Add adspirer plugin (MCP server + skills)

[amekala]

What this PR does

New third-party plugin: Adspirer — paid-media management for Grok Build. Create, analyze, and optimize ad campaigns across Google Ads, Meta Ads, TikTok Ads, LinkedIn Ads, Amazon Ads, and ChatGPT Ads through Adspirer's hosted MCP server, with 14 skills, 5 slash commands, and a performance-marketing subagent.

• Plugin name: adspirer
• Type: remote source
• Source URL + pinned SHA: https://github.com/Adspirer/adspirer-grok-plugin.git @ f698b3a4fcbc88f35edf56bf8d6311f6826c71b1
• Homepage: https://www.adspirer.com

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org.

Adspirer/adspirer-grok-plugin is a generated distribution repo under our company org. The upstream source of truth is our public monorepo amekala/ads-mcp (maintainer's account), which also feeds our Claude, Cursor, Codex, Gemini, and ChatGPT distributions. First-party ownership is independently verifiable: the official MCP Registry lists the server under the DNS-verified com.adspirer namespace with that repo as its repository.url.

Checklist

• One entry added to .grok-plugin/marketplace.json, valid JSON, name in kebab-case and unique.
• Remote source pins a full 40-char lowercase commit sha; the commit is public and reachable.
• .grok-plugin/plugin-index.json regenerated and committed.
• homepage + clear description; brand-scoped keywords/domains; category set.
• The plugin is licensed and the license is stated (MIT, in plugin.json and LICENSE).
• I've read Security expectations and the plugin complies.

Ran locally: validate-catalog.py ✓, generate-plugin-index.py ✓, generate-plugin-index.py --check ✓.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege — the plugin ships no hooks, no scripts, no LSP servers; it is skills, commands, one agent definition, and one .mcp.json. Nothing in it executes code on the user's machine.
• Network endpoints this plugin calls (and why): https://mcp.adspirer.com/mcp — the only endpoint; streamable-HTTP MCP server through which all campaign reads/writes go. https://www.adspirer.com appears in prose only (sign-in/docs links), never called by the plugin.
• Credentials/permissions it requires (and why): OAuth 2.1 with PKCE + dynamic client registration (RFC 7591), handled by Grok's MCP client on first connection. No API keys, no local credential files, no env vars. Ad-platform tokens are held server-side, scoped to accounts the user explicitly connects.

Safety posture worth noting for an ads product: all new campaigns are created PAUSED, and no budget change or campaign deletion happens without explicit user approval — this is enforced in the skills and the agent prompt.

Notes for reviewers

• Update flow: the source repo is auto-generated from ads-mcp by a daily sync workflow and only receives a commit when plugin content actually changes — so your nightly SHA bump will see HEAD move exactly when there's a real plugin release, not on unrelated monorepo commits. We intentionally omit version and rely on your bump script's "both lack version → SHA is the identity" path; if you'd prefer a version field, happy to add one.
• category: "marketing" is new to the catalog — closest honest fit for an ads-management plugin. Fine to change if you'd rather slot it elsewhere.
• Keywords/domains are deliberately brand-scoped (adspirer, our domains only) per the contribution guide — no generic ads/google ads terms that could mis-fire the CTA.