Add Norman Finance plugin

[stanlee000]

What this PR does

Adds the official Norman Finance hosted MCP server and its bundled finance/accounting skills to the Grok Build marketplace.

• Plugin name: norman-finance
• Type: remote source
• Source URL + pinned SHA: https://github.com/norman-finance/norman-mcp-server.git @ f9578ee8d5de8ed6d6c3a89ffc01f252a478a3a4
• Homepage: https://norman.finance

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org.

The source is maintained by Norman Finance in the norman-finance GitHub organization.

Checklist

• Added exactly one entry in .grok-plugin/marketplace.json.
• Remote source pins a full 40-character lowercase SHA that is public and reachable.
• Regenerated .grok-plugin/plugin-index.json.
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• Homepage and clear description are set.
• The source is licensed under MIT.

Security

• No curl | bash, remote-code download/exec, or postinstall behavior.
• No reading or exfiltration of local secrets, tokens, .env, or arbitrary environment variables.
• No lifecycle hooks or shell-execution MCP tools.

Network endpoints:

• https://mcp.norman.finance/mcp — hosted Streamable HTTP MCP endpoint.
• https://mcp.norman.finance/authorize and related OAuth metadata/token routes — MCP OAuth 2.1 flow.
• https://api.norman.finance/api/v1/oauth/ — Norman account authorization reached through the hosted MCP OAuth redirect.

Credentials/permissions:

• A Norman account is required. Authentication is completed in the browser through OAuth with PKCE; the plugin does not ask for, read, or store the user password or an API key.
• Norman MCP tool calls operate only on companies available to the authenticated Norman user. Mutating tools carry MCP safety annotations and remain subject to Grok approvals.

Notes for reviewers

The generated index discovers one remote MCP server and 19 bundled skills from the pinned source. The same public MCP is already distributed through Claude Connectors and the ChatGPT Plugins Directory. Source compatibility work is tracked in norman-finance/norman-mcp-server#116.