Plugin flagged pending manual review: sickle #461

Our listing for Sickle is hidden pending manual review after the security agent flagged it. Could an admin review it?

Plugin: https://cursor.directory/plugins/sickle
Publisher: Sickle (Better Email Ltd, UK), https://sickle.app/mcp

The scan found nothing malicious in the submission. It flagged the listing because Sickle is a hosted remote MCP with access to users' mailboxes and has no repository to audit. That's fair: Sickle is a commercial hosted service, not open source, so there is no repo to add. Here's what a reviewer would want to know instead:

• One MCP server component, { "url": "https://mcp.sickle.app" }. Nothing runs locally.
• Users sign in with their Sickle account over OAuth. Cursor gets a revocable token, never a mailbox password.
• Read (list, search, read), change (mark, move, move to Trash, save drafts) and send are separate permissions, and each tool checks the one it needs. The send tool is annotated destructive and open-world, so Cursor asks the user before every send. No tool deletes anything permanently.
• Mail is fetched from or handed to the provider for each call. The server keeps no copy, and credentials and email content aren't written to logs.
• Gmail access follows the Google API Services User Data Policy, including Limited Use.
• Users can revoke Cursor at sickle.app under Connect AI.
• Privacy policy: https://sickle.app/privacy-policy

I've updated the listing description with these details. Happy to answer anything else the reviewers need.