Add X Ads third-party MCP plugin

[nathanl-web]

Summary

• Add an X Ads marketplace plugin under third_party/x-ads/, pointing at X's hosted ads MCP server (https://ads-api.x.com/mcp) over Streamable HTTP. It lets agents manage campaigns, create ads, set up pixels and conversion tracking, and pull performance stats.
• This is a new plugin, separate from the existing X plugin: ads-api.x.com is a different OAuth protected resource than api.x.com (see https://ads-api.x.com/.well-known/oauth-protected-resource), with different scopes, so authorization cannot be shared. Users who install both authorize each one separately.
• Auth reuses the same OAuth client ID as the X plugin / X connector (per X's guidance) and requests ads.read, ads.write, media.write, and offline.access (for token refresh, matching the X plugin). The ads MCP server already grants access to this client server-side.
• Register the plugin in .cursor-plugin/marketplace.json and the root README table.

Notes for reviewers

• media.write is included so the creative/media upload tools can work in the future, although we don't currently have that
• Logo reuses the X mark from the X brand toolkit, same tile as the X plugin.

Test plan

• Plugin schema validation passes (node scripts/validate-plugins.mjs)
• Install from Cursor Settings → Plugins or /add-plugin x-ads
• Complete the X OAuth sign-in (separate authorize click from the X plugin)
• Smoke test: list ads accounts, then pull stats for a campaign

---

Note

Low Risk
Adds a new third-party plugin and marketplace listing only; no changes to shared auth or core app logic, though installed users grant ads write access via OAuth.

Overview
Adds a new X Ads integration plugin so agents can talk to X’s hosted ads MCP at https://ads-api.x.com/mcp for campaigns, creatives, pixels/conversions, and performance stats.

The change is mostly net-new under third_party/x-ads/ (manifest, mcp.json, README, changelog, license, logo) with OAuth using the same public client ID as the existing X plugin but ads-specific scopes (ads.read, ads.write, media.write, offline.access) on the separate ads-api.x.com protected resource—so users authorize this plugin independently of the main X plugin. The root marketplace manifest and README integrations table register x-ads alongside existing entries.

^{Reviewed by Cursor Bugbot for commit 164c539. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit d726d67. Configure here.}

[cursor]

Unadvertised Ads OAuth scope

High Severity · Bugbot Rules

media.write is not a vendor-advertised scope for the Ads MCP protected resource. Coverage of ads-api.x.com/mcp lists ads.read, ads.write, and offline.access; media.write is a general X API v2 user-media scope on api.x.com. Requesting an unadvertised scope fails the OAuth grant, so sign-in can break.

Additional Locations (2)

• third_party/x-ads/README.md#L29-L30
• third_party/x-ads/README.md#L57-L58

 

^{Triggered by learned rule: Plugin OAuth scopes must be vendor-advertised}

^{Reviewed by Cursor Bugbot for commit d726d67. Configure here.}

[nathanl-web]

Keeping media.write. The live Ads MCP protected-resource metadata advertises it.

Fetched just now from https://ads-api.x.com/.well-known/oauth-protected-resource (same payload at https://ads-api.x.com/.well-known/oauth-protected-resource/mcp):

{
  "authorization_servers": ["https://api.x.com"],
  "bearer_methods_supported": ["header"],
  "resource": "https://ads-api.x.com/mcp",
  "scopes_supported": ["ads.read", "ads.write", "media.write", "offline.access"]
}

media.write is vendor-advertised on the ads protected resource, not only on api.x.com. (For comparison, https://api.x.com/.well-known/oauth-protected-resource does not list media.write; the ads PRM does.) Leaving the scope in mcp.json so OAuth matches the PRM.