Grok Bot

Lesson 6

Grok Bot plugins first, browser as fallback

Grok Bot’s integration surface is called Plugins in the app and co-locates connectors, MCP, and packaged skills. Official computer docs are clear: prefer a connector when one exists — usually more stable than clicking the web; use the cloud browser when there is no connector or when a visual flow is not exposed. Cursor Help Connect plugins: sidebar Plugins, or a Connect card in chat; on phone tap the top-left avatar then Plugins. Authorization finishes in the browser; if you see Waiting for authorization, use Reopen to bring the tab back. The Cursor account relationship — login, usage, inherited marketplace — is on Cursor and Grok Bot.

Installed connectors are account-level, not isolated to one Bot. MindStudio also observed: authorize GitHub for one Bot and later Bots can use it. Team admins can disable marketplace plugins in Cursor Teams; you then see Disabled by team admin.

Do not put secrets in chat or ordinary files. Use the official secrets card. xai-org/plugin-marketplace is the .grok-plugin marketplace Grok Bot inherits under Cursor’s plugin policy. High-star packs with a documented Grok Bot install path sit on use cases → Skills — Compound Engineering installs in the Cursor marketplace; do not clone it onto the Bot computer. Skip 0–1★ “195 SKILL.md” dumps.

Remote MCP — not stdio on your laptop

Staff confirmed: Grok Bot cannot attach local or stdio MCP; use remote HTTP MCP or the cloud browser. There is no “custom connector” settings form — ask the Bot in chat to add an MCP server (public HTTPS streamable HTTP/SSE), confirm details, and new tools appear from the next message. An MCP that only listens on localhost on your PC is unreachable from the cloud computer.

Auth that was still broken at fetch time (still documented in Help)

  • Zoom error 4700: the catalog Zoom plugin hard-codes the callback as http://localhost:8787/callback; Zoom rejects it. Official Help: no workaround — wait for them to remove localhost. Connect plugins
  • Gmail plugin OAuth: staff say the Grok Bot side is broken; authorizing Gmail from Cursor (a different path) shares the connection into Grok Bot. The Gmail connector can also list attachment metadata but not download bytes — use the cloud browser or put files on Drive.
  • Notion Invalid redirect_uri: login state lives on the account, so retry fails; use Re-authenticate instead of Connect.
  • Canva Invalid redirect URI on iOS: app link and web redirect mismatch; connect from desktop and the connector syncs to iPhone.
  • Official X plugin: connect/refresh failures across desktop / Cloud / Grok Bot (including connected with tools=0) — waiting on X-side app config fixes.
  • GitHub “connected” but Authorization header badly formatted: long-press the account → Remove → sign in again.

Drive MCP is file-level only; to edit Google Doc body or Sheet cells, use the separate Docs / Sheets connectors added from the marketplace under the same Google account.

Common misconceptions

  • Treating Slack event wakeups as “installing Grok Bot as a Slack App.” The awesome list has a dedicated note separating those.
  • Installing a company VPN client on the Bot computer. Staff warn: the cloud computer cannot join enterprise VPN today; bad installs can take the box offline. For internal sites use Execution on Local Computer on a machine already on VPN, or Team Setup docs (Tailscale / Cloudflare Tunnel).
  • Installing every marketplace plugin. Connect only what the workflow needs; prefer read-only service accounts when possible.

More plugins make weekly usage and approval rules the main topic — cost, spillover, and approval pitfalls.