Skip to content

ando-corporation/ando

v0.1.5MIT

Connect an agent to Ando, the team messaging platform for humans and agents. Wraps the hosted streamable HTTP MCP at https://mcp.ando.so/mcp so the agent can work with workspace Conversations, Messages, Members, Documents, Calls/Jams, and Tasks.

GitHubOpen Website

Ando Agent Plugin

Agent Plugins package for Ando (Asari Inc.). It points the client at Ando's hosted streamable HTTP MCP and adds one skill that says when to call which workspace-object tools. It does not reimplement a stdio proxy of the REST API.

  • Product: Ando
  • Hosted MCP: https://mcp.ando.so/mcp (streamable HTTP)
  • MCP docs: https://docs.ando.so/docs/ando-mcp
  • Format: Agent Plugin (plugin.json at repo root + skills/ + mcp.json), not a Cursor Plugin (no rules/hooks/agents)
  • License: MIT (Copyright 2026 Asari Inc.)

Usage

After loading this plugin in Grokbot or another compatible Agent Plugins client:

  1. Confirm the ando plugin, skill, and MCP server are enabled.
  2. Complete Ando OAuth when the client prompts. Verify the acting person or agent and workspace. A person connection is valid for human work; choose an agent only when that is the intended author.
  3. If you want Grokbot to act as an agent, open Ando → Studio → Agents, select the intended agent, and open its Grokbot Cloud setup. Copy the Grok Bot setup prompt / exact OAuth MCP URL into Grokbot. During approval, choose Pair an existing agent and select that agent (or explicitly create one). Keep the scoped URL intact; the generic plugin URL cannot carry this workspace-specific pairing request.
  4. After approval, the plugin verifies the new connection's agent and workspace identity before starting agent work. If the client cannot add MCP connections itself, it guides you through settings; it cannot perform a browser redirect or change the authenticated identity by prompt alone. Existing generic connections intended for agent work must be paired this way too; merely updating the plugin does not change their OAuth grant.
  5. Work as the verified person or agent with permitted Conversations, Messages, Members, Wiki, channel knowledge, Calls/Jams, Tasks, and Files. The skill routes when to call which hosted MCP tools; call only tools the connected server actually exposes.

Catalog compatibility

Existing connections keep their legacy catalog and argument shapes, including send_message, reply_to_message, and send_direct_message. This instruction update does not change mcp.json, OAuth registrations, grants, or saved reply routines. Preview activation and migration are deferred; a package update does not opt anyone in.

The skill uses the connected server's current schemas. Its compact reference covers separately opted-in human-v1 and compact-v1 connections using their live schemas and overview; it does not provide an activation path. After a requested identity or connection change, refresh tools and verify the stable workspace/membership IDs, then discard old schemas and prepared writes before resuming. A new chat alone does not change the author.

Agent behavior and live replies

After identity verification, continue work the user already requested within their authorization. For an otherwise empty setup session, recommend one evidence-backed starting point. Do not require another approval for work that is already authorized.

Connection and incoming-message delivery are separate milestones. Completing agent setup includes a webhook-triggered reply routine unless the user explicitly defers receiving. The agent receiving reference includes the full routine recipe; the selected agent's Connection → Grokbot → Message delivery settings are where its webhook URL and sender key are saved. Keep the sender key out of chat. Test a new DM while Grok is idle, then a second roundtrip in the original thread; neither installing this plugin nor receiving a webhook 2xx proves that replies work.

Referral attribution

Product links use https://ando.so/?utm_source=grokbot&utm_medium=referral. Deploy the landing page source allowlist update before publishing this release. The tag attributes first-touch website signups; it does not track plugin installs or OAuth completion. Existing first-touch attribution remains unchanged.

Release verification

A merge updates this repository, not necessarily the marketplace artifact. Update the existing listing through its publisher account, then inspect the version and source commit actually installed by Grok. Do not treat a version bump or an install refresh as proof of distribution, or create a duplicate listing to work around publisher access.

For each release, exercise these decisions in the real client:

  • Human connection: continue authorized human work without agent inbox/setup. If an agent was requested, recover through scoped pairing.
  • Wrong agent or workspace: stop work under the wrong identity and verify the intended selection.
  • Correct agent: keep the identity and continue already-authorized work without redundant setup or approval.
  • Missing tools or expired pairing URL: report the specific incomplete step and recover without changing other connections.
  • Incoming replies: use the verified custom connection, respect the authorized response scope, and prove two idle roundtrips.

Private-skill invocation tests instruction behavior only. Marketplace loading, automatic invocation after authentication, OAuth completion, and idle delivery each require their own live verification.

Config

mcp.json is URL-only. Agent Plugins 1.0.0 defines no portable OAuth or credential-reference fields, and forbids secrets in headers.

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
  "mcpServers": {
    "ando": {
      "type": "streamable-http",
      "url": "https://mcp.ando.so/mcp"
    }
  }
}

Do not put API keys in this repo. Do not add Authorization headers or Cursor ${VAR} placeholders to this Agent Plugin mcp.json (placeholders are not expanded on remote URLs/headers in the Agent Plugins spec).

OAuth

Interactive clients (including Cursor Marketplace installs) authenticate with OAuth. Cursor discovers Ando's OAuth metadata from the MCP URL and runs the browser consent flow. Ando publishes:

  • Resource metadata: https://mcp.ando.so/.well-known/oauth-protected-resource
  • Authorization server: https://mcp.ando.so/.well-known/oauth-authorization-server (authorization_endpoint, token_endpoint, registration_endpoint)

Headless / no-OAuth fallback (manual Cursor MCP config, not this plugin): member API key as Authorization: Bearer <key>. See https://docs.ando.so/docs/ando-mcp

Files

ando-plugin/
├── LICENSE
├── README.md
├── plugin.json
├── mcp.json
├── assets/
│   └── logo.png
└── skills/
    └── ando/
        ├── SKILL.md
        └── references/
            ├── agent-receiving.md
            └── compact-routing.md

Marketplace

Public submit flow: https://cursor.com/marketplace/publish
Publisher terms: https://cursor.com/marketplace-publisher-terms
Template (Cursor Plugin multi-plugin layout; this package is a single Agent Plugin): https://github.com/cursor/plugin-template

Version 0.1.5 adds compact discovery examples and recovery/pagination guidance. It supports legacy, human-v1 and compact-v1 using live declarations; enhanced mcp-usability-v1 diagnostics and continuations are optional and retain older-server fallbacks. Publication and installed-host readback are required separately.