Updated logo icon, added names and descriptions to rules

Author: pittolive

.cursor-plugin/plugin.json

@@ -10,7 +10,7 @@
   "homepage": "https://guide.sonatype.com",
   "repository": "https://github.com/sonatype/sonatype-guide-cursor-plugin",
   "license": "MIT",
-  "logo": "assets/avatar.svg",
+  "logo": "assets/Sonatype-guide-icon-reverse.png",
   "keywords": [
     "dependencies",
     "security",

INSTALL_TEST.md

@@ -11,33 +11,26 @@ Use this to run **P0-3** from [SPRINT_PLAN.md](./SPRINT_PLAN.md): confirm the pl
 
 ---
 
-## Option A: Install from GitHub (recommended)
+## Option A: Install from marketplace (only way `/add-plugin` works)
 
-Use this if your plugin repo is on GitHub (e.g. `sonatype/sonatype-guide-cursor-plugin` or your fork).
+**Why `/add-plugin` with a GitHub URL does nothing:** Cursor only installs plugins that are **on the Cursor Marketplace**. Typing `/add-plugin sonatype/sonatype-guide-cursor-plugin` or a GitHub URL gives **no response** because the plugin is not in the marketplace yet.
 
-1. **Push the plugin to GitHub** (if not already):
-   - Create a repo and push this project.
-   - Repo root must contain `.cursor-plugin/plugin.json`, `skills/`, `rules/`, `agents/`, `mcp.json`, etc.
+**To make the plugin installable:**
 
-2. **In Cursor:**
-   - Open **Settings** (Cmd+,) → **Plugins** (or **Cursor Settings** → **Plugins**).
-   - Use **Add plugin** / **Install plugin**.
-   - Enter the GitHub URL, e.g.:
-     - `https://github.com/sonatype/sonatype-guide-cursor-plugin`, or
-     - `sonatype/sonatype-guide-cursor-plugin`
-   - If Cursor chat supports `/add-plugin`, you can try:
-     - `/add-plugin sonatype/sonatype-guide-cursor-plugin`
-     - or the full repo URL.
+1. **Submit the plugin** at [cursor.com/marketplace/publish](https://cursor.com/marketplace/publish) with repo URL:  
+   `https://github.com/sonatype/sonatype-guide-cursor-plugin`
+2. After approval, Cursor will list it on the marketplace (with a slug like `sonatype-guide`).
+3. **Then** users can run `/add-plugin sonatype-guide` in chat or install via **Settings → Plugins → Browse Marketplace**.
 
-3. **Confirm install:** The plugin should appear in your installed plugins. Enable it if there’s a toggle.
+Until then, use **Option B** (local path) or **Option C** (clone into cache) below.
 
 ---
 
 ## Option B: Local install (for testing without publishing)
 
 Use this to test the plugin from your machine without pushing to GitHub.
 
-**Note:** Plugins added via the `local` section of `installed.json` may **not appear** in Settings → Plugins. Cursor’s UI typically lists plugins installed from the marketplace or by URL. If you need the plugin to show in the Installed list and have MCP/skills load, use **Option A (GitHub)** instead.
+**Note:** Plugins added via the `local` section of `installed.json` may **not appear** in Settings → Plugins. If the plugin still doesn’t show or load, try **Option C** (clone into cache) or submit to the marketplace (Option A).
 
 1. **Back up Cursor’s plugin list** (optional but recommended):
    ```bash
@@ -51,7 +44,7 @@ Use this to test the plugin from your machine without pushing to GitHub.
    ```
    This script adds `sonatype-guide` to the `local` section of `~/.cursor/plugins/installed.json` (no copy to cache).
 
-3. **Restart Cursor.** The plugin may still not appear under Installed; if so, install via GitHub (Option A).
+3. **Restart Cursor.** The plugin may still not appear under Installed.
 
 4. **Uninstall (revert) when done testing:**
    ```bash
@@ -60,6 +53,26 @@ Use this to test the plugin from your machine without pushing to GitHub.
 
 ---
 
+## Option C: Clone into Cursor’s URL cache (experimental)
+
+Cursor stores URL-installed plugins under `~/.cursor/plugins/cache/url/`. You can try copying this repo into that structure so Cursor might pick it up.
+
+1. **Run the install-from-GitHub script** (clones into cache and adds to `user` list):
+   ```bash
+   cd /Users/moliverio/projects/sonatype-guide-cursor
+   ./scripts/install-from-github-to-cache.sh
+   ```
+2. **Restart Cursor** and check **Settings → Plugins** for Sonatype Guide.
+3. If it doesn’t appear, the only reliable path is **Option A** (submit to marketplace).
+
+4. **Uninstall (revert) when done testing:**
+   ```bash
+   rm -rf ~/.cursor/plugins/cache/url/https---github-com-sonatype-sonatype-guide-cursor-plugin
+   # Remove sonatype-guide from user array in ~/.cursor/plugins/installed.json if you added it
+   ```
+
+---
+
 ## Verification checklist
 
 After installing (A or B):

README.md

@@ -4,10 +4,18 @@ AI-powered dependency intelligence for Cursor. Check vulnerabilities, find safer
 
 ## Installation
 
-```bash
+**Important:** `/add-plugin` with a GitHub URL or `owner/repo` **does nothing** in Cursor (no response). Cursor only installs plugins that are on the **Cursor Marketplace**. So you must either submit this plugin at [cursor.com/marketplace/publish](https://cursor.com/marketplace/publish) first, or use a workaround below.
+
+**After the plugin is on the marketplace**, in Cursor chat run:
+
+```
 /add-plugin sonatype-guide
 ```
 
+**Workarounds before it’s published:**
+
+- **Local / cache:** See [INSTALL_TEST.md](INSTALL_TEST.md) — Option B (local path in `installed.json`) or Option C (clone into Cursor’s plugin cache).
+
 ## Prerequisites
 
 You need a Sonatype Guide account and API token.

assets/Sonatype-guide-icon-reverse.png

@@ -1,4 +1,5 @@
 ---
+name: dependency-hygiene
 description: Proactive dependency guidance when editing package manifests. Suggests security checks before adding or updating dependencies.
 alwaysApply: false
 globs:

rules/dependency-hygiene.mdc

@@ -1,4 +1,5 @@
 ---
+name: security-first-deps
 description: Security-focused dependency selection guidance. Prioritizes secure, well-maintained packages with compatible licenses.
 alwaysApply: true
 ---

rules/security-first-deps.mdc

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Experimental: clone Sonatype Guide plugin into Cursor's URL cache so it might
+# be discovered. Cursor may only load plugins from marketplace; this is a workaround
+# when /add-plugin with a GitHub URL does nothing.
+
+set -e
+CACHE="${CURSOR_PLUGINS:-$HOME/.cursor/plugins}/cache/url"
+SANITIZED="https---github-com-sonatype-sonatype-guide-cursor-plugin"
+REPO_URL="https://github.com/sonatype/sonatype-guide-cursor-plugin.git"
+PLUGIN_DIR="$CACHE/$SANITIZED/sonatype-guide-cursor-plugin"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOCAL_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+echo "Target: $PLUGIN_DIR"
+
+mkdir -p "$CACHE/$SANITIZED"
+
+# If we're in the plugin repo and it has the manifest, copy locally (works before push)
+if [[ -f "$LOCAL_ROOT/.cursor-plugin/plugin.json" ]]; then
+  echo "Using local plugin at $LOCAL_ROOT"
+  rm -rf "$PLUGIN_DIR"
+  cp -R "$LOCAL_ROOT" "$PLUGIN_DIR"
+  rm -rf "$PLUGIN_DIR/.git" 2>/dev/null || true
+elif [[ -d "$PLUGIN_DIR/.git" ]]; then
+  echo "Updating existing clone..."
+  (cd "$PLUGIN_DIR" && git fetch origin && git reset --hard origin/main 2>/dev/null || git reset --hard origin/master 2>/dev/null || true)
+else
+  echo "Cloning $REPO_URL ..."
+  git clone --depth 1 "$REPO_URL" "$PLUGIN_DIR"
+fi
+
+if [[ ! -f "$PLUGIN_DIR/.cursor-plugin/plugin.json" ]]; then
+  echo "Error: .cursor-plugin/plugin.json not found in clone. Check repo structure."
+  exit 1
+fi
+
+echo "Done. Restart Cursor and check Settings → Plugins."
+echo "If the plugin still does not appear, submit it at https://cursor.com/marketplace/publish"