[Wlain]

What

Adds the Kling AI China Agent Plugin under plugins/Wlain/kling-ai with:

• one streamable-http MCP server at https://klingai.com/mcp/plugin;
• three Skills for account/task routing, image generation, and video generation;
• explicit single-submit billing safety, task-ID handoff, and result fallback rules;
• network, data-use, credential, and paid-service disclosures.

Why

This gives MiniMax Code users a Skill-guided path to Kling image, video, motion-control, account-credit, upload, Element, and task-query tools without embedding API keys, tokens, cookies, or a local MCP server.

Requirements and data flow

• Requires a Kling China account; real generation may consume account credits.
• User prompts, explicitly supplied reference media, and generation parameters are sent to https://klingai.com/mcp/plugin.
• OAuth credentials must remain host-managed and must not enter Plugin files, chat, or logs.
• X-Kling-Integration: Plugin-MiniMaxCode is a non-secret integration marker, not an authorization header.

Validation

• npm ci
• npm run check
• Repository validation: 19 hosted Plugins and all examples passed.
• Test suite: 110 passed, 0 failed.
• MiniMax Code 3.0.67 local package discovery: 1 MCP server and 3 Skills discovered.

Runtime compatibility gate

This PR is intentionally a Draft. MiniMax Code 3.0.67 currently does not start browser OAuth after the protected remote MCP returns the standard 401 challenge, so tools/list and live tool injection cannot complete. Generic OAuth is also documented as outside the current public portable subset.

Related historical issue MiniMax-AI/minimax-code#120 was closed on 2026-10-19 during old-release backlog cleanup, not after successful Kling OAuth verification. Earlier triage said non-builtin MCP loading had been restored in later builds; this does not establish protected remote MCP OAuth support. The locally installed MiniMax Code remains 3.0.67, and no newer-host end-to-end OAuth/tools-list result is claimed.

Please do not treat the live MCP workflow as generally available until a MiniMax Code build completes protected-resource discovery, DCR or a host-managed pre-registered client, Authorization Code + S256 PKCE, token refresh, and post-login tools/list injection. The package does not work around this with a local proxy or pasted credentials.

2026-11-13 correction and verification

• Updated the configured China endpoint and six related documentation/Skill files to https://klingai.com/mcp/plugin.
• Anonymous initialize returns expected 401 with protected-resource metadata challenge; this is discovery-only verification, not authenticated compatibility.
• npm run check: repository validation passed and 110 tests passed, 0 failed; git diff --check passed.
• Restored actual Draft status pending supported-host integration evidence. No paid generation was performed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Wlain]

Hi maintainers — could you please review this submission and advise whether it can be accepted into the marketplace while protected remote MCP OAuth support is tracked in MiniMax-AI/minimax-code#120? The package is mergeable, repository validation passes (110 tests), and MiniMax Code 3.0.67 locally discovers the single remote MCP server and all three Skills. It intentionally does not add a local proxy or pasted-credential workaround. If marketplace publication must wait for host-side OAuth support, I am happy to keep it pending and make any packaging or metadata changes you recommend. Thank you!

[hetaoBackend]

Current head 487d44f is statically valid and the endpoint advertises OAuth discovery (an unauthenticated MCP initialize correctly receives 401 plus the protected-resource metadata challenge). However, the PR README itself says MiniMax Code 3.0.67 cannot start the required OAuth flow or inject tools, calls this contribution Draft-only until host support and real tools/list/authorization are available, while the GitHub PR is not marked Draft. Please mark the PR Draft and/or provide an actual supported-host OAuth/tools-list integration result before presenting this as an installable plugin. [code]smith is SKIPPED.