Add cursor-supermemory plugin (persistent memory via Supermemory)

[thahapc1994-jpg]

What this PR does

Adds the official cursor-supermemory plugin to the xAI plugin marketplace as a remote-source catalog entry. No plugin code is vendored here.

• Plugin name: cursor-supermemory
• Type: remote source
• Source URL + pinned SHA: https://github.com/supermemoryai/cursor-supermemory.git at 0abb19f5f53a55486e5d36a4f90b2fcaa5c7a4ac
• Homepage: https://supermemory.ai

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under the official org (supermemoryai).

This is a catalog index PR pointing at the vendor's official public repository. I am not affiliated with supermemoryai; the listing is sourced from that org's public plugin so Grok Build users can install it from the official marketplace.

Checklist

• Added exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha; the commit is public and reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally (generated from the full catalog, then this PR keeps only this plugin's index key).
• homepage + clear description set; keywords/domains are brand-scoped.
• License is stated: MIT

Security

• No curl | bash, remote-code download/exec, or postinstall RCE in the catalog entry.
• No reading/exfiltration of secrets, tokens, .env, or env vars in the catalog entry.
• MCP/hooks scope is whatever the upstream plugin ships — see notes.

Network endpoints this plugin calls: Supermemory API via the plugin's bundled Node CLI. MCP is stdio: node ${CURSOR_PLUGIN_ROOT}/dist/cli.js mcp.

Credentials/permissions it requires: node dist/cli.js login or SUPERMEMORY_API_KEY. Tokens live in user config, not in the plugin repo.

Notes for reviewers

Official Supermemory Cursor plugin. Ships skills (memory-init/save/search), commands, an agent, and lifecycle hooks (sessionStart/sessionEnd/preToolUse/postToolUse/beforeSubmitPrompt/stop) that run the bundled dist/ with Node. No .grok-plugin/.claude-plugin manifest — only .cursor-plugin/plugin.json — so the generated index records directory-scanned components but not the MCP server in mcp.json. Reviewers should treat the hooks as code that runs on the user's machine.

Install after merge:

grok plugin install cursor-supermemory --trust