[rudycelekli]

Plain ${VAR} references in MCP configuration currently pass validation even when the plugin has no matching variables.properties declaration. A typo can therefore ship through the marketplace validator and leave a required connection token unconfigurable.

Validate placeholders in default mcp.json, explicitly referenced files, inline configurations and mixed arrays. Preserve Cursor runtime interpolation (${env:NAME}, workspace/home/path values and plugin roots), as well as existing shell/default expressions. Report missing or invalid MCP files with plugin context.

Refs #531 (MCP variable declaration portion only). This does not duplicate the path/trigger work in #582 or the dependency/frontmatter/unlisted-directory/script-package work in #618; these touch the same validator and may require rebasing.

Validation: node --test scripts/validate-plugins.test.mjs passes all 12 tests; the same tests against current main fail 8 and pass 4. Both main and this candidate validate all 104 current marketplace plugins successfully. Tests exercise actual validator subprocesses, including declared variables, builtins, explicit discovery overrides and absent MCP configurations.

Run validation on every PR so edits to referenced MCP configuration files also receive checks, and run the new regression suite in CI. This trigger change overlaps #582; the validator and workflow will need a rebase if #582 or #618 lands first. Windows fixtures use directory junctions.

---

Note

Low Risk
Changes are limited to marketplace validation scripts and CI; no runtime plugin or MCP behavior is modified.

Overview
Plugin validation now enforces that plain ${VAR} placeholders in MCP configs are declared in variables.properties, so typos or missing declarations fail CI instead of shipping broken connection settings.

validate-plugins.mjs walks MCP configuration whether it comes from default mcp.json, explicit file paths, inline objects, or mixed arrays. It flags undeclared identifier-style variables while still allowing Cursor runtime tokens (CURSOR_PLUGIN_ROOT, workspace/home/path helpers), ${env:…}, and shell/default forms. Missing or invalid MCP JSON files are reported with plugin name and path context.

A new scripts/validate-plugins.test.mjs suite runs the validator in isolated temp fixtures (12 cases), and .github/workflows/validate-plugins.yml runs those tests before the full marketplace validation step.

^{Reviewed by Cursor Bugbot for commit d66927e. Bugbot is set up for automated code reviews on this repo. Configure here.}