docs(typeform): align README with new MCP docs and document CIMD

[alirezainfotech]

Refreshes the Typeform plugin README against Typeform's new MCP docs (https://www.typeform.com/developers/mcp/), and documents that Typeform's authorization server uses Client ID Metadata Documents (CIMD).

Changes

• Authentication (new section): OAuth 2.0 with CIMD (the client_id is an HTTPS URL to a metadata document: no allowlist, no registration call, no client secret), PKCE S256 required, scopes granted all together, offline_access for refresh tokens, and .well-known discovery.
• Data residency: the default / EU data center 1 / EU data center 2 table (MCP endpoint and authorization server), the note that the two EU hosts are not interchangeable, Enterprise-only EU hosting, and the region field from accounts-list_accounts.
• Capabilities: table aligned with the supported-tools page (accounts and workspaces, forms, themes, automations, contacts, insights, feedback).
• Call order: accounts-list_accounts first, forms-public_get_capabilities before editing, validate_patch → patch_form → publish_form, insights-public_discover before analytics.
• Notes: scope list, plan gating at call time, destructive tools and no sandbox, and what isn't available over MCP yet.
• Docs links: point to the new docs pages.
• plugin.json: homepage updated to the new docs URL, version bumped to 1.0.1. CHANGELOG.md entry added. mcp.json is unchanged.

Verification

Scopes, issuers, client_id_metadata_document_supported: true and code_challenge_methods_supported: ["S256"] were checked against the live /.well-known/oauth-authorization-server and the 401 challenge on api.typeform.com, api.eu.typeform.com and api.typeform.eu. The four developer-docs links return 200.

---

Note

Low Risk
Documentation and plugin metadata only; no changes to MCP endpoints, auth implementation, or runtime behavior.

Overview
Bumps the Typeform Cursor plugin to 1.0.1 and refreshes user-facing docs to match Typeform’s new MCP site (www.typeform.com/developers/mcp/).

The README gains a dedicated Authentication section (OAuth 2.0, CIMD, required PKCE, bundled scopes, offline_access, and well-known discovery), a data residency table for default vs two EU MCP hosts and their authorization servers, an expanded capability matrix (themes, automations, contacts, insights, feedback), recommended call order for accounts/forms/insights, and stronger Notes (scopes, plan gating, destructive actions, MCP gaps). plugin.json homepage and doc links are updated; CHANGELOG records the docs refresh. MCP wiring is unchanged.

^{Reviewed by Cursor Bugbot for commit 7336dd1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alirezainfotech]

Hi @poteto,

I'm Alireza Khosravian, a Senior Software Engineer at Typeform. We'd like to update the documentation for our MCP server in the Cursor plugins docs. Would you be able to take a look at and consider merging this PR?

We're also planning to deprecate DCR OAuth in the future. If possible, could you point us to the right person on your team to discuss updating the integration to use CIMD instead of DCR?

cc: @cursoragent

Thanks!

[deanrie]

Checked both against main: the README still has the "api.eu.typeform.com or api.typeform.eu depending on where your account lives" sentence, so the EU-host correction hasn't landed yet. #373 (Pol, Sep 14) carries the host table and capability-table fixes; this PR carries the same table plus the CIMD/PKCE authentication section and the residency notes. The two overlap on the EU table, so merging this one would supersede #373; merging #373 first would need a small rebase here. Flagging so the maintainers can pick one order. Both are README-only, mcp.json stays on the default data center either way.