fix(plugin): schema-valid marketplace.json so Cursor can import LeadMagic

.cursor-plugin/marketplace.json

@@ -0,0 +1,21 @@
+{
+	"name": "leadmagic",
+	"owner": {
+		"name": "LeadMagic",
+		"email": "plugins@leadmagic.io"
+	},
+	"metadata": {
+		"description": "Official LeadMagic plugin for Cursor: hosted MCP search, work email, and professional mobile.",
+		"version": "1.0.4"
+	},
+	"plugins": [
+		{
+			"name": "leadmagic",
+			"source": ".",
+			"description": "Official LeadMagic plugin for Cursor. Search people, companies, and jobs; find and validate work emails; look up professional mobile numbers.",
+			"minClientVersions": {
+				"cursor": "3.13.0"
+			}
+		}
+	]
+}

.cursor-plugin/plugin.json

@@ -1,8 +1,11 @@
 {
 	"name": "leadmagic",
 	"displayName": "LeadMagic",
-	"version": "0.1.11",
-	"description": "Official LeadMagic plugin for Cursor with hosted MCP (OAuth by default), skills, rules, agent, and commands: emails, mobile, LinkedIn-to-email, job changes, company research, competitors, technographics, and credits.",
+	"version": "1.0.4",
+	"minClientVersions": {
+		"cursor": "3.13.0"
+	},
+	"description": "Official LeadMagic plugin for Cursor. Search people, companies, and jobs; find and validate work emails; look up professional mobile numbers.",
 	"author": {
 		"name": "LeadMagic",
 		"email": "plugins@leadmagic.io"
@@ -16,17 +19,15 @@
 		"cursor",
 		"mcp",
 		"b2b",
-		"data-enrichment",
-		"email-validation",
-		"email-finder",
-		"company-intelligence",
-		"prospecting",
+		"enrichment",
 		"gtm",
-		"agent",
-		"commands"
+		"sales",
+		"prospecting",
+		"email-finder",
+		"company-intelligence"
 	],
-	"category": "developer-tools",
-	"tags": ["sales", "prospecting", "enrichment", "mcp", "api"],
+	"category": "integrations",
+	"tags": ["sales", "prospecting", "enrichment", "mcp", "gtm"],
 	"rules": "./rules/",
 	"skills": "./skills/",
 	"agents": "./agents/",

.github/pull_request_template.md

@@ -21,7 +21,7 @@
 ## Alignment Checklist
 
 - [ ] `mcp.json` still points to `https://mcp.leadmagic.io/mcp`
-- [ ] Default `mcp.json` stays OAuth-only (no headers); API-key fallback documented in README if needed
+- [ ] Default `mcp.json` stays OAuth-only (no headers; no API keys)
 - [ ] New or edited `agents/*.md` and `commands/*.md` include YAML frontmatter (`name`, `description`)
 - [ ] Repo copy does not imply MCP support for tools outside the current MCP surface
 - [ ] README and submission copy stay consistent

.github/workflows/public-files.yml

@@ -1,15 +1,31 @@
 name: Public file safety
+
 on:
   push:
   pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+defaults:
+  run:
+    shell: bash
+
 permissions:
   contents: read
+
 jobs:
   public-files:
+    name: public-files
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - run: python3 scripts/check-public-files.py
+
+      - name: Check tracked files for secrets
+        run: python3 scripts/check-public-files.py

.github/workflows/validate-plugin.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.mcp.json

@@ -0,0 +1,8 @@
+{
+	"mcpServers": {
+		"leadmagic": {
+			"type": "http",
+			"url": "https://mcp.leadmagic.io/mcp"
+		}
+	}
+}

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 1.0.5
+
+- First-run copy is plugin-facing: Cursor prompts OAuth against `https://mcp.leadmagic.io/mcp`. Sign in with your LeadMagic account in the browser. No API key, no vendor internals in the README.
+
+## 1.0.4
+
+- First-run copy: Cursor prompts OAuth; sign in with your LeadMagic account in the browser.
+- Align `.cursor-plugin/marketplace.json` with Cursor’s official schema: plugin entries may only include `name`, `source`, `description`, and `minClientVersions`. Extra `logo` / `category` fields fail marketplace import (`additionalProperties: false`).
+- Vendor `schemas/marketplace.schema.json` and validate it in `npm run validate`.
+- Point install docs at Team Marketplace import and `https://mcp.leadmagic.io/cursor-plugin`.
+
+## 1.0.3
+
+- Pin the official LeadMagic icon (`https://leadmagic.io/logo/icon.svg`, 256×256 SVG) and add a 256×256 PNG raster for listings that need it.
+- Align marketplace entry (`logo`, `category`) and add `.mcp.json` for cursor.directory auto-detect after official marketplace listing.
+- Skill frontmatter matches the official plugin template (`name`, `description` only).
+
+## 1.0.2
+
+- Search-then-enrich-selected playbook: look up work email or professional mobile only for named rows after search.
+- First-run prompt: credits, then a bounded company search without unlocking emails.
+
+## 1.0.1
+
+- Front door is four features: people/company/jobs search, work-email find, work-email validate, professional mobile.
+- OAuth first-run copy matches app.leadmagic.io sign-in. Marketplace tone is licensed B2B contact data, not scraping.
+- Trim GTM extras from README, agent, and commands; keep thin supporting skills only.
+
+## 1.0.0
+
+- Marketplace-ready packaging: category `integrations`, `minClientVersions.cursor` `3.13.0`, short GTM-outcome description, `/add-plugin leadmagic`.
+- Add ICP, buying-committee, and markdown table skills wrapping hosted MCP.
+- User-facing copy uses B2B profile / B2B profile URL; drop marketplace emphasis on phone lookup.
+
+## 0.1.13
+
+- Align plugin copy and agent routing with the public docs/MCP surface: people/company/jobs search, ads, B2B profile tools, bulk, hiring signals, lookalikes, and REST fallbacks when MCP has no tool.
+- Marketplace and README wording uses B2B profile data / B2B profile URL.
+
+## 0.1.12
+
+- Add `.cursor-plugin/marketplace.json` with `source: "."` so Cursor GitHub clone / Import from Repo detects the plugin.
+
 ## 0.1.11
 
 - Verify the public OAuth challenge and discovery metadata, including PKCE and public-client support.
@@ -53,12 +96,12 @@ All notable changes to the LeadMagic Cursor plugin package are documented here.
 
 ## 0.1.4
 
-- **Auth:** Default `mcp.json` uses OAuth only (no headers); Cursor signs in with LeadMagic. README documents optional `x-leadmagic-key` + `${LEADMAGIC_API_KEY}` for API-key mode.
+- **Auth:** Default `mcp.json` uses OAuth only (no headers); Cursor signs in with LeadMagic.
 - **CI:** `npm run check` runs validate plus `verify:health` against `https://mcp.leadmagic.io/health`; redundant `mcp.json` inline checks removed (covered by validate).
 
 ## 0.1.3
 
 - **MCP:** Hosted server at `https://mcp.leadmagic.io/mcp` — 10 tools, shared docs resource `leadmagic://docs`, prompts `account_research` and `contact_lookup`.
-- **Auth:** `mcp.json` uses header `x-leadmagic-key` with `${LEADMAGIC_API_KEY}`.
-- **Bundle:** Default rule, four skills (contact enrichment, account intelligence, prospect list QA, signal research), validation script, and GitHub Actions CI.
+- **Auth:** Hosted MCP later moved to OAuth-only; this release still documented a header placeholder.
+- **Bundle:** Default rule, skills, validation script, and GitHub Actions CI.
 - **Docs:** README includes data handling and links to privacy, terms, and support; `SUBMISSION.md` marketplace copy matches the MCP tool surface.

LICENSE-NOTES.md

@@ -8,4 +8,4 @@ Third-party dependencies, copied assets, and excerpts retain their own licenses
 
 An integration with a third-party service does not imply ownership of that service or endorsement by its provider. Repository licensing does not grant access to hosted services, API credentials, or customer data; service access is governed separately.
 
-Before distributing a bundled build, review the licenses of the dependencies and assets actually included in that artifact. Report a missing attribution or licensing concern to [support@leadmagic.io](mailto:support@leadmagic.io), with the affected file and public source.
+Before distributing a bundled build, review the licenses of the dependencies and assets actually included in that artifact. Report a missing attribution or licensing concern to [plugins@leadmagic.io](mailto:plugins@leadmagic.io), with the affected file and public source.