[MosoFin-support]

What this PR does

Adds the mosofin plugin (MCP Server) to the marketplace catalog as a remote source.

• Plugin name: mosofin
• Type: remote source
• Source URL + pinned SHA: https://github.com/MosoFin/mosofin-mcp-plugin.git @ 5f9a3919435ceac43ff5e053b240b750fc80571e
• Homepage: https://mosofin.com

MosoFin connects an AI assistant to a business's financial data (accounting platforms and other connected SaaS) through a remote MCP server. The plugin is a thin client: 8 skills, 1 subagent, and one HTTP MCP server config. It ships no code.

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (MosoFin).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; the source repo includes README.md + .grok-plugin/plugin.json.
• License is stated. — MIT (LICENSE in the source repo).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege. — No hooks. One HTTP MCP server.
• Network endpoints this plugin calls (and why): https://mcp.mosofin.com/mcp only — the MosoFin MCP server (Streamable HTTP). The URL is hardcoded in .mcp.json; there is no user-configurable endpoint.
• Credentials/permissions it requires (and why): OAuth 2.0 (dynamic client registration + PKCE) completed in the browser on first use; the host holds the token. The plugin ships no client id, secret, or keys. Data access is read-only and scoped to the one workspace the user confirms in chat. The only write is create_skill, which saves a user-approved analysis recipe to the user's own MosoFin library after explicit consent.

Notes for reviewers

• I'm on the engineering support team at MosoFin; the source repo is under our official org (MosoFin).
• Docs for connecting the MosoFin MCP server to Grok: https://docs.mosofin.com/destinations/mosofin-destinations/grok
• Source repo: https://github.com/MosoFin/mosofin-mcp-plugin (MIT), pinned to a commit on main.
• The plugin ships SKILL.md text, one agent definition (agents/mosofin-analyst.md), .mcp.json, a logo, and docs. No scripts, binaries, hooks, or LSP servers.
• Details of the read-only boundary and error handling: docs/plugin-contract.md in the source repo.

[Travisliang001]

Hi maintainers @ykeremy — this PR is ready for review.

I have added a demo in this link: https://youtu.be/T1O4IEp7jsc

Happy to answer any questions or make changes. Thanks for your time!

[MosoFin-support]

Hi @ykeremy — following up when you have a moment. This is the official MosoFin submission, an MCP-only remote-source plugin. The branch is synced with current main, the plugin index is regenerated, and local validation passes (validate-catalog.py and generate-plugin-index.py --check). Socket and Semgrep checks are green. The source is public and pinned to a full commit SHA under our official MosoFin org, with no scripts, hooks, or binaries.

For reference: there's a short demo here — https://youtu.be/T1O4IEp7jsc — and setup/integration docs at https://docs.mosofin.com/destinations/mosofin-destinations/grok (with the read-only boundary and error handling covered in docs/plugin-contract.md in the source repo).

Maintainer workflow approval and code-owner review are the remaining gates. Happy to answer any questions or make changes. Thank you!

[Travisliang001]

Hi @ykeremy , a quick nudge on this one when you have a moment. Nothing has changed since my last update. It’s still an MCP-only remote-source plugin pinned to a public commit, with no scripts, hooks or binaries.

The only things left are the maintainer workflow approval for the validate check and a code-owner review. If someone else on the team handles marketplace submissions, could you point me to them? I’m also glad to make any changes you’d like before review.

Thanks!