feat(notfair): add NotFair third-party MCP plugin

[ununununium]

Summary

• Add the notfair plugin under third_party/notfair/, pointing at NotFair's hosted MCP server (https://notfair.co/api/mcp/notfair) over Streamable HTTP. NotFair is a marketing workspace for Google, Meta, X, LinkedIn, Reddit, and TikTok Ads plus GA4, Search Console, GoHighLevel, and WordPress; one OAuth connection covers every supported platform.
• Auth is OAuth 2.1 with Dynamic Client Registration and PKCE, discovered from the server (WWW-Authenticate + protected-resource metadata). There is no API key, client ID, or template variable in the plugin. Protected-resource metadata: https://notfair.co/.well-known/oauth-protected-resource/api/mcp/notfair
• Register the plugin in .cursor-plugin/marketplace.json and the root README table (Integrations, author Notfair).

Notes for reviewers

• Source of truth for the plugin is https://github.com/nowork-studio/notfair-plugin (MIT, version 0.27.9); this directory is its Cursor packaging.
• This package is MCP-first. The source repo ships 48 open-source SEO, GEO, and content skills, but those wrappers resolve to canonical files outside skills/ and would make this PR unwieldy. Skills remain in the source repository.
• The same plugin was previously also submitted through cursor.com/marketplace/publish; this PR carries the packaging so it can be reviewed here.
• Logo is NotFair's brand mark (512×512 PNG) from the source repository.

Test plan

• node scripts/validate-plugins.mjs passes (after npm install --no-save ajv ajv-formats)
• Install from Cursor Settings → Plugins or /add-plugin notfair, complete the Connect to NotFair step
• Smoke test a read-only briefing (for example GA4 or Search Console) after connecting a workspace

---

Note

Medium Risk
Introduces a third-party hosted MCP that can read and mutate marketing, site, and CRM data after OAuth; repo changes are packaging only, but install surface and delegated write access warrant review.

Overview
Adds the NotFair third-party Cursor plugin (third_party/notfair/) and lists it in .cursor-plugin/marketplace.json and the root README integrations table (author Notfair).

The package is MCP-only: mcp.json and plugin.json point agents at NotFair’s hosted Streamable HTTP server (https://notfair.co/api/mcp/notfair) for ads, analytics, WordPress, and GoHighLevel via one OAuth connection. Auth is documented as OAuth 2.1 with DCR + PKCE discovered from the server, with no API keys or client secrets in the repo. Shipping docs include README.md, CHANGELOG.md (v0.27.9), and MIT LICENSE; SEO/content skills are explicitly left out of this packaging PR.

^{Reviewed by Cursor Bugbot for commit 2d7f489. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ununununium]

Hi @minupalaniappan — gentle ping on PR #398 (feat(notfair): add NotFair third-party MCP plugin).

It's been open since Sep 19, rebased cleanly onto main (most recently Sep 25), and is still waiting on a human review. Packaging only: MCP-first plugin pointing at our hosted Streamable HTTP server with OAuth 2.1 (DCR + PKCE), no API keys or secrets in-repo.

Happy to answer anything or adjust the packaging if needed. Thanks for looking when you get a chance.