[rshah2020]

Adds Crossmint's hosted Menta MCP server (https://menta.crossmint.com/mcp) under third_party/crossmint, following the Crimson Health and Gopuff pattern for Grok Bot-only plugins. Menta is Crossmint's agent checkout product; the plugin is listed as Crossmint, with menta kept as a search keyword. Registers it in .cursor-plugin/marketplace.json and the README table, with the same description in plugin.json, marketplace.json, and the README. minClientVersions is {"cursor": "never", "grokbot": "0.49.0", "sand": "0.49.0"}, also set on the marketplace entry. node scripts/validate-plugins.mjs passes.

Menta checks out at online stores for the user and pays with a card saved on their Menta account, only within a spending limit the user approved in Crossmint's secure form. The assistant cannot approve or raise a limit, and card numbers never go through the chat.

Auth

OAuth 2.1 with PKCE, so there is no client ID or key to configure. The sign-in and consent pages are branded Menta.

• An unauthenticated initialize returns 401 with resource_metadata="https://menta.crossmint.com/.well-known/oauth-protected-resource/mcp" and scope="commerce:invoke".
• Protected resource metadata names https://login.menta.crossmint.com as the authorization server.
• Authorization server metadata advertises S256 PKCE, dynamic client registration (/v1/oauth2/register), client_id_metadata_document_supported: true, and token_endpoint_auth_methods_supported including none.

Verification

• menta.crossmint.com has valid TLS and belongs to Crossmint (the site's author and publisher metadata, and its help page names Crossmint and [email protected] for support).
• Menta's help page lists Grok Bot as a supported assistant and gives this server URL.
• Cursor's Client ID Metadata Document (https://cursor.com/oauth/mcp-client.json) lists both https://www.cursor.com/bot/mcp/oauth/callback and https://www.cursor.com/agents/mcp/oauth/callback.
• Not verified: whether Menta's authorize step accepts Cursor's metadata document with those callbacks. Menta's authorize API requires a signed-in Menta session before it validates the client and redirect URI, so a sign-in with a real Menta account is needed to confirm.
• README capabilities come from Menta's help page. The server publishes no public tool list or server card.
• Logo is Crossmint's official mark, crossmint-mark-gradient.svg from crossmint.com/brand. The paths are unchanged; only the viewBox is widened to center the mark on a square canvas with padding.

Why Grok Bot only

Menta is a consumer shopping service, like Gopuff, OnePay, and Shopify Store, which are all listed for Grok Bot only. Menta also supports dynamic client registration, so it could be opened to Cursor desktop later by changing minClientVersions.