feat(third_party): add Gopuff plugin

[minupalaniappan]

Adds third_party/gopuff, a Grok Bot–only plugin for Gopuff's official MCP server (https://mcp.gopuff.com/mcp).

What's in it

• mcp.json: server key gopuff, type: http, placement: server, and Gopuff's public OAuth client auth.CLIENT_ID: mcp-grok-bot (no secret). Gopuff's sign-in server doesn't support dynamic client registration for our redirects, so the plugin pins the client Gopuff issued for Grok Bot; sign-in uses PKCE.
• plugin.json v1.0.0: minClientVersions cursor never, grokbot/sand 0.49.0 (same as Finance, Shopify and Tailscale), category integrations.
• README with the data-handling disclosure (orders are real Gopuff orders charged to the user's Gopuff account), CHANGELOG, MIT LICENSE, 192×192 logo.
• Registered at the end of .cursor-plugin/marketplace.json (description identical to plugin.json) and the root README table.

Copied from the team marketplace repo minupalaniappan/gopuff-plugin at 599ff0e, which is what TeachX testers install today; only repository and the CHANGELOG wording changed.

Status / known limits

• Gopuff's MCP is limited to employees plus a manual user-ID allowlist for now; other accounts get 401/403.
• Redirect URIs: as of 2026-10-17, goauth.gopuff.com accepts all five Cursor and Grok Bot callbacks for mcp-grok-bot (https://www.cursor.com/agents/mcp/oauth/callback, https://www.cursor.com/bot/mcp/oauth/callback, grokbot://mcp/oauth/callback, http://localhost:8787/callback, https://grok.com/connectors-oauth-exchange-code/), so sign-in can start from desktop, mobile and web.
• place_order needs a card or PayPal saved in the Gopuff app.
• Order-status updates have no webhook; "tell me when my order changes" relies on a routine that polls get_order_status.

Testing

• node scripts/validate-plugins.mjs → "All plugins validated successfully."
• Redirect URIs probed against goauth.gopuff.com/authenticate with client_id=mcp-grok-bot: all five return 303 to Gopuff's login; an unregistered URI returns 400 Invalid redirect URI.
• TeachX QA (2026-10-16) ran the same config from the team marketplace plugin across several Grok Bot surfaces; most tests passed with the expected tools and the same behavior on each surface. Address tests were slowed by Gopuff's find_address rate limit.
• Not verified yet: sign-in and a tool call from this public listing after merge.

---

Note

Medium Risk
New user-facing connector that authenticates to Gopuff and can place real paid orders; changes are additive plugin metadata only with no core app code touched.

Overview
Adds a new Gopuff third-party integration plugin so Grok Bot (and Sand ≥0.49.0) can shop via Gopuff’s official HTTP MCP at https://mcp.gopuff.com/mcp, with Cursor explicitly disabled (minClientVersions.cursor: never).

The plugin ships standard marketplace assets (plugin.json, mcp.json with placement: server and pinned OAuth client mcp-grok-bot, README disclosure that orders are real Gopuff charges, CHANGELOG, MIT license) and is registered in the root marketplace.json and README integrations table alongside existing entries like Gusto.

^{Reviewed by Cursor Bugbot for commit 3098b7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Listing descriptions do not match
  • Updated the gopuff README plugin-table cell so its description matches plugin.json and marketplace.json verbatim.

Or push these changes by commenting:

@cursor push 00614a05d5

Preview (00614a05d5)

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -105,7 +105,7 @@
 | `finary` | [Finary](third_party/finary/) | Cursor | Integrations | Read your net worth, accounts, holdings, spending, and budgets. |
 | `tiktok-for-business` | [TikTok for Business](third_party/tiktok-for-business/) | Cursor | Integrations | Manage TikTok ad campaigns, ad groups, ads, audiences, creatives, and reports. |
 | `gusto` | [Gusto](third_party/gusto/) | Cursor | Integrations | Work with payroll, employees, contractors, time off, and reports. |
-| `gopuff` | [Gopuff](third_party/gopuff/) | Cursor | Integrations | Shop Gopuff from Grok Bot: search products, build a cart, get a quote, and place and track orders. |
+| `gopuff` | [Gopuff](third_party/gopuff/) | Cursor | Integrations | Shop Gopuff from Grok Bot through Gopuff's official MCP server. Sign in with your Gopuff account; Gopuff handles the sign-in, and your searches, carts, and orders go to Gopuff under that account, so any order you place is charged and delivered like a normal Gopuff order. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `[email protected]` in the manifest).
 
 ## Repository structure

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 719e4de. Configure here.}