging in sequence.

Out of scope

• grok.com catalog connector for Plaud.
• Hosted SERVER placement check for Grok Bot iOS.
• Account-based end-to-end sign-in test, pending a Plaud account with synced recordings.

---

Note

Low Risk
Documentation and marketplace/plugin manifest only; no application logic or database access in this repo.

Overview
Adds two official marketplace integrations—PostHog and Plaud—each as a new third_party/* package with plugin.json, mcp.json, README, changelog, and MIT license, and registers both in .cursor-plugin/marketplace.json (including fixing the buffer entry so the plugins array closes correctly before the new items).

Plaud points agents at https://mcp.plaud.ai/mcp for OAuth-backed access to cloud recordings: list/search files, transcripts, AI notes, and account context (minClientVersions.cursor 3.13.0).

PostHog points at https://mcp.posthog.com/mcp for OAuth-backed analytics, HogQL, flags, experiments, error tracking, replays, and related workspace tools; docs call out that many hosted tools are writes to the active org/project.

Neither plugin ships local server code—only Cursor plugin metadata and documentation for the vendors’ hosted Streamable HTTP MCP endpoints.

^{Reviewed by Cursor Bugbot for commit 91d7ec7. Bugbot is set up for automated code reviews on this repo. Configure here.}