Grok Bot harness: pass the Cursor Marketplace review gate (self-contained logo, displayName, license)

2026-08-28

pluginsmcpdiscovery

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["none — plugin packaging only, no API surface change"] sdk_methods_updated: ["none"] mcp_tools_updated: ["none — MCP server contract unchanged; this is plugin manifest/asset metadata"] ---

What We Built

Prepared the BrainstormRouter Grok Bot / Cursor harness plugin to pass the public Cursor Marketplace review gate. Grok Bot's in-app plugin search only surfaces the public Cursor Marketplace — local symlink installs and repo/team imports never appear there — so being discoverable inside the Bot requires a marketplace submission, which is a manual metadata review.

The plugin manifest (.cursor-plugin/plugin.json) now carries a human displayName ("BrainstormRouter") alongside the machine name ("brainstormrouter"), a committed license, homepage, and full author (email + url). The logo on both the Cursor and Grok manifests moved from a remote URL (brainstormrouter.com/icons.svg) to a committed, self-contained assets/logo.svg — a small node-graph mark in the BR brand blue — so the review never depends on an external fetch. A new test locks the whole gate (name shape, displayName, committed logo, LICENSE presence) so it can't silently regress.

The README's install section gained a "Public Cursor Marketplace" block with the submit URL and publisher identity, and its stale "Team / repo marketplace" paragraph — which claimed a nonexistent .cursor-plugin/marketplace.json "is the listing" — was corrected to point at the real .cursor-plugin/plugin.json manifest that Cursor actually reads on import.

Why It Matters

Grok Bot users find plugins through Bot search, and Bot search is the public Cursor Marketplace only. Until BR clears that review, it is invisible to every Grok Bot user who hasn't already been handed the repo. Clearing the gate is the difference between "installable if you know the URL" and "discoverable." Shipping a self-contained logo also removes a live dependency: a review (or a later render) that fetched the logo from brainstormrouter.com would fail if that path moved.

How It Works

The Cursor manifest declares both identifiers and a self-hosted asset:

{
  "name": "brainstormrouter",
  "displayName": "BrainstormRouter",
  "license": "MIT",
  "logo": "assets/logo.svg"
}

src/mcp/grok-bot-plugin.test.ts asserts the gate end to end — kebab name, the displayName, logo resolving to a committed SVG on disk (and that the SVG is neither empty nor hidden), and a root LICENSE. The logo is a 32×32 SVG with no external references, so it renders identically in the marketplace card, the Bot plugin list, and offline.

The Numbers

4 review-gate fields locked by test (name shape, displayName, committed logo, LICENSE).
0 external asset fetches at review time (was 1 remote logo URL).

Competitive Edge

Portkey and OpenRouter meet developers at an API key. BR meets them inside the tools they already drive — a first-party Grok Bot / Cursor harness that routes through model=auto, persists tenant memory, and queries the capability graph. Discoverability inside Bot search is what turns that harness from a repo you clone into a plugin you find.

Lockstep Checklist

> Plugin packaging change only — no API route, SDK, or MCP tool contract touched.

[x] API Routes: none — no src/api/routes/ change.
[x] TS SDK: N/A — no contract change.
[x] Python SDK: N/A — no contract change.
[x] MCP Schemas: N/A — MCP server tool schemas unchanged.
[x] Master Record: N/A — no new capability; plugin manifest metadata only.

Open Follow-ups

The specific Cursor review rules encoded here (remote-logo rejection, mandatory

displayName) are assumed from prior work, not verified against Cursor's live publish policy. They are low-risk (a committed logo + displayName can only help), but the actual submission is the real confirmation.