Add SharePoint third-party MCP plugin (Microsoft Agent 365, preview)

[SamSokolin]

Summary

Adds third_party/sharepoint, a Cursor marketplace plugin for Microsoft's official Agent 365 Work IQ SharePoint MCP server (mcp_SharePointRemoteServer, preview), and registers it in .cursor-plugin/marketplace.json and the root README table.

Mirrors the layout of third_party/onedrive and third_party/outlook (plugin.json, mcp.json, README, CHANGELOG, LICENSE, logo, same minClientVersions).

Endpoint

Discovered from the Microsoft reference page (https://learn.microsoft.com/en-us/microsoft-agent-365/mcp-server-reference/sharepoint):

https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_SharePointRemoteServer

The server is tenant-scoped and does not support dynamic client registration, so the plugin follows the Salesforce/Zoom pattern of declaring plugin variables instead of hardcoding anything:

• TENANT_ID — Directory (tenant) ID, interpolated into the URL.
• CLIENT_ID — Application (client) ID of a customer-registered Entra public-client app, passed via auth.CLIENT_ID.

No client secret is declared or used (PKCE public client, per Microsoft's coding-agent setup guide). No OAuth scopes are pinned since Microsoft's samples supply only the client ID.

README

• Dedicated SharePoint vs. OneDrive section explaining the gap the existing OneDrive plugin leaves (personal drive only, via Cursor's rest-mcp proxy) and how this plugin covers sites, subsites, team document libraries, SharePoint lists/columns/items, sharing, and sensitivity labels.
• Entra app registration steps with Cursor's redirect URIs, prerequisites (Microsoft 365 Copilot licensing, preview status), the full tool inventory grouped by area (tool names verified against the official page, e.g. moveFileOrFolder), the 5 MB file limit, and a troubleshooting table (including the AADSTS650052 service-principal provisioning issue and Microsoft's Enable-WorkIQToolsForTenant.ps1 fix).

Notes

• The logo is a hand-drawn SharePoint-style mark in SharePoint brand colors (the Fluent brand-icon CDN was not reachable from the build VM). README/CHANGELOG describe it as such rather than claiming it is the official CDN asset.
• node scripts/validate-plugins.mjs passes locally.