[steevepay]

What this PR does

Adds the Carbone plugin (new plugin).

• Plugin name: carbone
• Type: remote source
• Source URL + pinned SHA: https://github.com/carboneio/carbone-agent-plugin.git @ 6e8c805daf42f4583dee6e8f46271a9da8e85893 (release v2.0.0)
• Homepage: https://github.com/carboneio/carbone-agent-plugin

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated (Apache-2.0).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): https://mcp.carbone.io, Carbone's hosted remote MCP server (Streamable HTTP), to render, convert and store documents with the user's Carbone account. The pluginhas no hooks, scripts or local server.
• Credentials/permissions it requires (and why): OAuth 2.1 sign-in with the user's Carbone account at account.carbone.io (dynamic client registration). No API key is stored in the plugin.

Notes for reviewers

The plugin contains one skill (skills/carbone, the Carbone templating language) and one remote MCP server (.mcp.json). Carbone is a document generation engine (carbone.io); the repository is maintained by the Carbone team.