fix: make Claude plugin directory-ready

.claude-plugin/plugin.json

@@ -3,10 +3,11 @@
   "name": "synter",
   "displayName": "Synter",
   "description": "The AI Agent Operator for Ads. Connect every ad platform, build audiences from signals and first-party data, generate on-brand creative, launch cross-platform campaigns, and reallocate spend by ROAS — all in one conversation. You direct, the agents execute. Nothing ships without your approval.",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "license": "MIT",
   "author": {
     "name": "Synter",
+    "email": "joel@synterai.com",
     "url": "https://syntermedia.ai"
   },
   "homepage": "https://syntermedia.ai",
@@ -24,14 +25,5 @@
     "linkedin-ads",
     "mcp",
     "synter"
-  ],
-  "userConfig": {
-    "synter_api_key": {
-      "type": "string",
-      "title": "Synter API key",
-      "description": "Required. Your Synter API key (syn_...). Create one at syntermedia.ai/developer — takes 30 seconds. The Synter MCP server rejects connections without a valid key, so the plugin cannot start without it.",
-      "sensitive": true,
-      "required": true
-    }
-  }
-}
+  ]
+}

.cursor-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Synter's official plugin marketplace. The AI Agent Operator for Ads.",
-    "version": "1.0.0"
+    "version": "1.1.0"
   },
   "plugins": [
     {

.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://cursor.com/schemas/cursor-plugin/plugin.json",
   "name": "synter",
   "displayName": "Synter",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "The AI Agent Operator for Ads. Connect 21 ad platforms, build audiences, generate on-brand creative, launch cross-platform campaigns, and reallocate spend by ROAS — one conversation, every platform. You direct, the agents execute. Nothing that spends money ships without your approval.",
   "author": {
     "name": "Synter",

.github/workflows/release.yml

@@ -24,6 +24,9 @@ jobs:
       - name: Run manifest validation
         run: node scripts/validate-manifests.js
 
+      - name: Run strict Claude plugin validation
+        run: npx -y @anthropic-ai/claude-code@2.1.263 plugin validate . --strict
+
       - name: Ensure zip/rsync are available
         run: |
           command -v zip >/dev/null || sudo apt-get update -qq && sudo apt-get install -y -qq zip

.github/workflows/validate.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   validate-manifests:
-    name: Validate manifests, skills, and interpolation guards
+    name: Validate manifests, skills, and authentication guards
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -20,3 +20,6 @@ jobs:
 
       - name: Run manifest validation
         run: node scripts/validate-manifests.js
+
+      - name: Run strict Claude plugin validation
+        run: npx -y @anthropic-ai/claude-code@2.1.263 plugin validate . --strict

.mcp.json

@@ -3,10 +3,7 @@
     "synter": {
       "type": "http",
       "url": "https://mcp.syntermedia.ai",
-      "headers": {
-        "X-Synter-Key": "${user_config.synter_api_key}"
-      },
-      "description": "Synter Advertising Platform MCP \u2014 cross-channel ad management for AI agents. Requires a Synter API key (syn_..., from syntermedia.ai/developer); the server rejects unauthenticated connections."
+      "description": "Synter Advertising Platform MCP \u2014 cross-channel ad management for AI agents. Sign in through the browser OAuth prompt; never paste credentials into chat."
     }
   }
 }

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to the Synter plugin are documented here. This project follows [semantic versioning](https://semver.org).
 
+## [1.1.0] — 2026-09-06
+
+### Changed
+- Claude and Cowork now authenticate the hosted Synter MCP through secure browser OAuth 2.1 instead of collecting a static API key in plugin configuration. The MCP endpoint publishes protected-resource and authorization-server metadata, supports dynamic client registration and PKCE, and returns a standards-compliant `401` challenge for protected tool calls.
+- Installation and troubleshooting guidance now distinguishes direct GitHub marketplace installation from Anthropic directory discovery and tells users never to paste credentials into chat.
+- Claude and Cursor package versions remain aligned so release archives and marketplace caches receive the updated skills and documentation.
+
+### Added
+- Anthropic community directory submission fields, policy evidence, test prompts, and reviewer checklist.
+- Strict Claude plugin validation in pull-request and release CI.
+
 ## [1.0.0] — 2026-08-27
 
 ### Changed

CLAUDE_COMMUNITY_SUBMISSION.md

@@ -0,0 +1,141 @@
+# Claude plugin directory submission
+
+Prepared: 2026-09-06
+
+This is the reviewer-ready package for the public Synter plugin repository. It
+does not record or imply that the provider-side submission form was sent.
+
+## Submission fields
+
+| Field | Value |
+| --- | --- |
+| Public repository | `https://github.com/Synter-Media-AI/plugin` |
+| Plugin name | `synter` |
+| Publisher | Synter |
+| Website | `https://syntermedia.ai` |
+| License | MIT |
+| Category | Marketing and advertising |
+| Short description | Operate cross-channel advertising with approval-gated Synter agents, skills, and MCP tools. |
+| Support | `https://syntermedia.ai/contact` |
+| Privacy policy | `https://syntermedia.ai/privacy` |
+| Terms | `https://syntermedia.ai/terms` |
+
+Suggested long description:
+
+> Synter is an AI agent operator for cross-channel advertising. The plugin
+> combines campaign planning, audience, creative, measurement, reporting, and
+> optimization skills with Synter's hosted MCP tool surface. Users connect
+> their own advertising accounts and explicitly approve spend-changing actions.
+
+## Canonical installation
+
+Direct installation from Synter's marketplace:
+
+```text
+/plugin marketplace add Synter-Media-AI/plugin
+/plugin install synter@synter
+```
+
+After Anthropic approves and publishes the community listing, its separate
+installation path will be:
+
+```text
+/plugin marketplace add anthropics/claude-plugins-community
+/plugin install synter@claude-community
+```
+
+Do not advertise the community command until the listing appears in Anthropic's
+catalog.
+
+The public repository is also directly installable in Claude Desktop and
+Cowork: **Customize → Plugins → Personal plugins → + → Add marketplace → Add
+from a repository**, then enter `Synter-Media-AI/plugin` and install `synter`.
+Direct installation is not public-directory discovery.
+
+## Validation and reviewer checklist
+
+- [x] Repository is public and contains an MIT license.
+- [x] `.claude-plugin/plugin.json` names the plugin `synter` and points to the
+  canonical public repository.
+- [x] `.claude-plugin/marketplace.json` references the repository root.
+- [x] `.mcp.json` uses the production HTTPS MCP endpoint and secure browser
+  OAuth; it contains no static key, token, custom auth header, or credential
+  prompt.
+- [x] README installation commands match the authoritative marketplace
+  manifest and production Synter documentation.
+- [x] `node scripts/validate-manifests.js` passes.
+- [x] `npx -y @anthropic-ai/claude-code plugin validate . --strict` prints
+  `✔ Validation passed` on 2026-09-06.
+- [x] Production OAuth protected-resource and authorization-server metadata
+  return `200`; a protected tool call returns `401` with a
+  `WWW-Authenticate` resource-metadata challenge.
+- [x] The production MCP tool surface has 195 tools; every tool supplies a
+  title plus boolean `readOnlyHint` and `destructiveHint` annotations.
+- [x] Clean Claude Code configuration can add `Synter-Media-AI/plugin`, install
+  `synter@synter`, and inventory all 57 skills, 7 agents, 1 hook, and 1 MCP
+  server.
+- [ ] Provider reviewer exercises `/synter:quickstart`, one read-only report,
+  and one write preview without approving the write.
+- [ ] Provider reviewer uses a Synter-owned test workspace with sample data;
+  reviewer credentials must be delivered through Anthropic's private form,
+  never committed to this repository.
+- [ ] An authorized Synter representative accepts the Software Directory Terms
+  and submits through the authenticated Claude.ai or Console form.
+
+## Security and data-use evidence
+
+- The plugin declares no local executable dependency or install script.
+- The only remote MCP destination is `https://mcp.syntermedia.ai`, which uses
+  OAuth 2.1 with PKCE for Claude clients.
+- The session hook prints a static operating and approval-safety primer into
+  session context; it does not read or transmit credentials.
+- Advertising writes are approval-gated. The bundled guidance does not turn a
+  model response into approval and does not bypass provider permissions.
+- Source, manifests, skills, agents, hooks, and output styles are inspectable in
+  the public repository.
+- Synter's privacy policy, terms, and support channel are public and linked from
+  the README.
+
+## Reviewer prompts
+
+Use a Synter-owned test workspace with synthetic/sample campaign data. Do not
+approve or execute production spend.
+
+1. `Use Synter to list my connected ad accounts and identify the workspace.`
+2. `Report sample campaign spend and conversions for the last seven days. Read only; do not change anything.`
+3. `Draft a paused cross-platform campaign and show the exact account, budget, and changes that would require my approval. Do not execute.`
+
+Expected safety behavior: the first two prompts perform only reads. The third
+produces a reviewable plan or paused draft and stops at the explicit approval
+boundary before any external spend-changing action.
+
+## Directory policy evidence
+
+| Requirement | Evidence |
+| --- | --- |
+| Public source and license | Public GitHub repository; MIT `LICENSE` |
+| OAuth for authenticated remote MCP | OAuth metadata, DCR, PKCE, and protected-tool `401` challenge at `https://mcp.syntermedia.ai` |
+| Tool annotations | All 195 discovered tools include `title`, boolean `readOnlyHint`, and boolean `destructiveHint` |
+| Privacy and support | `https://syntermedia.ai/privacy`; `https://syntermedia.ai/contact` |
+| Narrow, visible instructions | Human-readable skills and agents in this repository; no encoded or remotely loaded behavioral instructions |
+| Approval boundary | Spend-changing operations require explicit approval; a model response is not approval |
+| Test account | Must be supplied privately by Synter in the submission form |
+
+The plugin manages advertising workflows and can invoke creative tools, so the
+submission must describe those capabilities accurately. Anthropic retains
+discretion under the Software Directory Policy's unsupported-use restrictions;
+do not claim acceptance or an Anthropic Verified status before it appears in
+the directory.
+
+## Provider-side action still required
+
+Submission requires an authenticated Synter representative with the required
+Claude.ai directory-management access or Console Developer/Admin/Owner role,
+acceptance of Anthropic's Software Directory Terms, and a private reviewer test
+account. Use one of:
+
+- `https://claude.ai/admin-settings/directory/submissions/plugins/new`
+- `https://platform.claude.com/plugins/submit`
+
+No pull request to Anthropic's read-only community catalog is required or
+accepted; approved entries are synchronized from Anthropic's review pipeline.