Add Statsig third-party MCP plugin

[SamSokolin]

Resolves EXTY-1504

Packages Statsig's official hosted MCP server as a third_party marketplace plugin, following the same OAuth URL-only HTTP pattern as Attio (#339 / third_party/attio).

What's added

• third_party/statsig/
  • .cursor-plugin/plugin.json — name statsig, display name Statsig, category integrations, points mcpServers at ./mcp.json.
  • mcp.json — single http server at https://api.statsig.com/v1/mcp (the URL from Statsig's docs; no headers, no env).
  • README.md, CHANGELOG.md, LICENSE (MIT, matching sibling plugins).
  • assets/logo.png — Statsig's official mark, 192×192 PNG from the statsig-io GitHub organization avatar.
• Registered in .cursor-plugin/marketplace.json and the root README.md plugins table (appended after excalidraw, same convention as the other recent additions).

Packaging notes

• OAuth only. Statsig's Cursor MCP docs list OAuth as the recommended setup via a bare url entry. The endpoint returns 401 with a WWW-Authenticate header that points at /.well-known/oauth-protected-resource/v1/mcp, and the authorization server advertises PKCE S256 with none client auth, so Cursor's built-in MCP OAuth flow handles login with no client ID.
• Statsig's alternate API-key setup (npx mcp-remote ... --header statsig-api-key:${AUTH_TOKEN}) is a local stdio wrapper and is intentionally not packaged — no variables block, no stdio server, no API-key env template. The plugin README calls this out.
• Statsig's MCP OAuth issues a Personal Console API Key scoped to the user's role, so the org owner must have Personal Console API Key creation enabled for that role. The README's "Before you connect" section documents this prerequisite.

Docs

• Cursor setup: https://docs.statsig.com/integrations/mcp/cursor
• MCP overview / tool list: https://docs.statsig.com/integrations/mcp/overview
• Personal Console API Keys: https://docs.statsig.com/access-management/api-keys

Validation

• node scripts/validate-plugins.mjs → All plugins validated successfully.
• Probed https://api.statsig.com/v1/mcp with an unauthenticated initialize POST → 401 with OAuth protected-resource metadata (confirms the URL is live and OAuth-gated, not API-key-only).

Test plan

1. Install the plugin from this branch (Cursor Settings → Plugins → Statsig, or /add-plugin statsig).
2. When the statsig MCP server connects, complete the Statsig OAuth prompt in the browser (requires Personal Console API Key creation enabled for your role).
3. Confirm the server shows as connected under Tools & Integrations with tools listed.
4. Smoke a read: ask the agent to "list feature gates in my Statsig project" and confirm Get_List_of_Gates returns results; optionally "list active experiments".
5. Revoke the generated Personal Console API Key from the Statsig API keys page and confirm the connection stops working.