feat(third_party): add Workday plugin

[djiang-jq]

Adds workday to the marketplace. It follows the same pattern as quickbooks-online (#512): a metadata-only plugin that gates a Cursor-hosted built-in MCP server backed by a Merge Agent Handler connector.

Why there is no mcp.json

Workday is served by Cursor as a built-in MCP server (Merge Agent Handler's workday connector). The backend offers that server only to callers who have a plugin with a matching name installed from a global marketplace, so this manifest carries metadata and a logo and nothing else.

• name must stay exactly workday. It is the join key the backend matches against the connector's marketplacePluginName. Renaming it silently turns the connector off.
• The gate only honors global marketplaces, so this has to land in cursor-public to have any effect.

Backend dependency

This plugin has no effect until the backend registers the connector. MERGE_CONNECTORS in backend/server/src/mcp/merge/connectors.ts currently holds only QuickBooks Online; Workday needs an entry like:

{
  id: "workday",
  displayName: "Workday",
  mergeConnectorSlug: "workday",
  builtinServerId: -2001,
  marketplacePluginName: "workday",
}

plus "workday": { "enabled": true } in the merge_connector_settings Statsig config. Landing this plugin first is harmless: with no matching connector, nothing is offered.

Contents

File
.cursor-plugin/plugin.json	Manifest. No mcpServers, no variables — auth is Cursor-managed OAuth.
assets/logo.png	Official Workday mark, 192×192 RGBA (repo convention).
README.md	Explains the missing mcp.json up front; capability table mirrors Merge's Workday tool categories.
CHANGELOG.md, LICENSE	Standard, matching siblings.

Plus the usual two registry edits: an entry in .cursor-plugin/marketplace.json and a row in the root README.md table.

Logo provenance

Avatar of the official Workday GitHub organization (github.com/Workday.png), resized 400→192 and converted to RGBA. Same sourcing approach as Xero's.

Things I could not verify — please check

1. Merge application credential. QuickBooks sets applicationCredentialExternalId: "grok". I don't know whether a Workday OAuth credential exists in Merge yet, so the backend snippet above leaves it unset (Merge default).
2. Admin approval wording. The README says a Workday administrator may need to approve the connection if the tenant restricts API clients. That is a hedge; I have not run Merge's sign-in flow against a real tenant.
3. Description is read-oriented ("Look up…"). Merge's Workday connector also exposes write tools (create/update workers, request time off, payroll inputs). If the tool pack is not restricted to reads, the description and README should be widened.
4. minClientVersions.cursor is 3.19.0, copied from quickbooks-online, with the same open question about which client release supports Cursor-hosted built-in connectors.

Validation

npm install --no-save ajv ajv-formats && node scripts/validate-plugins.mjs → All plugins validated successfully.

Opened as a draft pending the confirmations above.

---

Note

Low Risk
Repo-only marketplace metadata and documentation with no runtime or auth code; connector behavior and sensitive HR data access depend on separate backend rollout.

Overview
Adds a new workday integration to the official marketplace, following the same metadata-only pattern as QuickBooks Online: manifest, docs, logo, and registry rows—no mcp.json, because the MCP server is Cursor-hosted and gated by installing a plugin whose name must stay workday.

Registers the plugin in .cursor-plugin/marketplace.json and the root README.md plugin table. Under third_party/workday/, ships plugin.json (integrations category, Cursor-managed OAuth, minClientVersions.cursor 3.19.0), plus README (install, capabilities for workers/org/time off/payroll/recruiting/WQL), CHANGELOG, and MIT LICENSE.

Until the backend registers the Merge Workday connector and enables it in config, installing the plugin has no effect; landing this first is safe.

^{Reviewed by Cursor Bugbot for commit 6060c2c. Bugbot is set up for automated code reviews on this repo. Configure here.}