Add invinoveritas plugin: independent pre-action review via remote MCP

[babyblueviper1]

What

Adds invinoveritas to third_party/ — a Cursor plugin connecting to invinoveritas's official remote MCP server (https://api.babyblueviper.com/mcp, Bearer-token auth) for an independent, signed verdict (approve/approve_with_concerns/reject) before an irreversible or high-consequence agent action: a destructive shell command, a production deploy, a merge to main. Advisory only — never blocks, the agent stays fully autonomous and decides.

Why

Most of this ecosystem's own tools already answer "can this agent do X" (authorization/eligibility). This answers a different question: "is this specific action, right now, actually sound" — a judgment call, not a policy lookup. That matters more as agent-driven merge/branch workflows scale past what a human can review per-action; a signed, independently-checkable pre-action verdict is a real second opinion on that path, not a human gate.

What's included

• .cursor-plugin/plugin.json — manifest, IVV_API_KEY variable forwarded via Authorization: Bearer header (same pattern as the github plugin).
• mcp.json — points at the live production MCP endpoint.
• skills/pre-action-review/SKILL.md — teaches the agent when to call review (destructive commands, merges, deploys, migrations — not routine reversible edits) and how to act on the verdict without silently dropping concerns.
• README.md, CHANGELOG.md, LICENSE (MIT), assets/logo.png (256×256).
• Registered in .cursor-plugin/marketplace.json.

Verification

• Real MCP initialize handshake against production, Bearer-authenticated: succeeded.
• Real tools/call for review against production through the exact transport this plugin configures: returned a correct reject verdict with structured, severity-ranked issues on a genuinely destructive test artifact (not a mock).
• plugin.json validated against schemas/plugin.schema.json (jsonschema in Python + inspected by hand).
• node scripts/validate-plugins.mjs — the actual CI check — passes clean locally.
• Free to install and try: POST /register (no payment) → free try-it calls on review before any billing.

Docs

• Live tool list + schemas: https://api.babyblueviper.com/.well-known/mcp/server-card.json
• Free, no-auth proof verification: POST /verify-proof
• Public signed-verdict track record: https://api.babyblueviper.com/ledger

---

Note

Low Risk
Additive marketplace and third-party plugin packaging only; no changes to core app logic, though users configure an external API key and outbound calls to a third-party service.

Overview
Adds a new invinoveritas entry to the official plugin marketplace and ships the full third_party/invinoveritas package so Cursor can call invinoveritas’s remote MCP server for advisory pre-action reviews.

The plugin wires HTTP MCP to https://api.babyblueviper.com/mcp with IVV_API_KEY passed as Authorization: Bearer, matching other third-party remote MCP plugins. It includes manifest, mcp.json, README, changelog, and MIT license.

A bundled pre-action-review skill instructs agents to call review before high-consequence or irreversible actions (destructive commands, merges, deploys, migrations) and to honor reject / approve_with_concerns / approve without hiding concerns; optional signed proofs via verify_proof are documented in the skill.

^{Reviewed by Cursor Bugbot for commit 4d514ed. Bugbot is set up for automated code reviews on this repo. Configure here.}