feat(notfair): add NotFair third-party MCP plugin

[ununununium]

Summary

• Add the notfair plugin under third_party/notfair/, pointing at NotFair's hosted MCP server (https://notfair.co/api/mcp/notfair) over Streamable HTTP. NotFair is a marketing workspace for Google, Meta, X, LinkedIn, Reddit, and TikTok Ads plus GA4, Search Console, GoHighLevel, and WordPress; one OAuth connection covers every supported platform.
• Auth is OAuth 2.1 with Dynamic Client Registration and PKCE, discovered from the server (WWW-Authenticate + protected-resource metadata). There is no API key, client ID, or template variable in the plugin. Protected-resource metadata: https://notfair.co/.well-known/oauth-protected-resource/api/mcp/notfair
• Register the plugin in .cursor-plugin/marketplace.json and the root README table (Integrations, author Notfair).

Notes for reviewers

• Source of truth for the plugin is https://github.com/nowork-studio/notfair-plugin (MIT, version 0.27.9); this directory is its Cursor packaging.
• This package is MCP-first. The source repo ships 48 open-source SEO, GEO, and content skills, but those wrappers resolve to canonical files outside skills/ and would make this PR unwieldy. Skills remain in the source repository.
• The same plugin was previously also submitted through cursor.com/marketplace/publish; this PR carries the packaging so it can be reviewed here.
• Logo is NotFair's brand mark (512×512 PNG) from the source repository.

Test plan

• node scripts/validate-plugins.mjs passes (after npm install --no-save ajv ajv-formats)
• Install from Cursor Settings → Plugins or /add-plugin notfair, complete the Connect to NotFair step
• Smoke test a read-only briefing (for example GA4 or Search Console) after connecting a workspace

---

Note

Low Risk
Packaging-only change (manifest, docs, marketplace registration); no in-repo executable logic or embedded credentials. Operational risk after install depends on NotFair’s hosted MCP and user OAuth scopes.

Overview
Adds the NotFair third-party integration to the Cursor plugin marketplace: new packaging under third_party/notfair/ and listings in .cursor-plugin/marketplace.json and the root README integrations table.

The plugin is MCP-only (v0.27.9): mcp.json points at NotFair’s hosted Streamable HTTP server at https://notfair.co/api/mcp/notfair, with OAuth 2.1 (DCR + PKCE) handled at runtime—no API keys or client secrets in the repo. Manifest, README, CHANGELOG, LICENSE, and logo assets ship with the package; the larger SEO/content skills from the upstream notfair-plugin repo are intentionally omitted from this PR.

^{Reviewed by Cursor Bugbot for commit 130618a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ununununium]

Hi @minupalaniappan — gentle ping on PR #398 (feat(notfair): add NotFair third-party MCP plugin).

It's been open since Sep 19, rebased cleanly onto main (most recently Sep 25), and is still waiting on a human review. Packaging only: MCP-first plugin pointing at our hosted Streamable HTTP server with OAuth 2.1 (DCR + PKCE), no API keys or secrets in-repo.

Happy to answer anything or adjust the packaging if needed. Thanks for looking when you get a chance.