Add Docusign third-party MCP plugin

[roshansada]

Docusign MCP requires a confidential OAuth Integration Key and Secret, plus a demo or production Streamable HTTP URL, so the plugin declares DOCUSIGN_MCP_URL, CLIENT_ID, and CLIENT_SECRET variables.

---

Note

Low Risk
Additive third-party plugin and manifest/docs only; no changes to core app logic, though agents could act on live Docusign data once users connect OAuth.

Overview
Adds a new docusign marketplace plugin under third_party/docusign/ so Cursor agents can use Docusign’s official remote MCP server (beta) for eSignature envelopes/templates, Maestro workflows, and Navigator agreements.

The plugin registers CLIENT_ID and CLIENT_SECRET (Integration Key + Secret Key) as required configure-time variables and passes them through HTTP MCP auth to https://mcp.docusign.com/mcp. Root .cursor-plugin/marketplace.json and the root README.md plugin table are updated to list it alongside other integrations.

Shipped with the usual plugin scaffolding: plugin.json, mcp.json, README (OAuth confidential app setup, redirect URIs, demo URL override via mcp-d.docusign.com), CHANGELOG, and MIT LICENSE. The PR description’s DOCUSIGN_MCP_URL variable is not in the diff—production URL is fixed in mcp.json, with demo documented as a post-install URL change only.

^{Reviewed by Cursor Bugbot for commit f290d82. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Missing MCP URL variable
  • Restored the required DOCUSIGN_MCP_URL plugin variable (reverting the commit that hardcoded the production URL) so demo/developer accounts can select https://mcp-d.docusign.com/mcp at configure time, with plugin.json, mcp.json, README, and changelog updated consistently.

Or push these changes by commenting:

@cursor push d295aa6056

Preview (d295aa6056)

diff --git a/third_party/docusign/.cursor-plugin/plugin.json b/third_party/docusign/.cursor-plugin/plugin.json
--- a/third_party/docusign/.cursor-plugin/plugin.json
+++ b/third_party/docusign/.cursor-plugin/plugin.json
@@ -29,6 +29,11 @@
   "variables": {
     "type": "object",
     "properties": {
+      "DOCUSIGN_MCP_URL": {
+        "type": "string",
+        "title": "Docusign MCP server URL",
+        "description": "Demo (developer accounts): https://mcp-d.docusign.com/mcp — Production: https://mcp.docusign.com/mcp"
+      },
       "CLIENT_ID": {
         "type": "string",
         "title": "Docusign Integration Key",
@@ -41,6 +46,7 @@
       }
     },
     "required": [
+      "DOCUSIGN_MCP_URL",
       "CLIENT_ID",
       "CLIENT_SECRET"
     ]

diff --git a/third_party/docusign/CHANGELOG.md b/third_party/docusign/CHANGELOG.md
--- a/third_party/docusign/CHANGELOG.md
+++ b/third_party/docusign/CHANGELOG.md
@@ -5,5 +5,5 @@
 ## 1.0.0 — initial release
 
 - Logo: Docusign's developer-center app icon.
-- Added the `docusign` MCP server pointing at `https://mcp.docusign.com/mcp`.
-- Declared `CLIENT_ID` and `CLIENT_SECRET` plugin variables and forwarded them through MCP auth.
+- Added the `docusign` MCP server with a configurable demo/production URL.
+- Declared `DOCUSIGN_MCP_URL`, `CLIENT_ID`, and `CLIENT_SECRET` plugin variables and forwarded credentials through MCP auth.

diff --git a/third_party/docusign/README.md b/third_party/docusign/README.md
--- a/third_party/docusign/README.md
+++ b/third_party/docusign/README.md
@@ -8,7 +8,7 @@
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Docusign**.
-3. Click **Install**, then set the Integration Key and Secret Key (below) and complete the Docusign sign-in prompt.
+3. Click **Install**, then set the MCP URL, Integration Key, and Secret Key (below) and complete the Docusign sign-in prompt.
 
 Or run `/add-plugin docusign` in chat.
 
@@ -19,7 +19,7 @@
   "mcpServers": {
     "docusign": {
       "type": "http",
-      "url": "https://mcp.docusign.com/mcp",
+      "url": "${DOCUSIGN_MCP_URL}",
       "auth": {
         "CLIENT_ID": "${CLIENT_ID}",
         "CLIENT_SECRET": "${CLIENT_SECRET}"
@@ -33,29 +33,28 @@
 
 Docusign MCP requires a confidential OAuth app (Authorization Code Grant). Create an Integration Key before anyone can connect.
 
-1. Sign in to your [Docusign account](https://www.docusign.com/) (or [developer account](https://developers.docusign.com/)) and open **Settings → Apps and Keys**.
+1. Sign in to your [Docusign developer account](https://developers.docusign.com/) (or production admin account) and open **Settings → Apps and Keys**.
 2. Add an app, copy the **Integration Key**, and generate a **Secret Key**.
 3. Register both redirect URIs on that app:
    - Desktop: `http://localhost:8787/callback`
    - Web and Cloud Agents: `https://www.cursor.com/agents/mcp/oauth/callback`
-4. In **Dashboard → Plugins → Configure**, set **Docusign Integration Key** and **Docusign Secret Key** from that app.
+4. In **Dashboard → Plugins → Configure**, set:
+   - **Docusign MCP server URL** — demo or production (table below)
+   - **Docusign Integration Key** and **Docusign Secret Key** from that app
 5. Complete the Docusign OAuth login when Cursor prompts.
 
-On a team marketplace an admin can set the credentials once for everyone; each member still completes their own Docusign OAuth login, so tool calls run with that member's permissions.
-
-## Demo vs production
-
-This plugin points at the production MCP URL. For developer/demo accounts, change the `url` in `mcp.json` to `https://mcp-d.docusign.com/mcp` after install.
-
 | Environment | URL |
 | --- | --- |
-| Production (default) | `https://mcp.docusign.com/mcp` |
 | Demo (developer accounts) | `https://mcp-d.docusign.com/mcp` |
+| Production | `https://mcp.docusign.com/mcp` |
 
+On a team marketplace an admin can set the URL and credentials once for everyone; each member still completes their own Docusign OAuth login, so tool calls run with that member's permissions.
+
 ## Notes
 
 - The MCP server is in beta. Expect changes as Docusign adds tools and refines the surface.
 - Only **Confidential Authorization Code Grant** tokens are supported — not JWT, Implicit, or Public Authorization Code Grant.
+- Match the MCP URL to the account type: use the demo URL with developer/demo accounts and the production URL with production accounts.
 
 ## Docs
 

diff --git a/third_party/docusign/mcp.json b/third_party/docusign/mcp.json
--- a/third_party/docusign/mcp.json
+++ b/third_party/docusign/mcp.json
@@ -2,7 +2,7 @@
   "mcpServers": {
     "docusign": {
       "type": "http",
-      "url": "https://mcp.docusign.com/mcp",
+      "url": "${DOCUSIGN_MCP_URL}",
       "auth": {
         "CLIENT_ID": "${CLIENT_ID}",
         "CLIENT_SECRET": "${CLIENT_SECRET}"

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit f290d82. Configure here.}

[cursor]

Missing MCP URL variable

Medium Severity · Logic Bug

The PR description says the plugin declares DOCUSIGN_MCP_URL alongside CLIENT_ID and CLIENT_SECRET, but plugin.json only exposes the OAuth credentials and mcp.json hardcodes the production URL. Demo/developer accounts need https://mcp-d.docusign.com/mcp, and without a configure-time URL variable (Salesforce’s SALESFORCE_MCP_URL pattern) those users cannot select the demo endpoint through plugin configuration—especially on team marketplaces where post-install mcp.json edits are not a reliable path.

Additional Locations (2)

• third_party/docusign/mcp.json#L4-L5
• third_party/docusign/README.md#L45-L53

 

^{Reviewed by Cursor Bugbot for commit f290d82. Configure here.}