Validate portable and native plugin packaging

.cursor-plugin/plugin.json

@@ -14,5 +14,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcpServers": "./mcp.json"
+  "mcpServers": "./.mcp.json"
 }

mcp.json

@@ -2,7 +2,8 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
   "mcpServers": {
     "polymorfa-docs": {
-      "url": "https://docs.polymorfa.com/mcp"
+      "url": "https://docs.polymorfa.com/mcp",
+      "type": "streamable-http"
     }
   }
 }

scripts/validate.py

@@ -8,3 +8,14 @@
 for filename in ("plugin.json", ".claude-plugin/plugin.json", ".cursor-plugin/plugin.json", "gemini-extension.json"):
     assert json.loads((root / filename).read_text())["version"] == "0.1.0", filename
 print("Manifests and skills validated")
+for filename, transport in [("mcp.json", "streamable-http"), (".mcp.json", "http")]:
+    servers = json.loads((root / filename).read_text())["mcpServers"]
+    assert servers == {"polymorfa-docs": {"type": transport, "url": "https://docs.polymorfa.com/mcp"}}, filename
+for filename in (".claude-plugin/plugin.json", ".cursor-plugin/plugin.json"):
+    manifest = json.loads((root / filename).read_text())
+    for field, kind in (("mcpServers", "file"), ("skills", "directory")):
+        relative = Path(manifest[field])
+        assert not relative.is_absolute() and ".." not in relative.parts, (filename, field)
+        target = (root / relative).resolve()
+        assert target.is_relative_to(root), (filename, field)
+        assert target.is_file() if kind == "file" else target.is_dir(), (filename, field)