[timbenniks-contentstack]

Installing the plugin now gives the agent the Contentstack skills and the Contentstack tools from the hosted MCP Profile Hub (https://mcp-profile-hub.contentstack.com/api/mcp). Sign-in is OAuth in the browser on first use: no API key, and every call runs with the user's own Contentstack roles.

This is the packaging step for listing Contentstack in the OpenAI (ChatGPT and Codex) plugin directory and the Cursor Marketplace, from this one repo instead of a new one. Server side: contentstack/contentstack-mcp-profile-manager#337 (epic DX-32269).

What changed

Each client reads its own file, in the format its docs define (checked 3 Nov 2026):

Client	File	Shape
Claude Code, claude.ai	.mcp.json (new)	type: "http"
Codex, ChatGPT, Agent Plugins clients	mcp.json (new)	type: "streamable-http", agent-plugins.org schema
Cursor	.cursor-plugin/plugin.json	inline mcpServers, url only. Overrides Cursor's default mcp.json discovery, so Cursor never reads the portable file's type
Gemini CLI	gemini-extension.json	mcpServers, httpUrl (streamable HTTP)

• .claude-plugin/plugin.json gains documentationUrl, supportUrl, privacyPolicyUrl and termsOfServiceUrl. claude plugin validate flags a plugin that connects to a remote MCP server without a privacy policy.
• README: a short "Contentstack MCP server" section and the new files in the layout. CHANGELOG: added to the 0.3.1 entry, so it ships in the 0.3.1 release with the Studio changes already on next.

Heads-up for reviewers

• Existing installs pick up the server on their next update and get a sign-in prompt the first time a Contentstack tool runs. The README says how to turn the server off for skills-only use.
• No version bump needed. next is already at 0.3.1, which hasn't been released yet, so this ships in 0.3.1.
• Still to decide before the directory submissions (not in this PR): the plugin name (contentstack-skills reads oddly once it carries the server, and OpenAI rejects "MCP" in a display name), the icon (claude plugin validate already warns about it), and whether ChatGPT gets all 24 skills or a CMS-focused subset.

Verification

• node scripts/validate.mjs: 24 skills and 7 manifests valid.
• claude plugin validate .: passes with the same two warnings as next (no icon, root CLAUDE.md). The new privacy warning is resolved.
• Not yet verified: installing in each client and completing sign-in. Codex and Cursor review the bundle at submission.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed