feat(plugins): add CentricMem

[zeyu-j]

What this PR does

• Plugin name: centricmem
• Type: remote source
• Source URL + pinned SHA: https://github.com/zeyu-j/centricmem-skill.git @ 299c6f0c32bf7cb32cb70de2bbb87c2f135d8517
• Homepage: https://centricmem.com

Adds the hosted CentricMem librarian Skill to the Grok Build catalog. Agents organise and retrieve Markdown cards over host MCP at https://mem.centricmem.com/mcp. Authentication is a ten-minute /connect?device= page so keys never land in chat.

Local checks:

• python scripts/generate-plugin-index.py
• python scripts/validate-catalog.py
• python scripts/generate-plugin-index.py --check

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

There is no separate GitHub org yet. zeyu-j/centricmem-skill is the canonical public Skill package (same author as centricmem.com / mem.centricmem.com). The private client stays out of this catalog.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python scripts/generate-plugin-index.py).
• python scripts/validate-catalog.py passes locally.
• python scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated.

License: PolyForm-Noncommercial-1.0.0 (stated in .grok-plugin/plugin.json on the pinned commit).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): https://mem.centricmem.com/mcp (Streamable HTTP host MCP) and https://centricmem.com/connect?device= (human-only key entry). Dashboard/login stay on centricmem.com.
• Credentials/permissions it requires (and why): an agent key the human enters on the connect page. Agents must not ask the user to paste keys, tokens, or transcript jsonl into chat.

Notes for reviewers

Keywords/domains are brand-scoped (centricmem, centricmem librarian, centricmem mcp; centricmem.com, mem.centricmem.com). The plugin is a Skill + host MCP client, not a local hub bootstrap.

Made with Cursor

[Copilot]

🟢 Approval recommended

The changes are limited to adding a new pinned-SHA marketplace entry and its corresponding generated index update, with no schema or validation issues evident in the modified JSON.

Pull request overview

Adds the CentricMem remote-source plugin to the Grok Build catalog, including its pinned commit reference and generated index metadata, so it can be discovered and installed from the marketplace.

Changes:

• Added a new centricmem entry to the marketplace catalog with URL source + pinned 40-char SHA, homepage, keywords, and domains.
• Regenerated the plugin index to include centricmem (version + exposed skill metadata).

File summaries

File	Description
.grok-plugin/marketplace.json	Adds the centricmem marketplace listing (URL source pinned to commit SHA, metadata for discovery).
.grok-plugin/plugin-index.json	Adds the generated index entry for centricmem (version and skill component summary).

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zeyu-j]

Copilot had no inline comments. Follow-up pin: Skill 0.21.27 at 284ddb5e02cff752efb6feb4d2702f217d1fb66c (refresh compares metadata.version; agent-neutral install path).