[Pandekh]

Summary

Adds a Devin-native plugin manifest (.devin-plugin/plugin.json) and a short Windsurf / Devin Desktop section to the README, so the PandaDoc plugin can be listed in CognitionAI/devin-marketplace with proper metadata.

Changes

• .devin-plugin/plugin.json (new): name pandadoc, displayName PandaDoc, logo assets/pd-logo_400x400.png (existing 400×400 PNG, plugin-relative path), one-sentence description and a 35-character shortDescription, homepage, repository, license, keywords, skills: "skills", and the hosted server inline as mcpServers.pandadoc.url = https://mcp.pandadoc.com/v1/mcp (OAuth, no credentials). version is 1.0.3, equal to .claude-plugin/plugin.json.
• scripts/bump-plugin-version.mjs: adds .devin-plugin/plugin.json to MANIFESTS, so the release chore keeps its version in sync with the other manifests.
• README.md: new Windsurf / Devin Desktop section after Cursor (install with devin plugins install PandaDoc/mcp-server-guide, OAuth sign-in on first use, plus a collapsed manual MCP setup via ~/.config/devin/config.json).

server.json and all other manifests are unchanged.

Why

Devin reads manifests in the order .devin-plugin/plugin.json > .claude-plugin/plugin.json > root plugin.json. Without a Devin manifest, a CognitionAI/devin-marketplace listing would fall back to .claude-plugin/plugin.json, which has no displayName or logo and the generic description "Plugin that includes the PandaDoc MCP server and Skills for common workflows". With this file the listing shows the PandaDoc name, logo, and a proper description.

The server is declared inline (without the Claude-specific "type": "http" from .mcp.json), which also stops Devin from reading the root .mcp.json, so it is declared exactly once. Hooks are not added for Devin: hooks/session-start.mjs is Claude-specific.

Checks

• python3 -m json.tool passes on all changed JSON.
• npx @anthropic-ai/claude-code@latest plugin validate . --strict (the step from sync-release-chores.yml) passes, with the same warning and note as on main.
• node scripts/bump-plugin-version.mjs, run locally against a test skill change, bumps all 7 manifests (including the new one) from 1.0.3 to 1.0.4. The only change to the new file is its version line.
• The manifest meets CognitionAI/devin-marketplace scripts/validate.py rules: the logo path format, the server shape, and the description and shortDescription limits.

Not verified

• Installing the plugin with the Devin CLI (devin plugins install …) and the OAuth sign-in in Devin Desktop have not been tried yet. Both need a signed-in Devin account. The README steps are based on Devin's docs.

Notes

• EU accounts: the plugin is pinned to the global server (mcp.pandadoc.com). The README's existing region table still points EU users to https://mcp.pandadoc.eu/v1/mcp for manual setup. server.json is deliberately left unchanged.
• After merge, the PandaDoc entry in CognitionAI/devin-marketplace must be pinned to the new merge commit SHA on main (currently 9866bd1, which has no .devin-plugin/plugin.json).