Add Navan plugin (third_party/navan)

.cursor-plugin/marketplace.json

@@ -154,6 +154,11 @@
       "name": "docusign",
       "source": "third_party/docusign",
       "description": "Connect Cursor to Docusign — work with eSignature envelopes and templates, Maestro workflows, and Navigator agreements — via Docusign's official remote MCP server (beta)."
+    },
+    {
+      "name": "navan",
+      "source": "third_party/navan",
+      "description": "Connect Cursor to Navan — query expenses, analyze travel bookings, check policies and approvals, and manage cards — via Navan's official remote MCP server."
     }
   ]
 }

README.md

@@ -29,6 +29,7 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc
 | `circleback` | [Circleback](third_party/circleback/) | Cursor | Integrations | Connect Cursor to Circleback — search meetings, transcripts, action items, calendar events, and emails, and look up people and companies — via Circleback's official remote MCP server. |
 | `docusign` | [Docusign](third_party/docusign/) | Cursor | Integrations | Connect Cursor to Docusign — work with eSignature envelopes and templates, Maestro workflows, and Navigator agreements — via Docusign's official remote MCP server (beta). |
 | `x` | [X](third_party/x/) | Cursor | Integrations | Read-only access to the X API — search posts and users, read timelines and mentions, and pull trends and news — via X's official hosted MCP server. |
+| `navan` | [Navan](third_party/navan/) | Cursor | Integrations | Connect Cursor to Navan — query expenses, analyze travel bookings, check policies and approvals, and manage cards — via Navan's official remote MCP server. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest).
 
 ## Repository structure

third_party/navan/.cursor-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "navan",
+  "displayName": "Navan",
+  "version": "1.0.0",
+  "minClientVersions": {
+    "cursor": "3.13.0"
+  },
+  "description": "Connect Cursor to Navan — query expenses, analyze travel bookings, check policies and approvals, and manage cards — via Navan's official remote MCP server.",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://developer.navan.com/mcp/",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "logo": "assets/logo.png",
+  "keywords": [
+    "navan",
+    "mcp",
+    "travel",
+    "expenses",
+    "spend",
+    "corporate-cards",
+    "bookings"
+  ],
+  "category": "integrations",
+  "tags": [
+    "navan",
+    "travel",
+    "expenses",
+    "mcp"
+  ],
+  "mcpServers": "./mcp.json"
+}

third_party/navan/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+All notable changes to this plugin will be documented here.
+
+## 1.0.0 — initial release
+
+- Logo: Navan brand mark (white "n" on purple tile).
+- Added the `navan` MCP server pointing at `https://mcp.navan.com/mcp`.

third_party/navan/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

third_party/navan/README.md

@@ -0,0 +1,54 @@
+# Navan
+
+Cursor plugin that connects agents to [Navan](https://navan.com) through Navan's official remote [Model Context Protocol](https://modelcontextprotocol.io/) server.
+
+Query expenses and spend trends, analyze travel bookings across flights, hotels, and ground transport, ask about policies, approval flows, and flag/decline reasons, and look up card details for the signed-in Navan user.
+
+## Prerequisite
+
+A Navan admin must enable MCP for your organization first: **Navan → Configuration → Integrations → MCP** and toggle it on. Until then, connections from any MCP client will fail.
+
+## Install
+
+1. Open **Cursor Settings → Plugins**.
+2. Search for **Navan**.
+3. Click **Install**, then complete the Navan SSO sign-in prompt.
+
+Or run `/add-plugin navan` in chat.
+
+## MCP
+
+```json
+{
+  "mcpServers": {
+    "navan": {
+      "type": "http",
+      "url": "https://mcp.navan.com/mcp"
+    }
+  }
+}
+```
+
+Auth is OAuth 2.0 against Navan's standard SSO login. The first request opens a browser window to sign in and approve scopes — there is no API key or client ID to configure. Sessions refresh automatically while in use; sign in again after 100 days of inactivity or 365 days since authentication.
+
+## Notes
+
+- Tool calls run under the signed-in user's context and role (Employee, Manager, Approver, Finance Admin) and cannot exceed that user's Navan permissions.
+- Queries for data the user is not authorized to see return an empty result with a `403_BY_POLICY` annotation rather than leaking data.
+- The server cannot bypass approval workflows, policy rules, or duplicate detection, and cannot escalate privileges.
+- Every tool call is logged in Navan's audit trail with the user identity, client name/version, tool arguments, and response status.
+- Keep payloads lean: pass specific date ranges, filter to the fields you need, and prefer summary tools (e.g. `summarize_spend`) before drilling into raw rows.
+- Navan MCP is not intended for high-volume or scheduled workloads — use the [Navan REST API](https://developer.navan.com/) for those.
+
+## Verify
+
+Once connected, ask the agent:
+
+> "Use Navan to list my five most recent expenses."
+
+A correctly connected client returns a structured table within a few seconds. If you see a permission prompt, approve it — that is Navan's scoped-consent flow.
+
+## Docs
+
+- Navan MCP guide: https://developer.navan.com/mcp/
+- Server URL: https://mcp.navan.com/mcp

third_party/navan/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "navan": {
+      "type": "http",
+      "url": "https://mcp.navan.com/mcp"
+    }
+  }
+}