Add Todoist plugin (hosted MCP)

[thahapc1994-jpg]

What this PR does

Adds the official todoist plugin to the xAI plugin marketplace as a remote-source catalog entry. No plugin code is vendored here.

• Plugin name: todoist
• Type: remote source
• Source URL + pinned SHA: https://github.com/Doist/todoist-mcp.git at 4e173822d738327503cae6da1e6b269e9e810646
• Homepage: https://github.com/Doist/todoist-mcp

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under the official org (Doist).

This is a catalog index PR pointing at the vendor's official public repository. I am not affiliated with Doist; the listing is sourced from that org's public plugin so Grok Build users can install it from the official marketplace.

Checklist

• Added exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha; the commit is public and reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally (generated from the full catalog, then this PR keeps only this plugin's index key).
• homepage + clear description set; keywords/domains are brand-scoped.
• License is stated: MIT

Security

• No curl | bash, remote-code download/exec, or postinstall RCE in the catalog entry.
• No reading/exfiltration of secrets, tokens, .env, or env vars in the catalog entry.
• MCP/hooks scope is whatever the upstream plugin ships — see notes.

Network endpoints this plugin calls: https://ai.todoist.net/mcp — Doist hosted Streamable HTTP MCP server.

Credentials/permissions it requires: OAuth in the browser on first use. No API key is stored in the plugin.

Notes for reviewers

Official Doist plugin. Manifest is .claude-plugin/plugin.json. Generated index: HTTP MCP server todoist, version 13.1.3. No hooks.

Install after merge:

grok plugin install todoist --trust