feat(third_party): add Coinbase plugin by minupalaniappan · Pull Request #354 · cursor/plugins · GitHub

Warning

Blocked on Coinbase. Coinbase's remote MCP server is available only to harnesses on an explicit allowlist (ChatGPT, Grok, Perplexity Computer, Claude, Claude Code). Cursor is not on it, and login.coinbase.com publishes no registration_endpoint, so there is no client id Cursor can use and sign-in cannot complete in any plugin shape. Draft until Coinbase allowlists Cursor and Cursor has a client identity (a partner OAuth client wired as a static provider policy, or Client ID Metadata Document support against client_id_metadata_document_supported: true).

Summary

Add Coinbase as a third_party/ marketplace plugin, in the Attio (Add Attio third-party MCP plugin #339) / Hunter (Add Hunter third-party MCP plugin (API key header auth) #340) shape.
One of nine hosted-MCP connectors that grok.com offers publicly (GrowthBook visibility all) and the Cursor marketplace does not. The server URL matches Grok's production connector_catalog.mcp_server_url.
Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
URL-only OAuth, matching Coinbase's documented setup and the other eight connectors in this batch. The original CLIENT_ID / CLIENT_SECRET variables were dropped: Coinbase Developer Platform OAuth client creation is limited to approved partners, so users could not have supplied them (Bugbot finding).


Endpoint	https://agents.coinbase.com/mcp
Auth	OAuth via Coinbase sign-in. Probed: 401 → login.coinbase.com; PRM advertises mcp:* scopes; AS has no dynamic client registration.
Grok visibility	all

MCP

{
  "mcpServers": {
    "coinbase": {
      "type": "http",
      "url": "https://agents.coinbase.com/mcp"
    }
  }
}

Stack

Split from #345 into one PR per plugin.

gamma feat(third_party): add Gamma plugin #347 ✅ merged
webull feat(third_party): add Webull plugin #348 ✅ merged
sp-global feat(third_party): add S&P Global plugin #349 ✅ merged
interactive-brokers feat(third_party): add Interactive Brokers plugin #350 ✅ merged
meltwater feat(third_party): add Meltwater plugin #351 ✅ merged
daloopa feat(third_party): add Daloopa plugin #352 ✅ merged
excalidraw feat(third_party): add Excalidraw plugin #353 ✅ merged
8. coinbase feat(third_party): add Coinbase plugin #354 ← this PR (blocked)
google-cloud-bigquery feat(third_party): add Google Cloud BigQuery plugin #355 ✅ merged

Test plan

node scripts/validate-plugins.mjs passes on this branch
Endpoint probed for OAuth discoverability and dynamic client registration
README has Install / MCP / Availability / What agents can do / Notes / Docs / License, with capabilities sourced from vendor docs
marketplace.json, plugin.json, and README table descriptions are identical
Logo visually reviewed at 192×192
Blocked: install from Cursor Settings → Plugins, complete Coinbase sign-in, and smoke test listing portfolios — requires Coinbase allowlisting Cursor

Notes

Orders placed through this server are live; Coinbase recommends scoping the agent to a dedicated portfolio.

Note

Medium Risk
Introduces a live-trading crypto integration (OAuth to user accounts) via marketplace config; repo change is low-risk, but end-user impact is financial once allowlisting unblocks sign-in.

Overview
Adds a new Coinbase third-party marketplace plugin so agents can connect to Coinbase’s hosted remote MCP at https://agents.coinbase.com/mcp for balances, quotes, and trade preview/execution.

The change registers coinbase in .cursor-plugin/marketplace.json and the root README plugin table, and adds third_party/coinbase/ with manifest, URL-only mcp.json (no user API key variables), docs, changelog, and MIT license—same hosted-MCP pattern as other finance connectors. README and changelog call out OAuth sign-in and that the integration is blocked until Coinbase allowlists Cursor as an MCP harness; they also warn that orders through the server are live.

Reviewed by Cursor Bugbot for commit 07242f3. Bugbot is set up for automated code reviews on this repo. Configure here.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

✅ Fixed: Invented Coinbase OAuth client credentials
- Removed the required CLIENT_ID/CLIENT_SECRET pair so the plugin uses Coinbase's documented URL-only login OAuth against https://agents.coinbase.com/mcp.

Or push these changes by commenting:

@cursor push db37780599

Preview (db37780599)

diff --git a/third_party/coinbase/.cursor-plugin/plugin.json b/third_party/coinbase/.cursor-plugin/plugin.json
--- a/third_party/coinbase/.cursor-plugin/plugin.json
+++ b/third_party/coinbase/.cursor-plugin/plugin.json
@@ -31,24 +31,5 @@
     "crypto",
     "mcp"
   ],
-  "variables": {
-    "type": "object",
-    "properties": {
-      "CLIENT_ID": {
-        "type": "string",
-        "title": "Coinbase OAuth Client ID",
-        "description": "OAuth client ID from the Coinbase Developer Platform portal (portal.cdp.coinbase.com \u2192 OAuth)."
-      },
-      "CLIENT_SECRET": {
-        "type": "string",
-        "title": "Coinbase OAuth Client Secret",
-        "description": "OAuth client secret from the same Coinbase Developer Platform OAuth client."
-      }
-    },
-    "required": [
-      "CLIENT_ID",
-      "CLIENT_SECRET"
-    ]
-  },
   "mcpServers": "./mcp.json"
 }

diff --git a/third_party/coinbase/CHANGELOG.md b/third_party/coinbase/CHANGELOG.md
--- a/third_party/coinbase/CHANGELOG.md
+++ b/third_party/coinbase/CHANGELOG.md
@@ -5,5 +5,5 @@
 ## 1.0.0 — initial release
 
 - Added the `coinbase` MCP server pointing at Coinbase's hosted Streamable HTTP endpoint (`https://agents.coinbase.com/mcp`).
-- Auth uses OAuth with Coinbase user login. Declared `CLIENT_ID` and `CLIENT_SECRET` plugin variables and forwarded them through MCP auth, since `login.coinbase.com` does not support dynamic client registration.
+- Auth uses Coinbase user login OAuth against the hosted remote URL. No client ID or secret is required.
 - Logo: Coinbase's official mark, from the `coinbase` GitHub organization.

diff --git a/third_party/coinbase/README.md b/third_party/coinbase/README.md
--- a/third_party/coinbase/README.md
+++ b/third_party/coinbase/README.md
@@ -8,7 +8,7 @@
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Coinbase**.
-3. Click **Install**, then follow **Setup** below.
+3. Click **Install**, then complete the Coinbase sign-in prompt.
 
 Or run `/add-plugin coinbase` in chat.
 
@@ -18,29 +18,14 @@
 {
   "mcpServers": {
     "coinbase": {
-      "url": "https://agents.coinbase.com/mcp",
-      "auth": {
-        "CLIENT_ID": "${CLIENT_ID}",
-        "CLIENT_SECRET": "${CLIENT_SECRET}"
-      }
+      "url": "https://agents.coinbase.com/mcp"
     }
   }
 }

-## Setup
+Auth is OAuth against Coinbase. Cursor prompts for Coinbase user login when the plugin connects — there is no API key or client ID to configure. On the approval screen, select which portfolios to give the agent access to. Coinbase recommends scoping the agent to a dedicated portfolio.

-Coinbase's authorization server (login.coinbase.com) does not support dynamic client registration, so an OAuth client has to be registered before anyone can connect.

-1. In the Coinbase Developer Platform portal, create an OAuth client and enable the Coinbase for Agents (mcp:*) scopes you want to expose.
-2. Register both redirect URIs on that client:

- Desktop: http://localhost:8787/callback
- Web and Cloud Agents: https://www.cursor.com/agents/mcp/oauth/callback
  -3. In Dashboard → Plugins → Configure, set Coinbase OAuth Client ID and Coinbase OAuth Client Secret from that client.
  -4. Complete the Coinbase login when Cursor prompts.

-On a team marketplace an admin sets the client ID and secret once for everyone; each member still completes their own Coinbase login, so tool calls run against that member's account. Coinbase recommends scoping the agent to a dedicated portfolio.

What agents can do

| Category | Capabilities |

diff --git a/third_party/coinbase/mcp.json b/third_party/coinbase/mcp.json
--- a/third_party/coinbase/mcp.json
+++ b/third_party/coinbase/mcp.json
@@ -1,11 +1,7 @@
{
"mcpServers": {
"coinbase": {

 "url": "https://agents.coinbase.com/mcp",

```
 "auth": {
```
```
   "CLIENT_ID": "${CLIENT_ID}",
```
```
   "CLIENT_SECRET": "${CLIENT_SECRET}"
```
```
 }
```

 "url": "https://agents.coinbase.com/mcp"

}
}
}

</details>


<sub>You can send follow-ups to the cloud agent <a href="https://cursor.com/agents/bc-4de60f60-e92a-42a3-8f20-7685d06ce582">here</a>.</sub>
<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END -->

<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 14ef85f2ae789a6ce4646bea543fe3b37b5198b5. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

…owlist blocker

minupalaniappan force-pushed the minu/plugin-coinbase branch from 4894601 to e844cb8 Compare September 10, 2026 17:55

minupalaniappan force-pushed the minu/plugin-excalidraw branch from c7dbdaa to e08285c Compare September 10, 2026 17:55

minupalaniappan force-pushed the minu/plugin-coinbase branch from e844cb8 to b288e33 Compare September 10, 2026 20:14

minupalaniappan force-pushed the minu/plugin-excalidraw branch from 7ad62fb to 4573b2f Compare September 10, 2026 21:18

minupalaniappan force-pushed the minu/plugin-coinbase branch from b288e33 to 81c6f48 Compare September 10, 2026 21:18

minupalaniappan force-pushed the minu/plugin-excalidraw branch from 4573b2f to 529e3af Compare September 10, 2026 21:36

minupalaniappan force-pushed the minu/plugin-coinbase branch from 81c6f48 to 14ef85f Compare September 10, 2026 21:36

cursor Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread third_party/coinbase/mcp.json Outdated

minupalaniappan force-pushed the minu/plugin-excalidraw branch from 529e3af to 30baab7 Compare September 10, 2026 21:47

minupalaniappan force-pushed the minu/plugin-coinbase branch from 14ef85f to 86eae3b Compare September 10, 2026 21:47

minupalaniappan force-pushed the minu/plugin-excalidraw branch from 30baab7 to ae97d2c Compare September 10, 2026 21:55

minupalaniappan force-pushed the minu/plugin-coinbase branch from 86eae3b to c2ec8f2 Compare September 10, 2026 21:55

minupalaniappan force-pushed the minu/plugin-excalidraw branch from ae97d2c to f4a9669 Compare September 10, 2026 22:29

minupalaniappan force-pushed the minu/plugin-coinbase branch 2 times, most recently from 678976a to 6cc3241 Compare September 10, 2026 22:38

minupalaniappan changed the base branch from minu/plugin-excalidraw to main September 10, 2026 22:38

minupalaniappan marked this pull request as draft September 15, 2026 03:12

ericzakariasson and others added 2 commits September 14, 2026 23:14

feat(third_party): add Coinbase plugin

b32b4d8

fix(coinbase): drop client credential variables; document harness all…

07242f3

…owlist blocker

minupalaniappan force-pushed the minu/plugin-coinbase branch from 4ee133f to 07242f3 Compare September 15, 2026 03:14

feat(third_party): add Coinbase plugin by minupalaniappan · Pull Request #354 · cursor/plugins · GitHub

feat(third_party): add Coinbase plugin - #354

feat(third_party): add Coinbase plugin#354
minupalaniappan wants to merge 2 commits into
mainfrom
minu/plugin-coinbase

minupalaniappan commented Sep 10, 2026 •
edited by cursor Bot
Loading

Uh oh!

Uh oh!

cursor Bot left a comment •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat(third_party): add Coinbase plugin by minupalaniappan · Pull Request #354 · cursor/plugins · GitHub

feat(third_party): add Coinbase plugin - #354

feat(third_party): add Coinbase plugin#354minupalaniappan wants to merge 2 commits intomaincursor/plugins:mainfrom minu/plugin-coinbasecursor/plugins:minu/plugin-coinbaseCopy head branch name to clipboard

Conversation

minupalaniappan commented Sep 10, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

MCP

Stack

Test plan

Notes

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

-Coinbase's authorization server (login.coinbase.com) does not support dynamic client registration, so an OAuth client has to be registered before anyone can connect.

-On a team marketplace an admin sets the client ID and secret once for everyone; each member still completes their own Coinbase login, so tool calls run against that member's account. Coinbase recommends scoping the agent to a dedicated portfolio.

What agents can do

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat(third_party): add Coinbase plugin#354
minupalaniappan wants to merge 2 commits into
mainfrom
minu/plugin-coinbase

minupalaniappan commented Sep 10, 2026 •
edited by cursor Bot
Loading

cursor Bot left a comment •
edited
Loading