feat(notfair): add NotFair third-party MCP plugin

[ununununium]

Summary

• Add the notfair plugin under third_party/notfair/, pointing at NotFair's hosted MCP server (https://notfair.co/api/mcp/notfair) over Streamable HTTP. NotFair is a marketing workspace for Google, Meta, X, LinkedIn, Reddit, and TikTok Ads plus GA4, Search Console, GoHighLevel, and WordPress; one OAuth connection covers every supported platform.
• Auth is OAuth 2.1 with Dynamic Client Registration and PKCE, discovered from the server (WWW-Authenticate + protected-resource metadata). There is no API key, client ID, or template variable in the plugin. Protected-resource metadata: https://notfair.co/.well-known/oauth-protected-resource/api/mcp/notfair
• Register the plugin in .cursor-plugin/marketplace.json and the root README table (Integrations, author Notfair).

Notes for reviewers

• Source of truth for the plugin is https://github.com/nowork-studio/notfair-plugin (MIT, version 0.27.9); this directory is its Cursor packaging.
• This package is MCP-first. The source repo ships 48 open-source SEO, GEO, and content skills, but those wrappers resolve to canonical files outside skills/ and would make this PR unwieldy. Skills remain in the source repository.
• The same plugin was previously also submitted through cursor.com/marketplace/publish; this PR carries the packaging so it can be reviewed here.
• Logo is NotFair's brand mark (512×512 PNG) from the source repository.

Test plan

• node scripts/validate-plugins.mjs passes (after npm install --no-save ajv ajv-formats)
• Install from Cursor Settings → Plugins or /add-plugin notfair, complete the Connect to NotFair step
• Smoke test a read-only briefing (for example GA4 or Search Console) after connecting a workspace

---

Note

Medium Risk
Introduces a third-party OAuth connector whose tools can read and mutate ads, analytics, WordPress, and CRM data; risk is limited to additive marketplace packaging with no core repo logic changes.

Overview
Adds the NotFair integration to the Cursor plugin marketplace: a new third_party/notfair/ package that wires agents to NotFair’s hosted Streamable HTTP MCP at https://notfair.co/api/mcp/notfair, plus listings in .cursor-plugin/marketplace.json and the root README integrations table.

The plugin is MCP-only (manifest, mcp.json, docs, MIT license, changelog); SEO/GEO skills from the upstream repo are intentionally omitted. Auth is OAuth 2.1 with server-discovered DCR and PKCE—no API keys or client secrets in the repo. One connection is documented to cover Google/Meta/X/LinkedIn/Reddit/TikTok Ads, GA4, Search Console, GoHighLevel, and WordPress inside the user’s NotFair workspace.

^{Reviewed by Cursor Bugbot for commit 2274d73. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ununununium]

Hi @minupalaniappan — gentle ping on PR #398 (feat(notfair): add NotFair third-party MCP plugin).

It's been open since Sep 19, rebased cleanly onto main (most recently Sep 25), and is still waiting on a human review. Packaging only: MCP-first plugin pointing at our hosted Streamable HTTP server with OAuth 2.1 (DCR + PKCE), no API keys or secrets in-repo.

Happy to answer anything or adjust the packaging if needed. Thanks for looking when you get a chance.