[DevSrijit]

Summary

• Add CommSync (one inbox for business SMS and email) as a third_party/ marketplace plugin, in the Attio / Clarify shape.
• Direct submission from the CommSync team; connects to CommSync's own hosted remote MCP server over Streamable HTTP.
• Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
• URL-only OAuth — no CLIENT_ID/CLIENT_SECRET needed; the authorization server supports dynamic client registration and client ID metadata documents.

Endpoint	https://server.commsync.ai/api/mcp
Auth	OAuth 2.1. Probed: 401 with WWW-Authenticate: Bearer resource_metadata=… → protected-resource metadata at /.well-known/oauth-protected-resource/api/mcp → AS https://server.commsync.ai exposes registration_endpoint, PKCE S256, authorization_code + refresh_token, client_id_metadata_document_supported, and RFC 9207 iss. The consent screen lets the user pick which phone/email lines Cursor can use.
Tools	threads (list/read/search/triage), sending (SMS + email reply, compose, forward), contacts and identities, labels, search, Daily Brief, channels, webhooks. Every tool carries title + read-only/destructive/idempotent/open-world annotations; sends are destructive + open-world. The hosted runtime is the source of truth.
Registry	Listed on the official MCP Registry as ai.commsync/commsync.

MCP

{
  "mcpServers": {
    "commsync": {
      "type": "http",
      "url": "https://server.commsync.ai/api/mcp"
    }
  }
}

Files

• third_party/commsync/.cursor-plugin/plugin.json, mcp.json
• third_party/commsync/README.md, CHANGELOG.md, LICENSE
• third_party/commsync/assets/logo.png (192×192, CommSync's official app mark)

Verification

• node scripts/validate-plugins.mjs → All plugins validated successfully.
• File set mirrors third_party/attio/.

---

Note

Medium Risk
Introduces agent access to read and send real SMS/email via a third-party hosted MCP; risk is mitigated by OAuth, per-line consent, and destructive send annotations, but mis-sent messages remain possible if a user approves a tool call.

Overview
Adds CommSync as a new third_party/commsync marketplace plugin so Cursor agents can work with a unified business SMS and email inbox through CommSync’s hosted MCP server.

The plugin is wired like other URL-only HTTP integrations: mcp.json points at https://server.commsync.ai/api/mcp, with OAuth 2.1 (PKCE, dynamic client registration) and line-level consent for which phone numbers and mailboxes Cursor may use—no API keys in the repo. Docs describe inbox triage, contacts/labels, search, channels, webhooks, and send actions annotated as destructive/open-world so the client should confirm before sending.

Registry updates: commsync is listed in .cursor-plugin/marketplace.json and the root README.md plugins table (author CommSync).

^{Reviewed by Cursor Bugbot for commit 7179d47. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[DevSrijit]

I merged the latest main and resolved the conflict in .cursor-plugin/marketplace.json. CommSync is now the last entry, after workday. scripts/validate-plugins.mjs passes. @djiang-jq, can you review this when you have time? It is a URL-only connector to CommSync's hosted MCP server (OAuth 2.1). Thank you.