Add Kling AI plugin

[Wlain]

What this PR does

• Plugin: kling-ai
• Type: third-party vendored plugin under external_plugins
• Homepage: https://kling.ai
• Default region: Global (https://kling.ai/mcp)

Adds the Kling AI plugin for Grok Build with two Agent Skills and one OAuth-protected remote MCP registration for image and video generation workflows.

Publisher and ownership

• Submission is authorized by the requester for the Kling AI integration project.
• Publisher declared by the plugin manifest: KLING AI Pte Ltd.
• The working source repository is currently internal, so this submission uses the marketplace's supported vendored-source form.
• xAI reviewers may request additional publisher verification before merge.

Validation

• Added exactly one kling-ai entry to .grok-plugin/marketplace.json.
• Regenerated .grok-plugin/plugin-index.json.
• python3 scripts/validate-catalog.py passes.
• python3 scripts/generate-plugin-index.py --check passes.
• grok plugin validate passes with Grok Build 1.0.5.
• Socket Security project and PR checks pass.
• Semgrep scan passes.

OAuth verification status

Grok Build owns OAuth discovery, dynamic registration, PKCE, credential storage, and refresh. Local verification confirmed that:

1. The installed plugin registers exactly one active Kling server as Plugin-Grok-kling-ai.
2. It targets the Global endpoint https://kling.ai/mcp.
3. The endpoint is reachable and returns OAuth authorization required.
4. Grok's native MCP authentication flow starts and reaches the browser authorization step.

The final user consent was intentionally cancelled during this submission pass, so no access token was retained and no credit-consuming generation call was made. Full consent, reconnect, refresh, and account-switch behavior can be completed during reviewer testing.

Security and behavior

• No curl | bash, remote code execution, hooks, postinstall scripts, local MCP runtime, or executable dependencies.
• No API key, client secret, bearer token, cookie, or environment secret is requested or bundled.
• X-Kling-Integration: Plugin-Grok is sent only to the configured Kling MCP origin for integration attribution; it must not affect authentication, billing, or rollout.
• Generation is a credit-consuming write. The Skill requires explicit confirmation of final settings and at-most-once submission.
• The marketplace package activates exactly one regional endpoint. The China endpoint appears only in inactive private-distribution documentation/template material and is not loaded by Grok Marketplace.

[Wlain]

Hi @ykeremy — could you please take a first review pass on this submission when you have a chance? All currently reported security checks are green, the plugin uses one OAuth-protected remote MCP endpoint with no local runtime or executable dependencies, and grok-build-team is already requested. The branch is currently behind main; I can sync it immediately once you prefer a rebase/update. I can also provide publisher authorization/verification promptly if that is the remaining gate. Thanks!