feat(third_party): add beehiiv plugin

[minupalaniappan]

What this adds

A marketplace plugin for beehiiv, the newsletter platform, pointing at beehiiv's official hosted MCP server (https://mcp.beehiiv.com/mcp, Streamable HTTP). Tracks Linear PGT-4589.

Why now: 59 Grok Bot users hand-added mcp.beehiiv.com as a custom MCP server in the last 30 days. beehiiv is part of a creator-tooling cluster (Buffer, Metricool, Kit, vidIQ) that neither ChatGPT nor Claude covers with a first-party connector.

Tools (category-level): beehiiv does not publish a tool list for the MCP and does not version it (tools are added continuously and discovered at connect time), so the README documents capabilities by the categories in beehiiv's own docs — content and posts, audience and subscribers, growth, monetization, automations, podcasts, website, analytics, assets/guest authors/RSS — and states that the hosted runtime is the source of truth for tool names and schemas. Notable limits from the docs, called out in the README: publishing, scheduling, and sending posts and activating automations are not available via MCP (app only); free plans are read-only, write actions need a paid plan.

Files: third_party/beehiiv/{.cursor-plugin/plugin.json, mcp.json, README.md, CHANGELOG.md, LICENSE, assets/logo.png} plus one appended entry in .cursor-plugin/marketplace.json.

Auth verification

• Anonymous initialize against https://mcp.beehiiv.com/mcp returns 401 with a WWW-Authenticate header carrying a resource_metadata pointer (protected resource metadata).
• The authorization server is https://mcp.beehiiv.com; it advertises PKCE and dynamic client registration.
• DCR returned 201 for every redirect set Cursor and Grok send, including Grok Bot mobile (grokbot://mcp/oauth/callback + https://www.cursor.com/bot/mcp/oauth/callback) and grok.com — no vendor allowlist work needed.

What to review

• plugin.json keeps the eToro / TinyFish shape (same field set, minClientVersions.cursor 3.13.0, category: integrations, mcpServers: ./mcp.json).
• Logo provenance: beehiiv's official hive mark from the app icon published on beehiiv.com (https://beehiiv-marketing-images.s3.amazonaws.com/Redesign2023/favicon.png, 999×999), centered on a white 192×192 tile with 16px padding.
• node scripts/validate-plugins.mjs prints All plugins validated successfully.; plugin.json and mcp.json parse cleanly.
• Sibling plugin PRs opened the same day also append to marketplace.json, so expect a trivial array-tail conflict when merging these in sequence.

Out of scope

• grok.com catalog connector for beehiiv.
• Hosted SERVER placement check for Grok Bot iOS.
• Account-based sign-in test through the full OAuth flow — pending a beehiiv account.

---

Note

Low Risk
Additive third-party plugin and marketplace listing only; no changes to core app logic, though connected agents can perform live workspace writes per beehiiv OAuth permissions.

Overview
Adds a new beehiiv marketplace integration that wires Cursor to beehiiv’s hosted MCP at https://mcp.beehiiv.com/mcp (HTTP MCP + OAuth/PKCE, no API keys in config).

The change is mostly new third_party/beehiiv packaging—plugin.json, mcp.json, README (capabilities, plan limits, and safety notes), changelog, license, and logo—and a new beehiiv entry appended to .cursor-plugin/marketplace.json.

^{Reviewed by Cursor Bugbot for commit 2dac565. Bugbot is set up for automated code reviews on this repo. Configure here.}