All notable changes to the LeadMagic Cursor plugin package are documented here.
- CI/CD: Concurrency to cancel superseded runs; job
timeout-minutes;workflow_dispatch; npm cache viaactions/setup-node; pinactions/checkoutandactions/setup-nodeto full SHAs (v5tags); drop duplicate README string check (already enforced bynpm run validate). Dependabot weekly updates for GitHub Actions plus npm commit-message prefixes. - Tooling:
.node-versionandpackage.jsonenginesfor Node 22+.
- Security: Add SECURITY.md; expand
.gitignorefor.env*; CIpermissions: contents: read,npm audit --audit-level=high, and Dependabot for npm. - Docs: README restructured (security first, tables, shorter flow); link
LICENSEand security policy.
- Cursor plugin model: Add
agents/leadmagic-enrichment.mdandcommands/(check-credits,research-company,validate-email); wireagentsandcommandsinplugin.jsonto match patterns used by plugins such as encoredev/cursor-plugin. - Validation: Assert agent/command markdown frontmatter; README links to Cursor Plugins docs.
- Docs: README clarifies MCP (Cursor) vs REST (OpenAPI), links leadmagic-openapi and product docs; validator and CI require the OpenAPI repo URL in README.
- Auth: Default
mcp.jsonuses OAuth only (no headers); Cursor signs in with LeadMagic. README documents optionalx-leadmagic-key+${LEADMAGIC_API_KEY}for API-key mode. - CI:
npm run checkruns validate plusverify:healthagainsthttps://mcp.leadmagic.io/health; redundantmcp.jsoninline checks removed (covered by validate).
- MCP: Hosted server at
https://mcp.leadmagic.io/mcp— 10 tools, shared docs resourceleadmagic://docs, promptsaccount_researchandcontact_lookup. - Auth:
mcp.jsonuses headerx-leadmagic-keywith${LEADMAGIC_API_KEY}. - Bundle: Default rule, four skills (contact enrichment, account intelligence, prospect list QA, signal research), validation script, and GitHub Actions CI.
- Docs: README includes data handling and links to privacy, terms, and support;
SUBMISSION.mdmarketplace copy matches the MCP tool surface.