feat(third_party): add Buffer plugin

[minupalaniappan]

What this adds

A buffer marketplace plugin (third_party/buffer) that connects agents to Buffer's official remote MCP server at https://mcp.buffer.com/mcp (Streamable HTTP). Agents can draft, schedule, and publish posts across connected social channels, manage the queue and ideas board, reuse post templates, and pull aggregated post analytics. Tracks Linear PGT-4580.

Why now: 98 Grok Bot users hand-added mcp.buffer.com as a custom MCP server in the last 30 days, and Buffer anchors a creator/social cluster no other plugin covers. Neither ChatGPT nor Claude lists Buffer in their connector catalogs.

Tools (20): get_account, list_channels, get_channel, list_posts, get_post, create_post, edit_post, delete_post, get_aggregated_post_metrics, list_ideas, list_idea_groups, create_idea, list_post_templates, get_post_template, create_post_template, update_post_template, delete_post_template, introspect_schema, execute_query, execute_mutation. Plus a buffer://schema resource and a review_weekly_posts prompt. Source: Buffer's MCP integration guide; the hosted runtime is the source of truth.

Auth verification

• Anonymous initialize against https://mcp.buffer.com/mcp returns 401 with a WWW-Authenticate header carrying a resource_metadata pointer (protected resource metadata per the MCP auth spec).
• The authorization server is https://auth.buffer.com, advertising PKCE and dynamic client registration.
• DCR returned 201 for every redirect set Cursor and Grok send, including Grok Bot mobile (grokbot://mcp/oauth/callback + https://www.cursor.com/bot/mcp/oauth/callback) and grok.com — no vendor allowlist work needed.
• MCP access is included on every Buffer plan, including Free.

What to review

• plugin.json keeps the eToro / TinyFish shape (same field set, minClientVersions.cursor: 3.13.0, category: integrations, mcpServers: ./mcp.json).
• Logo: Buffer's official stacked mark from https://buffer.com/icons/buffer-icon.svg (the site's mask-icon, navy #132062), rendered at 160×160 and centered with 16px padding on a white 192×192 tile.
• node scripts/validate-plugins.mjs prints All plugins validated successfully.; plugin.json and mcp.json parse cleanly.
• The marketplace.json change is a single appended entry. Sibling plugin PRs opened the same day also append to marketplace.json, so expect a trivial array-tail conflict when merging in sequence.
• README Notes call out that create_post with shareNow / automatic scheduling publishes live to real social accounts and delete_post is irreversible, and that saveToDraft / notification scheduling are the safe alternatives.

Out of scope

• grok.com catalog connector for Buffer.
• Hosted SERVER placement check for Grok Bot iOS.
• Account-based sign-in test (end-to-end OAuth flow and live tool listing) pending a Buffer account.

---

Note

Low Risk
Repo changes are marketplace metadata and MCP config only; operational risk is users granting agents Buffer write tools that can publish or delete live posts.

Overview
Adds a new Buffer integration plugin under third_party/buffer and registers it in .cursor-plugin/marketplace.json so users can install it from the plugin catalog.

The plugin is a thin MCP wrapper: mcp.json points at Buffer’s hosted HTTP server (https://mcp.buffer.com/mcp), with OAuth sign-in handled by Buffer (no API keys in the repo). Packaging matches other third-party integrations (plugin.json, MIT license, changelog, README describing queue/drafts, ideas, templates, analytics, and GraphQL escape hatches).

Docs call out user-facing risk: approved write tools can schedule or immediately publish to real social channels and delete_post is irreversible; draft/notification modes are the safer paths.

^{Reviewed by Cursor Bugbot for commit 8e5adde. Bugbot is set up for automated code reviews on this repo. Configure here.}