The files
- .cursor-plugin/plugin.json: name (unique, lowercase, kebab-case), displayName, version, description, author with name, email and url, homepage, repository, license, logo, keywords, category, tags, mcpServers pointing at ./mcp.json
- .cursor-plugin/marketplace.json: name, owner, metadata and the plugins array, required when one repo holds several plugins and harmless when it holds one
- mcp.json: the MCP servers block, for a SaaS ideally { type: "http", url: "https://yourdomain/mcp" }
- skills/<name>/SKILL.md plus references, the same skill you ship to Claude
- assets/logo.png committed to the repo, optional but the listing looks unfinished without it
- Optional Cursor-only pieces: rules as .mdc files, agents, commands, hooks
Submit it
- 1Push the plugin to a public git repo. Every plugin on the marketplace must be open source.
- 2Check the manifest against the cursor/plugin-template repo; a valid .cursor-plugin/plugin.json with a unique kebab-case name is the gate.
- 3Submit the repository link at cursor.com/marketplace/publish.
- 4Wait for the manual review. Each update is reviewed again before it is published, so batch changes.
How users install it
Once listed, users open Cursor Settings, go to Plugins (Customize in the sidebar), search for your name and click Install at project or user scope. Chat has a shortcut too:
In the Cursor chat
/add-plugin <plugin-name>
Point the plugin at your remote MCP server with OAuth and dynamic client registration. Cursor prompts the user to sign in to your product and pick a workspace, and there is no key to copy. That one decision removes most of the support tickets a plugin generates.
What we learned shipping ours
- Reuse the skill folder from the Claude plugin verbatim. The two formats differ only in the manifest and the MCP config file name.
- Keep the sync script dumb: clone the plugin repo, replace everything except .git and LICENSE, commit if changed. It runs in CI after every release.
- Mention an API key fallback in the README for users behind an SSO policy that blocks OAuth popups.
- The author block wants an email. Use a monitored one; that is where the review questions arrive.
Vendor docs this guide is checked against
- Cursor plugin docscursor.com/docs/plugins
- Plugin template repogithub.com/cursor/plugin-template
- Official plugins and the marketplace specgithub.com/cursor/plugins