feat(third_party): add Google Cloud BigQuery plugin - #355

Summary

• Add Google Cloud BigQuery as a third_party/ marketplace plugin, in the Attio (Add Attio third-party MCP plugin #339) / Hunter (Add Hunter third-party MCP plugin (API key header auth) #340) shape.
• One of nine hosted-MCP connectors that grok.com offers publicly (GrowthBook visibility all) and the Cursor marketplace does not. The server URL matches Grok's production connector_catalog.mcp_server_url.
• Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
• Rebased directly onto main; no longer stacked on feat(third_party): add Coinbase plugin #354.

MCP

{
  "mcpServers": {
    "google-cloud-bigquery": {
      "type": "http",
      "url": "https://bigquery.googleapis.com/mcp"
    }
  }
}

Stack

Split from #345 into one PR per plugin. #347–#353 are merged. This PR was originally stacked on coinbase #354 but is now independent and based on main; #354 can land on its own schedule.

Test plan

• node scripts/validate-plugins.mjs passes on this branch
• Endpoint probed for OAuth discoverability and dynamic client registration; the auth shape above is what the server actually supports
• README has Install / MCP / Before you connect / What agents can do / Notes / Docs / License, with capabilities sourced from vendor docs
• marketplace.json, plugin.json, and README table descriptions are identical
• Logo visually reviewed at 192×192
• Install from Cursor Settings → Plugins, complete sign-in, and smoke test list_dataset_ids

Notes

• Backend dependency landed: anysphere/everysphere #1042504 merged 2026-09-11 (d394e3cfc). It adds bigquery.googleapis.com to MCP_OAUTH_PROVIDER_POLICIES so the backend folds in the pre-registered Google client with scope https://www.googleapis.com/auth/bigquery (the scope Google's BigQuery API and MCP docs specify; there is no BigQuery-specific read-only scope). Sign-in only works once the marketplace2 backend service is deployed at or past that commit; confirm the deploy before announcing the plugin.
• Consent-screen verification of auth/bigquery on cursor-gws-prod should be confirmed; unverified, Cursor-surface users see Google's interstitial. The Grok GCP project already requests this scope for its BigQuery connector.
• Grok also offers BigQuery with service-identity auth; this plugin configures only the user OAuth flow, same as gmail.