Add Version Story plugin (git for lawyers: hosted MCP for document comparison and redlining)

[kevkev-kev]

Git for Lawyers

What this PR does

Adds Version Story, a hosted MCP server for deterministic legal document comparison, as a remote-source catalog entry. No plugin code is vendored here; the plugin directory holds a manifest, an .mcp.json pointing at the hosted server, a README, and four skills.

• Plugin name: version-story
• Type: remote source
• Source URL + pinned SHA: https://github.com/VersionStory/version-story-plugin-marketplace.git at 66a463549b82faf052d91d8e3a096de0d2d8db61, path grok
• Homepage: https://www.versionstory.com/developers/mcp/overview

Version Story is git for lawyers: diff, merge, and blame for Word and PDF documents. Lawyers work in redlines rather than diffs, and the tools that produce them have no API. This server compares two versions of a document and returns a true redline as Word tracked changes, a PDF, or a markdown rendering with change markup the agent can read. It merges parallel revisions of one document into a single tracked-changes draft with each party's edits attributed, and builds version histories that attribute every surviving change to the version that introduced it. The comparison engine is deterministic and preserves footnotes, tables, numbering, and formatting, which is why law firms use it in place of desktop comparison tools.

Grok connects over streamable HTTP with OAuth 2.1 (PKCE, dynamic client registration). File transfers are ordinary HTTPS requests the agent makes itself against signed URLs on *.versionstory.com.

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (VersionStory).

Checklist

• Added exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; keywords and domains are brand-scoped.
• License is stated: MIT for the plugin files. Use of the service is governed by the Version Story Terms of Service.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege. No hooks, no local process, one HTTP MCP server.
• Network endpoints this plugin calls (and why):
  • https://mcp-compare.versionstory.com/mcp: tool calls.
  • https://mcp-compare.versionstory.com/transfer/...: the agent's HTTP PUT of source documents, authorized by a one-hour signed token from the upload manifest.
  • https://documents.versionstory.com/...: signed redline downloads.
  • https://app.versionstory.com: browser sign-in during OAuth.
• Credentials/permissions it requires (and why): a Version Story account. OAuth issues the agent a scoped access token; no API key, no password handling. A free tier exists with a monthly upload limit.

Documents the agent uploads land in the user's own Version Story account under the same storage and retention controls as the web application, and are never used to train models. Document content does not pass through the model as part of producing a redline; the agent reads document text only when the user asks for the changes to be explained. Version Story is SOC 2 Type II certified (https://app.versionstory.com/trust).

Notes for reviewers

Tool schemas come from tools/list; response shapes and the transfer flow are documented at https://www.versionstory.com/developers/mcp/overview. Contact: kevin@versionstory.com.