Viral∞p
AI plugin directories

How to list on Grok Build plugins

xAI's plugin marketplace launched on June 11, 2026 for Grok Build, the terminal coding agent, with MongoDB, Vercel, Sentry, Chrome DevTools and Cloudflare at launch. The catalog is one JSON file in a public GitHub repo, and getting listed is a pull request that adds your entry. It is the most transparent process on this list: the validator you run locally is exactly what CI runs, and the review criteria are written down in CONTRIBUTING.md.

You ship

Public repo: .grok-plugin/plugin.json, .mcp.json, skills/, plus a PR to xai-org/plugin-marketplace

Submit at

Pull request to github.com/xai-org/plugin-marketplace

Review

CI validator plus xAI code-owner review of source, security and duplication

Auth

Remote MCP with OAuth; env vars for local servers

01

What the marketplace is

The repo xai-org/plugin-marketplace is an index, not a store. Its .grok-plugin/marketplace.json lists every plugin and where Grok Build fetches it from. Third-party plugins normally live in their own repo and are referenced by URL plus a full commit SHA; xAI vendors nothing. A plugin is a directory bundling skills, commands, agents, hooks, MCP servers and LSP servers, with an optional manifest for metadata. Grok Build users browse it with /marketplace and install with one keypress, or from the shell:

How users install once you are listed

grok plugin marketplace list
grok plugin install <name> --trust
02

The files in your repo

  • .grok-plugin/plugin.json: name, version, description, author with name and url, homepage, repository, license, keywords, logo. A .claude-plugin/plugin.json is also accepted, so the Claude plugin repo can double as the Grok one.
  • .mcp.json: mcpServers with a remote { type: "http", url } entry or a local command
  • skills/<name>/SKILL.md: the same skill files you ship to Claude and Cursor
  • README.md: what it does, the network endpoints it calls and the credentials it needs. Reviewers read this first.
  • A LICENSE file. Unlicensed plugins are sent back.
03

The catalog entry

Your pull request adds one object to the plugins array. Keywords and domains power the plugin CTA, the prompt where Grok Build proactively suggests your plugin, so they must be brand-scoped: your product name and the domains you own, never generic words like video, api or deploy.

.grok-plugin/marketplace.json entry

{
  "name": "yourproduct",
  "description": "What the plugin does, in one specific sentence.",
  "category": "development",
  "source": {
    "source": "url",
    "url": "https://github.com/your-org/yourproduct-plugin.git",
    "sha": "<full 40-character commit sha>"
  },
  "homepage": "https://yourproduct.com",
  "keywords": ["yourproduct", "yourproduct mcp"],
  "domains": ["yourproduct.com"]
}
04

Submit it

  1. 1Publish the plugin repo under your official GitHub org, public, with a LICENSE. A branded plugin sourced from a personal account reads as impersonation and is questioned every time.
  2. 2Fork xai-org/plugin-marketplace and branch from main.
  3. 3Add your entry to .grok-plugin/marketplace.json. Get the SHA with git ls-remote https://github.com/<org>/<repo>.git HEAD; tags, branches and short SHAs are rejected.
  4. 4Run python3 scripts/generate-plugin-index.py, then python3 scripts/validate-catalog.py and python3 scripts/generate-plugin-index.py --check. Commit the regenerated plugin-index.json.
  5. 5Open the PR and fill in the template: ownership, the network endpoints the plugin calls, the credentials it needs.
  6. 6Wait for CI and code-owner review. Updates later are a new PR that bumps the sha; never a second entry.
05

What the review rejects

  • Remote code execution: curl piped to bash, downloaded binaries, eval of remote content, postinstall scripts that fetch code
  • Reading ~/.ssh, .env, tokens or environment variables and sending them anywhere, and undisclosed telemetry
  • Hooks that run shell on every Bash or Write with no matcher, or a shell-exec MCP server where a scoped tool would do
  • Base64 blobs, minified bundles without source, typosquatted dependencies, prompt injection in SKILL.md
  • A private or unreachable pinned commit, a stale plugin-index.json, a vague description, no homepage

Declare every endpoint and credential in the README before you open the PR. The reviewers audit the MCP config, hooks and skills statically, and a plugin that explains itself is the one that merges on the first pass.

06

The Grok app is a different surface

Grok Build is the coding agent. The Grok app on web, iOS and Android has connectors instead: a curated catalog of OAuth integrations plus Bring Your Own MCP, and the catalog has no self-serve submission as of September 2026. Cover it with a connect guide on your site that points at the same remote MCP server the plugin uses:

Connect guide to put on your site

1. Open grok.com/connectors
2. Click New Connector, then Custom
3. Paste https://yourdomain/api/v1/mcp and sign in when prompted

The xAI API also accepts remote MCP tools by URL, so the same server works from any Grok-powered agent. Put the URL and auth header in your API docs and llms.txt and both paths are covered.

Vendor docs this guide is checked against

Listed is step one.
Being named is the job.

Assistants recommend the brands they keep seeing. Viraloop generates and posts your short-form content daily, so the model's answer about you stays current.

Start posting dailyAll directories

Want the short version?

Ask AI for a summary of Viraloop, what it automates for you, and how it compares to the alternatives.