Add read-only X MCP plugin

[maloneya]

Adds third_party/x, a Cursor plugin for X's official hosted MCP server.

Which X MCP

X's MCP docs describe two routes to https://api.x.com/mcp:

• App-only Bearer — a plain remote HTTP server with an Authorization header. Read-only endpoints, no user context. This is what the plugin ships.
• xurl bridge — a local npx stdio bridge doing OAuth 2.0 PKCE with a browser login, needed for writes and user-context tools.

The bridge route needs Node.js, a registered http://localhost:8080/callback redirect URI, and a reachable browser on first run, so it does not fit a marketplace plugin. The plugin's README documents it as an escape hatch, along with X's unauthenticated docs-search server at https://docs.x.com/mcp.

Plugin variables

mcp.json carries a single ${X_BEARER_TOKEN} placeholder, declared and required in the manifest schema, and forwarded through the Authorization header — the same shape as the existing github plugin:

{
  "mcpServers": {
    "x": {
      "type": "http",
      "url": "https://api.x.com/mcp",
      "headers": { "Authorization": "Bearer ${X_BEARER_TOKEN}" }
    }
  }
}

No secret values are committed. Users set the token in Dashboard → Plugins → Configure.

Logo

abs.twimg.com (where x.com serves its icons) is not reachable from this environment, so the mark comes from X's official brand toolkit at about.x.com — content/dam/about-twitter/x/brand-toolkit/x-logo.zip, which ships logo.svg, logo-black.png, and logo-white.png.

assets/logo.svg is the unmodified official path data on a black 192×192 tile, matching this repo's convention (github and apollo-io both use 192×192 tiles with a background rect). Glyph proportions were measured against x.com/favicon.ico and match it exactly at 0.719 × 0.750 of the tile:

Verification

• node scripts/validate-plugins.mjs → All plugins validated successfully.
• POST https://api.x.com/mcp returns 401 Unauthorized without a token, confirming the endpoint is live and gated on the Authorization header. Tool calls were not exercised end to end, since that needs a real X developer app token.
• Every ${VAR} in mcp.json is declared in the manifest schema.
• Registered in .cursor-plugin/marketplace.json and the root README table.