Harden and package BeatAPI for Cursor, Grok Bot, and Grok Build

.codex-plugin/plugin.json

@@ -1,14 +1,14 @@
 {
-  "name": "beatapi-codex-plugin",
-  "version": "0.2.0",
-  "description": "Create and manage BeatAPI image, video, Effect, workflow, and realtime APIs from Codex.",
+  "name": "beatapi-agent-plugin",
+  "version": "0.3.0",
+  "description": "Create and manage BeatAPI text, image, video, Effect, workflow, and analysis APIs from Codex.",
   "author": {
     "name": "BeatAPI",
     "email": "support@beatapi.io",
     "url": "https://beatapi.io"
   },
   "homepage": "https://beatapi.io",
-  "repository": "https://github.com/BeatAPI/beatapi-codex-plugin",
+  "repository": "https://github.com/BeatAPI/beatapi-agent-plugin",
   "license": "MIT",
   "keywords": [
     "beatapi",
@@ -18,14 +18,16 @@
     "realtime-video",
     "image-generation",
     "video-generation",
+    "text-generation",
+    "video-analysis",
     "ai-effects"
   ],
   "skills": "./skills/",
   "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "BeatAPI",
-    "shortDescription": "Manage generation, Effects, workflows, and realtime",
-    "longDescription": "Use one existing BeatAPI account and API key from Codex to discover public models and Effects, upload inputs, check USD balance and concurrency, create image, video, Effect, Music Video, and Ecommerce Video tasks, manage short-lived Realtime Video sessions, monitor progress, retrieve hosted results, and configure webhooks.",
+    "shortDescription": "Manage BeatAPI text, media, and workflows",
+    "longDescription": "Use one existing BeatAPI account and API key from Codex to discover models and Effects, create text responses, upload explicitly approved inputs, check USD balance and concurrency, create image, video, Effect, Video Analysis, Music Video, and Ecommerce Video tasks, monitor progress, retrieve hosted results, and manage existing Realtime sessions and webhooks.",
     "developerName": "BeatAPI",
     "category": "Creativity",
     "capabilities": [
@@ -36,13 +38,9 @@
     "privacyPolicyURL": "https://beatapi.io/privacy-policy",
     "termsOfServiceURL": "https://beatapi.io/terms-of-service",
     "defaultPrompt": [
-      "Use $beatapi-video to create a music video from my images and audio.",
-      "Use $beatapi-video to turn my product images into a vertical ad.",
-      "Use $beatapi-video to generate an image with Nano Banana Pro.",
-      "Use $beatapi-video to create a Seedance 2.5 video.",
-      "Use $beatapi-video to list current Effects for this portrait.",
-      "Use $beatapi-video to create a 60-second realtime session for my web app.",
-      "Use $beatapi-video to check my USD balance and task status."
+      "Use $beatapi-video to turn these product images into a vertical ad.",
+      "Use $beatapi-video to list current models, then generate from this prompt.",
+      "Use $beatapi-video to check my balance and the status of task task_...."
     ],
     "brandColor": "#2563FF",
     "composerIcon": "./assets/icon.png",

.cursor-plugin/plugin.json

@@ -0,0 +1,54 @@
+{
+  "name": "beatapi-agent-plugin",
+  "version": "0.3.0",
+  "description": "Use BeatAPI text, image, video, Effects, workflows, and analysis APIs from Cursor and Grok Bot.",
+  "author": {
+    "name": "BeatAPI",
+    "email": "support@beatapi.io"
+  },
+  "homepage": "https://beatapi.io",
+  "repository": "https://github.com/BeatAPI/beatapi-agent-plugin",
+  "license": "MIT",
+  "keywords": [
+    "beatapi",
+    "agent-toolkit",
+    "ai-video",
+    "ai-image",
+    "text-generation",
+    "video-analysis",
+    "grok-bot"
+  ],
+  "logo": "assets/logo.png",
+  "skills": "./skills/",
+  "mcpServers": "./mcp.json",
+  "variables": {
+    "type": "object",
+    "properties": {
+      "BEATAPI_API_KEY": {
+        "type": "string",
+        "title": "BeatAPI API key",
+        "description": "Create a key at https://beatapi.io/dashboard/apikeys. The value is injected into the local MCP server and is never stored in this repository."
+      },
+      "BEATAPI_BASE_URL": {
+        "type": "string",
+        "title": "BeatAPI base URL",
+        "description": "Optional API base URL override. Keep the default unless BeatAPI support gave you another endpoint.",
+        "default": "https://api.beatapi.io"
+      },
+      "BEATAPI_TRUST_CUSTOM_BASE_URL": {
+        "type": "string",
+        "title": "Trust custom API origin",
+        "description": "Leave empty for the official API. Set exactly 1 only when BeatAPI support gave you the custom HTTPS origin above."
+      },
+      "BEATAPI_UPLOAD_ROOTS": {
+        "type": "string",
+        "title": "Approved upload directories",
+        "description": "Optional path-list of directories containing files you explicitly want the plugin to upload. Use colon separators on macOS/Linux and semicolons on Windows."
+      }
+    },
+    "required": [
+      "BEATAPI_API_KEY"
+    ],
+    "additionalProperties": false
+  }
+}

.github/workflows/ci.yml

@@ -11,16 +11,16 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run verify
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: beatapi-plugin-artifacts
           path: |
-            dist/beatapi-codex-plugin-marketplace.zip
+            dist/beatapi-agent-plugin-marketplace.zip
             dist/submission/beatapi-video-skill.zip

.github/workflows/release.yml

@@ -12,15 +12,15 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run verify
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: |
-            dist/beatapi-codex-plugin-marketplace.zip
+            dist/beatapi-agent-plugin-marketplace.zip
             dist/submission/beatapi-video-skill.zip

.grok-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "beatapi-agent-plugin",
+  "version": "0.3.0",
+  "description": "Use BeatAPI text, image, video, Effects, workflows, and analysis APIs from Grok Build.",
+  "author": {
+    "name": "BeatAPI",
+    "url": "https://beatapi.io"
+  },
+  "homepage": "https://beatapi.io",
+  "repository": "https://github.com/BeatAPI/beatapi-agent-plugin",
+  "license": "MIT",
+  "keywords": [
+    "beatapi",
+    "beatapi agent toolkit",
+    "beatapi video",
+    "beatapi image",
+    "beatapi workflows"
+  ],
+  "logo": "./assets/logo.png",
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json"
+}

.mcp.json

@@ -9,10 +9,11 @@
       "env_vars": [
         "BEATAPI_API_KEY",
         "BEATAPI_BASE_URL",
+        "BEATAPI_TRUST_CUSTOM_BASE_URL",
         "BEATAPI_CLI_PATH",
-        "CODEX_HOME"
+        "BEATAPI_UPLOAD_ROOTS"
       ],
-      "tool_timeout_sec": 900
+      "tool_timeout_sec": 4500
     }
   }
 }

CHANGELOG.md

@@ -2,16 +2,26 @@
 
 ## Unreleased
 
+- Renamed the repository and package to `beatapi-agent-plugin`.
+- Added a Cursor/Grok Bot manifest and root `mcp.json` alongside the existing
+  Codex manifest, sharing the same Skill and MCP runtime.
+- Declared `BEATAPI_API_KEY` as a required Cursor plugin variable so users bind
+  it through Plugins → Configure instead of chat or repository files.
 - Added MCP tools for text-model discovery, non-streaming text responses,
   generation-model discovery, generic image/video generation, versioned
   Effects, and Video Analysis.
 - Synchronized the canonical Skill, typed client runtime, and OpenAPI snapshot
-  with the complete 29-operation contract and USD-denominated usage semantics.
+  with the complete 30-operation contract and USD-denominated usage semantics.
 - Replaced hardcoded image/video model unions with a stable `model` plus
   `parameters` interface so newly published model IDs do not require a plugin
   release.
 - Added host Configure guidance for `BEATAPI_API_KEY` and kept credentials out
   of tool arguments and model-visible results.
+- Confined uploads to configured trusted roots, rejected credential material in
+  open-ended parameters, validated custom API origins, reduced CLI environment
+  inheritance, and pinned release workflow dependencies.
+- Removed Realtime-session and webhook creation from agent-visible surfaces
+  until hosts provide an opaque secret broker.
 
 ## 0.2.0 - 2026-07-31