Add Keenable plugin (keyless web search + page extraction)

[ilya-bogin-keenable]

What this PR does

Adds Keenable — a keyless web search + page-content extraction plugin backed by Keenable's hosted MCP server.

• Plugin name: keenable
• Type: remote source
• Source URL + pinned SHA: https://github.com/keenableai/keenable-grok-plugin.git @ 350fd05a76a3e7bc6b6dbef616f30c9d08ce6c90
• Homepage: https://keenable.ai

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (keenableai/keenable-grok-plugin).

Checklist

• Added exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, public + reachable.
• Regenerated .grok-plugin/plugin-index.json.
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated (MIT).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege — the plugin ships no hooks and a single scoped HTTP MCP server (two tools: search_web_pages, fetch_page_content).
• Network endpoints this plugin calls (and why): only https://api.keenable.ai/mcp — Keenable's hosted MCP server, for web search and page extraction.
• Credentials/permissions it requires (and why): none. Keyless by default. The server optionally reads a KEENABLE_API_KEY env var to raise rate limits; a key is never required and none is bundled.

Notes for reviewers

Follows the same shape as the existing tavily, exa, and firecrawl entries: a thin remote-source repo (.mcp.json + .grok-plugin/plugin.json + skills) wrapping a hosted MCP endpoint. Like firecrawl, Keenable is keyless by default (public rate-limited path, no signup); an optional API key only lifts limits. Source is published under our official keenableai org.

[ilya-bogin-keenable]

@ykeremy gentle ping on this one. It has been open since June 20 with no comments, and the Validate catalog workflow has never run: it is stuck on the first-time-contributor approval gate, so the check never reports. Could you approve the workflow run when you get a chance?

Rebased onto current main today, MERGEABLE, 2 files / +35. Socket Security (project report + PR alerts) and semgrep all pass. Locally validate-catalog.py and generate-plugin-index.py --check are both green.

It is a catalog entry only, for keenable-grok-plugin: a thin .mcp.json pointing at our hosted api.keenable.ai/mcp plus two skills, no binary and no login. Like the Firecrawl entry it is keyless by default, so there is nothing for a user to sign up for before the plugin works.