Add Grok Build plugin files

[devin-ai-integration]

Summary

Prep work so Mobbin can be listed in Grok Build's plugin marketplace (xai-org/plugin-marketplace) instead of users pasting https://api.mobbin.com/mcp by hand. Tracked in PRJ-2469.

Grok reads a dot-prefixed .mcp.json plus .grok-plugin/plugin.json, and its transport key is "type": "http" — not the Agent Plugins "streamable-http". So this is additive: the existing plugin.json / mcp.json are untouched and npm run validate still passes against the (strict) Agent Plugins schemas.

Shapes were copied from the closest hosted-MCP + OAuth precedents already in the catalog — tavily-grok-plugin and firecrawl-grok-plugin — including the informational note field both of them carry.

Connector only, no skills — per review feedback.

No credentials are packaged; auth still happens through the MCP OAuth flow on first use.

Follow-up (separate, not in this PR): a catalog entry in xai-org/plugin-marketplace pinning this repo to a full 40-char commit SHA, which is why this needs to land first.

Link to Devin session: https://app.devin.ai/sessions/5bb466a87b1c40de94e8fbc4e971bbd0
Requested by: @liaujianjie

[devin-ai-integration]

Original prompt from jianjie

SYSTEM:
=== BEGIN THREAD HISTORY (in #api-mcp) ===
<most_recent_message>
Liau Jian Jie (U013YJN6402) [ts=1786537493.315159]: @Devin file this as a linear issue

[Slack unfurl — this is an automatic link preview, not a user message]
Quote of conversation (https://mobbinco.slack.com/archives/C013YJKS734/p1786535623759819?thread_ts=1786502250.805739&amp;cid=C013YJKS734):
> From Abhijeet Narharshettiwar
> <@U013YJN6402>
> any plans to add mobbin mcp as a built-in connector in the grok marketplace, so we can connect it directly instead of adding it manually via the HTTP endpoint?

> ATTACHMENT:"https://app.devin.ai/attachments/6d86dcf2-ac3d-412a-95a3-a301b8d47d7d/Screenshot%202026-08-12%20at%205.14.58%3FPM.png"
> Posted on August 12, 2026 at 11:53 AM

</most_recent_message>
=== END THREAD HISTORY ===
Channel ID: C0AM5BHRL5P
Thread URL: https://mobbinco.slack.com/archives/C0AM5BHRL5P/p1786537493315159?thread_ts=1786537493.315159&amp;cid=C0AM5BHRL5P

The latest message is the one right above that tagged you. The <most_recent_message> is the message that you should use to guide your goals + task for this session, and you should use the rest of the slack thread as context.
A [ts=...] marker on a Slack message is that message's timestamp. To act on a specific message with the slack tool (e.g. adding an emoji reaction via the reaction command), pass that value as timestamp along with the Channel ID — no extra lookup call is needed.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[kingstarfly]

@devin exclude the skill please. Only mcp server

[devin-ai-integration]

@devin exclude the skill please. Only mcp server

Done in 2bcc25b — skill removed, connector only. The listing will just show "1 connector" with no skills, same as a few existing catalog entries.

[kingstarfly]

@devin also, is this relevant? https://linear.app/mobbin/issue/PRJ-2379/connector-asset-kit-logos-copy-contacts-single-source-for-every-mcp

how did you decide the description? Also what other fields are there - please study the readme at https://github.com/xai-org/plugin-marketplace/tree/main closely

[devin-ai-integration]

also, is this relevant? PRJ-2379 … how did you decide the description? Also what other fields are there

Yes, relevant — I'd missed it. The description I wrote was my own paraphrase modelled on the Tavily/Firecrawl entries, which is exactly the re-deriving PRJ-2379 exists to stop. Switched to its canonical ≤80-char line in 7c9c341:

Search real-world UI/UX design references from top mobile and web apps.

The other PRJ-2379 assets mostly don't apply to this surface: the catalog has no icon/logo field at all (all 18 existing entries use only name, description, category, source, homepage, keywords, domains), and there's no contact, GA-date, demo-video, or sample-prompt field either. Those matter for the grok.com/connectors first-party tile, not for the Grok Build marketplace.

Full field set per the README: name and source required; description, category, homepage, keywords, domains recommended; version, author, tags optional display metadata — no entry in the catalog currently uses those last three, so I've left them out.

On keywords: I deliberately did not use PRJ-2379's synonym list. CONTRIBUTING says keywords/domains power Grok Build's proactive plugin CTA and that generic terms ("design inspiration", "UI patterns", "app screenshots") get pushed back for mis-firing on unrelated requests, so the entry uses mobbin, mobbin design, mobbin mcp and only domains we own (mobbin.com, api.mobbin.com).

Two things worth a separate pass, not this PR: our description copy drifts across surfaces (root plugin.json says "…from your agent", server.json in mobbin-mcp-server has the 96-char version), and PRJ-2379 lists no promo screenshots — which the first-party connector route will ask for.

Also checked the rest of CONTRIBUTING's review criteria against us: source is under the official mobbin org, MIT stated, README declares the endpoint and that no credential is packaged, and the plugin is a scoped read-only hosted MCP server with no hooks or shell exec — so nothing in their security list applies.