Add WhatSetter third-party MCP plugin

[devlikemasta]

Summary

• Add the whatsetter plugin under third_party/whatsetter/, pointing at WhatSetter's hosted MCP server (https://mcp.whatsetter.com/mcp) over Streamable HTTP. WhatSetter is an AI appointment setter on WhatsApp; the plugin lets agents work the inbox and the leads it handles, review booked meetings, import contacts, pause or resume campaigns, and, with explicit approval, send a WhatsApp message from a connected number.
• Auth is OAuth 2.1 with Dynamic Client Registration and PKCE, discovered from the server (WWW-Authenticate + /.well-known/oauth-protected-resource), the same model as the Intercom plugin: no API key, no client ID, no template variable. On the consent page the user pastes a WhatSetter API key whose scopes they chose; Cursor only holds a revocable token.
• Bundles the whatsetter skill (skills/whatsetter/SKILL.md): operating rules, playbooks (briefing, inbox triage, import, bookings, campaigns, CRM sync, groups) and the API's real error table, so the agent reads tool results correctly and asks before anything is sent. Markdown only: no hooks, no scripts, no commands.
• Register the plugin in .cursor-plugin/marketplace.json and the root README table (Integrations, author WhatSetter).

Notes for reviewers

• Source of truth for the plugin is the WhatSetter organization's repository, https://github.com/whatsetter/whatsetter-plugin (MIT, verified domain whatsetter.com); this directory is its Cursor packaging. The same repo is submitted to the xAI plugin marketplace (Add WhatSetter plugin xai-org/plugin-marketplace#759).
• mcp.json declares "placement": "server" (same as x-money and the plugins fixed in third_party: declare server placement for TinyFish, beehiiv, Trello, Buffer, Plaud #438), so Grok Bot dials the hosted server. Dynamic client registration was probed on 2026-10-01 with the desktop set (https://www.cursor.com/agents/mcp/oauth/callback, http://localhost:8787/callback) and the Grok Bot mobile set (https://www.cursor.com/bot/mcp/oauth/callback, grokbot://mcp/oauth/callback): all four are accepted (HTTP 201).
• Protected-resource metadata: https://mcp.whatsetter.com/.well-known/oauth-protected-resource (authorization server on the same host, S256 PKCE, authorization_code + refresh_token). An unauthenticated POST /mcp answers 401 with resource_metadata in WWW-Authenticate.
• Every tool carries readOnlyHint / destructiveHint annotations. send_whatsapp_message is the only tool that reaches a person; anti-ban limits (lead_not_contacted, quota_exceeded, idempotency keys) are enforced by the API, not by the prompt.
• The same plugin was submitted through cursor.com/marketplace/publish on September 13 and is in the manual review queue (forum thread: https://forum.cursor.com/t/172489); this PR carries the packaging so it can be reviewed here.
• Logo is WhatSetter's brand mark on a white tile (512×512 PNG, 40 KB).

Test plan

• node scripts/validate-plugins.mjs passes (after npm install --no-save ajv ajv-formats); re-run after rebasing on main (2eb7ed4)
• Local install in Cursor 3.13 (~/.cursor/plugins/local/whatsetter): the plugin, its MCP server and the whatsetter skill are listed under Customize; the first tool call opens the Connect to WhatSetter page; after approval whoami returns the workspace and 23 tools load
• Install from Cursor Settings → Plugins or /add-plugin whatsetter, complete the Connect to WhatSetter step
• Smoke test: "Give me my WhatSetter briefing" (read-only), then pause and resume a campaign

---

Note

Medium Risk
New hosted MCP connector with OAuth and write/send tools that can message real WhatsApp leads and change campaigns; impact is limited to additive marketplace packaging, not core repo logic.

Overview
Adds the WhatSetter third-party integration so agents can operate a WhatSetter WhatsApp AI setter workspace from Cursor.

New packaging under third_party/whatsetter/ wires a hosted Streamable HTTP MCP server (https://mcp.whatsetter.com/mcp) with "placement": "server" for Grok Bot, OAuth 2.1 + DCR/PKCE (no secrets in the manifest), plus manifest, README, changelog, and MIT license. A bundled whatsetter skill defines operating rules (explicit approval before send_whatsapp_message), playbooks (briefing, inbox, imports, campaigns, CRM/webhooks, groups), and API error handling.

The plugin is registered in .cursor-plugin/marketplace.json and the root README integrations table (author WhatSetter).

^{Reviewed by Cursor Bugbot for commit 2f2a2a4. Bugbot is set up for automated code reviews on this repo. Configure here.}