Add official BlindPay MCP plugin

[rafa-thayto]

What this PR does

Adds the official BlindPay MCP plugin to the Grok Build marketplace.

• Plugin name: blindpay
• Type: remote source
• Source URL + pinned SHA: https://github.com/blindpaylabs/blindpay-mcp.git @ 1a52d43fe658374d21f647a7c6a23ad3ac6cca71 (v1.8.0; on main after blindpay-mcp#30)
• Homepage: https://blindpay.com
• Category: development
• License: MIT

What it ships

Two hosted HTTP MCP servers (OAuth 2.1 / PKCE, no API key to paste):

Server	URL	Scope
blindpay	https://mcp.blindpay.com/mcp	Full (read + write)
blindpay-readonly	https://mcp.blindpay.com/mcp/readonly	Read-only

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (blindpaylabs).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable on main.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally (Catalog OK).
• python3 scripts/generate-plugin-index.py --check passes locally (Plugin index OK).
• homepage + clear description set; upstream includes README.md + .grok-plugin/plugin.json.
• License is stated: MIT.
• Brand-scoped keywords / domains (no generic CTA terms).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege (hosted HTTP MCP only; no local shell MCP).
• Network endpoints this plugin calls (and why):
  • https://mcp.blindpay.com/mcp — full BlindPay MCP (Streamable HTTP)
  • https://mcp.blindpay.com/mcp/readonly — read-only BlindPay MCP
  • OAuth discovery via /.well-known/oauth-protected-resource/... → Clerk auth at clerk.blindpay.com
• Credentials/permissions it requires (and why):
  • Browser OAuth 2.1 (PKCE) with the user's BlindPay account; no long-lived API key in the plugin config.

Notes for reviewers

• Publisher is BlindPay (blindpaylabs), not a personal fork.
• Unauthenticated POSTs to both MCP URLs correctly return 401 + WWW-Authenticate Bearer resource metadata (same OAuth posture as Stripe / Quo / Sentry hosted MCPs).
• Related upstream: feat: Grok plugin + full/readonly HTTP MCP endpoints blindpaylabs/blindpay-mcp#30 (merged).