feat(third_party): add SharePoint and Finance cards for Grok-routed connectors

[minupalaniappan]

Summary

• Add two marketplace cards under third_party/ for Grok connectors that cannot be packaged as hosted-MCP plugins: SharePoint (Grok native content index, Microsoft Graph) and Finance (Grok aggregates brokerages via Plaid). Neither has an MCP server URL, so these plugins bundle no components: plugin.json, README, CHANGELOG, LICENSE, logo only.
• Purpose: make the two connectors discoverable and installable in Cursor, and give the "installed plugins" UI and the Grok connector bridge an install record to key on. Tools are served through the bridge (ListSandMcpTools → Grok connectors-manager) once the user's Cursor and Grok accounts are linked and the connector is connected on grok.com.
• Follow-on to feat(third_party): add 9 publicly-released Grok connectors as third-party MCP plugins #345 (the 9 hosted-MCP Grok connectors). Together they cover every publicly visible Grok connector missing from Cursor: 28 public curated-MCP rows = 17 already on Cursor + 9 in feat(third_party): add 9 publicly-released Grok connectors as third-party MCP plugins #345 + 2 first-party WIP (Robinhood, NetSuite); SharePoint and Finance are the two public non-MCP connectors.
• Names are sharepoint and finance, matching the connectors, so when a first-party build lands it upserts into the same cursor-public rows (the indexer keys on (marketplaceId, name)) and existing installs carry over.

Plugin	Grok visibility	Components	Logo
sharepoint	business	none	Microsoft SharePoint product icon from the Fluent brand icon CDN, on a padded white tile (same treatment as outlook / onedrive)
finance	consumer (not a catalog row; injected when the user has a Plaid link)	none	Grok's product mark from grok.com, since the connector runs on Grok and aggregates brokerages rather than representing one vendor

What the schema and indexer do with a component-less plugin

• schemas/plugin.schema.json requires only name; mcpServers, skills, etc. are optional. scripts/validate-plugins.mjs passes.
• The indexer has no minimum-component check; these index into cursor-public as normal rows with mcpServers = null.
• Installing creates a userPluginInstall row and mirrors zero MCP servers. Nothing errors.
• Cursor and Grok de-duplicate connectors by normalized server URL. These have none, so they can never shadow or be shadowed by a Cursor-native plugin.

Test plan

• Plugin schema validation passes (node scripts/validate-plugins.mjs)
• READMEs state plainly that install does not start a sign-in flow and that the plugin contributes no tools until the connector is connected on grok.com
• Logos visually reviewed at 192×192
• After merge: confirm both rows index into cursor-public with mcpServers = null and render on cursor.com/marketplace
• With unified_connectors on and a linked account that has SharePoint connected on grok.com: install sharepoint in Cursor, confirm SharePoint tools appear via the bridge
• Same for finance with a Plaid-linked grok.com account

Notes

• Inert-by-design, and that is the risk. A user who installs either card without a linked Grok account and a connected connector gets a card that does nothing, with no in-product path to fix it: there is no OAuth flow to run, and the reconnect bridge (GetAuthUrl) is not yet exposed to Cursor. The README spells this out. Recommend landing this after the unified_connectors cohort is enabled so the cards have a working path behind them on day one, and treating the Cursor-side "unlinked account" signal (in flight) as a prerequisite for broad rollout.
• Why not skip the cards and rely on the bridge alone? The bridge already surfaces these tools for linked users. The cards add discoverability (a Cursor user searching "SharePoint" finds something), an install record for the installed-plugins UI, and a stable row that the first-party builds can take over.
• plugin.source on the Cursor side: these two are the rows that should carry GROK when the default-and-backfill change lands; everything published from this repo otherwise gets CURSOR.
• Branched from main, independent of feat(third_party): add 9 publicly-released Grok connectors as third-party MCP plugins #345. Both touch marketplace.json and the README table, so whichever merges second will need a trivial rebase.

---

Note

Low Risk
Documentation and marketplace manifests only; no runtime or auth code in-repo. Main product risk is users installing cards without a linked Grok connector and seeing no tools until grok.com is configured.

Overview
Adds SharePoint and Finance as discoverable Cursor marketplace plugins under third_party/, registered in .cursor-plugin/marketplace.json and the root README plugin table.

Unlike hosted-MCP integrations, these entries are metadata-only (plugin.json, README, CHANGELOG, LICENSE, logo): no bundled MCP server. Tools appear in Cursor only after the user links Cursor to Grok, connects the connector on grok.com, and the Grok connector bridge serves them. READMEs state that install does not start OAuth and the plugin contributes no tools until the Grok side is connected.

SharePoint covers search/read of sites, pages, and files (Grok content index). Finance covers portfolio, balances, and transactions from Plaid-linked brokerages. Plugin names match the Grok connectors so future first-party builds can upsert the same marketplace rows.

^{Reviewed by Cursor Bugbot for commit 7d102c4. Bugbot is set up for automated code reviews on this repo. Configure here.}