Add Xquik third-party MCP plugin

[kriptoburak]

Problem

Xquik publishes a live Streamable HTTP MCP server with OAuth 2.1 discovery, but Cursor users must configure it manually. The official plugin marketplace has no Xquik entry, setup guidance, or operational guardrails for its read, export, monitoring, and connected-account surfaces.

Solution

• add third_party/xquik as a complete marketplace plugin
• connect Cursor to https://xquik.com/mcp through automatic OAuth discovery
• bundle an xquik Skill that uses live operation discovery and bounded requests
• default the Skill to public read-only work
• require explicit confirmation before private reads, writes, persistent resources, event delivery, or metered bulk jobs
• document installation, capabilities, verification prompts, current API references, and Xquik's independent-service status
• use the official Xquik artwork from the public Agent Skill repository

The integration is additive and does not modify the existing official X plugin. Xquik remains a separately named service with its own hosted MCP endpoint and authorization flow.

Verification

• node scripts/validate-plugins.mjs
• Agent Skill frontmatter and structure validation (quick_validate.py)
• marketplace uniqueness and referenced-path assertions
• live protected-resource metadata assertion for https://xquik.com/mcp
• live OAuth metadata assertions for dynamic registration, authorization-code flow, and PKCE S256
• live unauthenticated MCP initialize request returns the expected 401 authentication challenge
• all documented Xquik links return HTTP 200
• secret scan and git diff --check
• logo rendered and compared with the public source asset

Authenticated tool calls were not exercised because they require a user-owned Xquik authorization. The public transport, challenge, discovery metadata, schemas, and documentation were verified live.

---

Note

Low Risk
Additive marketplace and plugin scaffolding only; no changes to core app logic or the existing X plugin, though agents can reach external OAuth-backed APIs after user install.

Overview
Adds Xquik as a new third-party Cursor marketplace plugin so users can install a hosted MCP integration without hand-editing config.

The change registers xquik in marketplace.json and the root README plugin table, and introduces third_party/xquik with manifest, mcp.json pointing at https://xquik.com/mcp, logo, MIT license, changelog, and user-facing README (OAuth discovery, install/verify prompts).

It also ships an xquik Skill that routes agents through live explore / xquik discovery, defaults to public read-only calls, and requires explicit confirmation before private reads, writes, monitors, webhooks, exports, or other metered/persistent work. The existing official x plugin is unchanged.

^{Reviewed by Cursor Bugbot for commit 665734a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kriptoburak]

Rebased onto current main (9036be1) and resolved the README registry conflict by preserving every upstream plugin row and the new concise-description style. Xquik now uses the same short description across the marketplace, root README, and plugin manifest. Current head: 665734a3.

Revalidated the exact tree with node scripts/validate-plugins.mjs, Skill frontmatter validation, 32/32 registry-to-README order, unique name/source and declared-path checks, MCP metadata parity, live OAuth 2.1 discovery and unauthenticated challenge checks, all 6 public links, SVG/XML validation, canonical-logo comparison, secret scan, and git diff --check. The PR is now conflict-free and GitHub reports MERGEABLE.