feat(third_party): add Coinbase plugin

[minupalaniappan]

Summary

• Add Coinbase as a third_party/ marketplace plugin, in the Attio (Add Attio third-party MCP plugin #339) / Hunter (Add Hunter third-party MCP plugin (API key header auth) #340) shape.
• One of nine hosted-MCP connectors that grok.com offers publicly (GrowthBook visibility all) and the Cursor marketplace does not. The server URL matches Grok's production connector_catalog.mcp_server_url.
• Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
• Based on main; bottom of the stack now that feat(third_party): add Gamma plugin #347, feat(third_party): add Webull plugin #348, feat(third_party): add S&P Global plugin #349, feat(third_party): add Interactive Brokers plugin #350, feat(third_party): add Meltwater plugin #351, feat(third_party): add Daloopa plugin #352, feat(third_party): add Excalidraw plugin #353 have merged.

Endpoint	https://agents.coinbase.com/mcp
Auth	OAuth via CLIENT_ID / CLIENT_SECRET plugin variables. Probed: 401 → login.coinbase.com, which publishes no registration_endpoint, and Cursor has no pre-registered Coinbase client.
Grok visibility	all

MCP

{
  "mcpServers": {
    "coinbase": {
      "url": "https://agents.coinbase.com/mcp",
      "auth": {
        "CLIENT_ID": "${CLIENT_ID}",
        "CLIENT_SECRET": "${CLIENT_SECRET}"
      }
    }
  }
}

Stack

Split from #345 into one PR per plugin. Independent plugins come first; the two with external prerequisites (Coinbase, BigQuery) are last so they never block the others.

1. gamma feat(third_party): add Gamma plugin #347 ✅ merged
2. webull feat(third_party): add Webull plugin #348 ✅ merged
3. sp-global feat(third_party): add S&P Global plugin #349 ✅ merged
4. interactive-brokers feat(third_party): add Interactive Brokers plugin #350 ✅ merged
5. meltwater feat(third_party): add Meltwater plugin #351 ✅ merged
6. daloopa feat(third_party): add Daloopa plugin #352 ✅ merged
7. excalidraw feat(third_party): add Excalidraw plugin #353 ✅ merged
   8. coinbase feat(third_party): add Coinbase plugin #354 ← this PR
8. google-cloud-bigquery feat(third_party): add Google Cloud BigQuery plugin #355

Test plan

• node scripts/validate-plugins.mjs passes on this branch
• Endpoint probed for OAuth discoverability and dynamic client registration; the auth shape above is what the server actually supports
• README has Install / MCP / Setup / What agents can do / Notes / Docs / License, with capabilities sourced from vendor docs
• marketplace.json, plugin.json, and README table descriptions are identical
• Logo visually reviewed at 192×192
• Install from Cursor Settings → Plugins, complete sign-in, and smoke test listing portfolios after entering client credentials

Notes

• Follows the Gong / HubSpot / DocuSign pattern: the user registers an OAuth client in the Coinbase Developer Platform portal and enters its credentials in Dashboard → Plugins → Configure. The README lists both redirect URIs.
• Orders placed through this server are live; Coinbase recommends scoping the agent to a dedicated portfolio.

---

Note

Medium Risk
The diff is additive marketplace metadata only, but the integration exposes live trading and portfolio actions on user Coinbase accounts once OAuth is configured.

Overview
Adds a new Coinbase marketplace plugin under third_party/coinbase/ and registers it in .cursor-plugin/marketplace.json and the root README plugin table.

The plugin wires Cursor to Coinbase’s hosted MCP at https://agents.coinbase.com/mcp via mcp.json, with OAuth using required plugin variables CLIENT_ID and CLIENT_SECRET (no dynamic client registration on Coinbase’s side). The manifest sets minClientVersions.cursor to 3.13.0 and ships README setup (CDP OAuth client, redirect URIs, per-user login), changelog, and MIT license—same packaging shape as other third_party/ hosted-MCP connectors.

^{Reviewed by Cursor Bugbot for commit 6cc3241. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Invented Coinbase OAuth client credentials
  • Removed the required CLIENT_ID/CLIENT_SECRET pair so the plugin uses Coinbase's documented URL-only login OAuth against https://agents.coinbase.com/mcp.

Or push these changes by commenting:

@cursor push db37780599

Preview (db37780599)

diff --git a/third_party/coinbase/.cursor-plugin/plugin.json b/third_party/coinbase/.cursor-plugin/plugin.json
--- a/third_party/coinbase/.cursor-plugin/plugin.json
+++ b/third_party/coinbase/.cursor-plugin/plugin.json
@@ -31,24 +31,5 @@
     "crypto",
     "mcp"
   ],
-  "variables": {
-    "type": "object",
-    "properties": {
-      "CLIENT_ID": {
-        "type": "string",
-        "title": "Coinbase OAuth Client ID",
-        "description": "OAuth client ID from the Coinbase Developer Platform portal (portal.cdp.coinbase.com \u2192 OAuth)."
-      },
-      "CLIENT_SECRET": {
-        "type": "string",
-        "title": "Coinbase OAuth Client Secret",
-        "description": "OAuth client secret from the same Coinbase Developer Platform OAuth client."
-      }
-    },
-    "required": [
-      "CLIENT_ID",
-      "CLIENT_SECRET"
-    ]
-  },
   "mcpServers": "./mcp.json"
 }

diff --git a/third_party/coinbase/CHANGELOG.md b/third_party/coinbase/CHANGELOG.md
--- a/third_party/coinbase/CHANGELOG.md
+++ b/third_party/coinbase/CHANGELOG.md
@@ -5,5 +5,5 @@
 ## 1.0.0 — initial release
 
 - Added the `coinbase` MCP server pointing at Coinbase's hosted Streamable HTTP endpoint (`https://agents.coinbase.com/mcp`).
-- Auth uses OAuth with Coinbase user login. Declared `CLIENT_ID` and `CLIENT_SECRET` plugin variables and forwarded them through MCP auth, since `login.coinbase.com` does not support dynamic client registration.
+- Auth uses Coinbase user login OAuth against the hosted remote URL. No client ID or secret is required.
 - Logo: Coinbase's official mark, from the `coinbase` GitHub organization.

diff --git a/third_party/coinbase/README.md b/third_party/coinbase/README.md
--- a/third_party/coinbase/README.md
+++ b/third_party/coinbase/README.md
@@ -8,7 +8,7 @@
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Coinbase**.
-3. Click **Install**, then follow **Setup** below.
+3. Click **Install**, then complete the Coinbase sign-in prompt.
 
 Or run `/add-plugin coinbase` in chat.
 
@@ -18,29 +18,14 @@
 {
   "mcpServers": {
     "coinbase": {
-      "url": "https://agents.coinbase.com/mcp",
-      "auth": {
-        "CLIENT_ID": "${CLIENT_ID}",
-        "CLIENT_SECRET": "${CLIENT_SECRET}"
-      }
+      "url": "https://agents.coinbase.com/mcp"
     }
   }
 }

-## Setup
+Auth is OAuth against Coinbase. Cursor prompts for Coinbase user login when the plugin connects — there is no API key or client ID to configure. On the approval screen, select which portfolios to give the agent access to. Coinbase recommends scoping the agent to a dedicated portfolio.

-Coinbase's authorization server (login.coinbase.com) does not support dynamic client registration, so an OAuth client has to be registered before anyone can connect.

-1. In the Coinbase Developer Platform portal, create an OAuth client and enable the Coinbase for Agents (mcp:*) scopes you want to expose.
-2. Register both redirect URIs on that client:

• • Desktop: http://localhost:8787/callback
• • Web and Cloud Agents: https://www.cursor.com/agents/mcp/oauth/callback
    -3. In Dashboard → Plugins → Configure, set Coinbase OAuth Client ID and Coinbase OAuth Client Secret from that client.
    -4. Complete the Coinbase login when Cursor prompts.

-On a team marketplace an admin sets the client ID and secret once for everyone; each member still completes their own Coinbase login, so tool calls run against that member's account. Coinbase recommends scoping the agent to a dedicated portfolio.

What agents can do

| Category | Capabilities |

diff --git a/third_party/coinbase/mcp.json b/third_party/coinbase/mcp.json
--- a/third_party/coinbase/mcp.json
+++ b/third_party/coinbase/mcp.json
@@ -1,11 +1,7 @@
{
"mcpServers": {
"coinbase": {

•  "url": "https://agents.coinbase.com/mcp",
  

•  "auth": {
  

•    "CLIENT_ID": "${CLIENT_ID}",
  

•    "CLIENT_SECRET": "${CLIENT_SECRET}"
  

•  }
  

•  "url": "https://agents.coinbase.com/mcp"
  

  }
  }
  }

</details>


<sub>You can send follow-ups to the cloud agent <a href="https://cursor.com/agents/bc-4de60f60-e92a-42a3-8f20-7685d06ce582">here</a>.</sub>
<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END -->

<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 14ef85f2ae789a6ce4646bea543fe3b37b5198b5. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

[cursor]

Invented Coinbase OAuth client credentials

High Severity · Logic Bug

Official Coinbase for Agents setup is URL-only login OAuth: the https://agents.coinbase.com/mcp URL plus a Coinbase sign-in, with Client ID and Secret left blank. This plugin requires CLIENT_ID and CLIENT_SECRET and tells users to register a CDP OAuth client with mcp:* scopes, which Coinbase does not advertise. Creating those clients is partner-gated, so typical users cannot finish sign-in.

Additional Locations (2)

• third_party/coinbase/.cursor-plugin/plugin.json#L33-L52
• third_party/coinbase/README.md#L32-L40

 

^{Triggered by learned rule: Prefer native remote MCP over mcp-remote and SSE}

^{Reviewed by Cursor Bugbot for commit 14ef85f. Configure here.}