catalog.json

{
  "schema_version": 2,
  "reviewed_at": "2026-11-12",
  "tools": [
    {
      "id": "systematic-debugging",
      "name": "Systematic Debugging",
      "kind": "skill",
      "category": "engineering-skills",
      "description": "Root-cause investigation, reproducible failures, and hypothesis-driven debugging.",
      "repository": "obra/superpowers",
      "homepage": "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/systematic-debugging",
      "license": "MIT",
      "stars": 306063,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-23T03:48:57Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/obra/superpowers/tar.gz/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "sha256": "da34247c51339cdd6175b3590261f16e25b08d46669afd5b6fc3f842ab303e20",
        "ref": "2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "type": "skill",
        "subdir": "skills/systematic-debugging",
        "license_path": "LICENSE"
      },
      "notes": "Upstream cross-references test-driven-development and verification-before-completion; all three are included in presets. Copies the skill directory, not the full Superpowers plugin.",
      "evidence": [
        "https://api.github.com/repos/obra/superpowers",
        "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/systematic-debugging"
      ]
    },
    {
      "id": "test-driven-development",
      "name": "Test-Driven Development",
      "kind": "skill",
      "category": "engineering-skills",
      "description": "A test-first workflow with guidance for meaningful regression tests.",
      "repository": "obra/superpowers",
      "homepage": "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/test-driven-development",
      "license": "MIT",
      "stars": 306063,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-23T03:48:57Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/obra/superpowers/tar.gz/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "sha256": "da34247c51339cdd6175b3590261f16e25b08d46669afd5b6fc3f842ab303e20",
        "ref": "2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "type": "skill",
        "subdir": "skills/test-driven-development",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/obra/superpowers",
        "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/test-driven-development"
      ]
    },
    {
      "id": "verification-before-completion",
      "name": "Verification Before Completion",
      "kind": "skill",
      "category": "engineering-skills",
      "description": "Require fresh verification evidence before claiming a change is complete.",
      "repository": "obra/superpowers",
      "homepage": "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/verification-before-completion",
      "license": "MIT",
      "stars": 306063,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-23T03:48:57Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/obra/superpowers/tar.gz/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "sha256": "da34247c51339cdd6175b3590261f16e25b08d46669afd5b6fc3f842ab303e20",
        "ref": "2ce8aa15d05bd57213e6f746f953aafb7ded7a8b",
        "type": "skill",
        "subdir": "skills/verification-before-completion",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/obra/superpowers",
        "https://github.com/obra/superpowers/tree/2ce8aa15d05bd57213e6f746f953aafb7ded7a8b/skills/verification-before-completion"
      ]
    },
    {
      "id": "python-testing-patterns",
      "name": "Python Testing Patterns",
      "kind": "skill",
      "category": "python-skills",
      "description": "Practical pytest fixtures, parametrization, mocking, async testing, and coverage guidance.",
      "repository": "wshobson/agents",
      "homepage": "https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-testing-patterns",
      "license": "MIT",
      "stars": 41868,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T01:08:14Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/wshobson/agents/tar.gz/0874a27b17a22e2b7c2e2bcd725768e0803cad06",
        "sha256": "468c5d32d4a24ea9629c7713d209bbb46cf462ac487d3bc442414aec4ed54c43",
        "ref": "0874a27b17a22e2b7c2e2bcd725768e0803cad06",
        "type": "skill",
        "subdir": "plugins/python-development/skills/python-testing-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/wshobson/agents",
        "https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-testing-patterns"
      ]
    },
    {
      "id": "python-packaging",
      "name": "Python Packaging",
      "kind": "skill",
      "category": "python-skills",
      "description": "Build Python libraries and CLIs with package metadata, wheels, and release workflows.",
      "repository": "wshobson/agents",
      "homepage": "https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-packaging",
      "license": "MIT",
      "stars": 41868,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T01:08:14Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/wshobson/agents/tar.gz/0874a27b17a22e2b7c2e2bcd725768e0803cad06",
        "sha256": "468c5d32d4a24ea9629c7713d209bbb46cf462ac487d3bc442414aec4ed54c43",
        "ref": "0874a27b17a22e2b7c2e2bcd725768e0803cad06",
        "type": "skill",
        "subdir": "plugins/python-development/skills/python-packaging",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/wshobson/agents",
        "https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-packaging"
      ]
    },
    {
      "id": "context7",
      "name": "Context7",
      "kind": "mcp",
      "category": "documentation",
      "description": "Retrieve library documentation and version-specific examples for coding tasks.",
      "repository": "upstash/context7",
      "homepage": "https://github.com/upstash/context7/tree/master/packages/mcp",
      "license": "MIT",
      "stars": 63759,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:24:32Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "@upstash/context7-mcp@4.4.4"
        ],
        "requirements": [
          "npx"
        ],
        "version": "4.4.4",
        "runtime": "Node.js >=20.18.1"
      },
      "notes": "Node.js >=20.18.1. The upstream stdio README documents an optional API key for higher limits/private repositories; service policies and availability apply. Set credentials through your agent, never commit secrets.",
      "evidence": [
        "https://api.github.com/repos/upstash/context7",
        "https://github.com/upstash/context7/tree/master/packages/mcp",
        "https://registry.npmjs.org/@upstash%2fcontext7-mcp/4.4.4"
      ]
    },
    {
      "id": "playwright",
      "name": "Playwright MCP",
      "kind": "mcp",
      "category": "browser",
      "description": "Browser inspection and interactive web testing through accessibility snapshots.",
      "repository": "microsoft/playwright-mcp",
      "homepage": "https://github.com/microsoft/playwright-mcp",
      "license": "Apache-2.0",
      "stars": 38702,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-22T17:43:26Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "@playwright/mcp@0.0.83"
        ],
        "requirements": [
          "npx"
        ],
        "version": "0.0.83",
        "runtime": "Node.js >=18"
      },
      "notes": "Node.js >=18 plus a supported browser. First browser use may require a browser installation. This entry configures the MCP server; it does not install browser binaries.",
      "evidence": [
        "https://api.github.com/repos/microsoft/playwright-mcp",
        "https://github.com/microsoft/playwright-mcp",
        "https://registry.npmjs.org/@playwright%2fmcp/0.0.83"
      ]
    },
    {
      "id": "fetch",
      "name": "Fetch MCP",
      "kind": "mcp",
      "category": "documentation",
      "description": "Retrieve web pages as text/Markdown for documentation and research.",
      "repository": "modelcontextprotocol/servers",
      "homepage": "https://github.com/modelcontextprotocol/servers/tree/main/src/fetch",
      "license": "Apache-2.0 / MIT; docs CC-BY-4.0",
      "stars": 91599,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T13:43:37Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "mcp-server-fetch==2026.10.24"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "2026.10.24",
        "runtime": "Python >=3.10"
      },
      "notes": "uv/uvx and Python >=3.10. This is an upstream reference server; assess URL/network access for your environment. No private-IP bypass is enabled.",
      "evidence": [
        "https://api.github.com/repos/modelcontextprotocol/servers",
        "https://github.com/modelcontextprotocol/servers/tree/main/src/fetch",
        "https://pypi.org/pypi/mcp-server-fetch/2026.10.24/json"
      ]
    },
    {
      "id": "github-mcp",
      "name": "GitHub MCP Server",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Official GitHub tools for repositories, issues, and pull requests.",
      "repository": "github/github-mcp-server",
      "homepage": "https://github.com/github/github-mcp-server",
      "license": "MIT",
      "stars": 33999,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-23T21:21:33Z",
      "archived": false,
      "install": null,
      "notes": "Configure authentication and allowed toolsets with the official installer. No credentials or remote OAuth flow is provisioned by this CLI.",
      "evidence": [
        "https://api.github.com/repos/github/github-mcp-server",
        "https://github.com/github/github-mcp-server"
      ]
    },
    {
      "id": "serena",
      "name": "Serena",
      "kind": "lsp",
      "category": "lsp-bridge",
      "description": "Expose semantic code navigation, references, diagnostics, and edits to coding agents through an MCP-to-LSP bridge.",
      "repository": "oraios/serena",
      "homepage": "https://github.com/oraios/serena",
      "license": "GPL-3.0-or-later (application); MIT (SolidLSP)",
      "stars": 30759,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:37:49Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.13",
          "--from",
          "git+https://github.com/oraios/serena@5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc",
          "serena",
          "start-mcp-server",
          "--context",
          "ide",
          "--project",
          "{project}",
          "--language-backend",
          "LSP",
          "--agent-interface",
          "tools",
          "--enable-web-dashboard",
          "false",
          "--open-web-dashboard",
          "false",
          "--enable-gui-log-window",
          "false"
        ],
        "requirements": [
          "uvx",
          "git"
        ],
        "source": "git",
        "ref": "5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc",
        "version": "2.1.0",
        "runtime": "uv/uvx + Git; Python 3.13 selected by uvx; language-specific dependencies"
      },
      "notes": "Pins stable v2.1.0. uvx selects Python 3.13 (upstream supports >=3.11,<3.15); Git and network access required. Generic single-project ide context, explicit LSP backend and tools interface; dashboard/browser/GUI disabled. Language-server dependencies may download at first project activation; some languages need an external toolchain. MCP handshake and discovery of 22 tools verified on macOS in a temporary Python project; symbol operations and individual agent UIs were not exercised.",
      "evidence": [
        "https://api.github.com/repos/oraios/serena",
        "https://github.com/oraios/serena",
        "https://github.com/oraios/serena/releases/tag/v2.1.0",
        "https://github.com/oraios/serena/blob/5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc/pyproject.toml",
        "https://github.com/oraios/serena/blob/5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc/LICENSE",
        "https://oraios.github.io/serena/02-usage/020_running.html",
        "https://oraios.github.io/serena/02-usage/050_configuration.html"
      ]
    },
    {
      "id": "chrome-devtools",
      "name": "Chrome DevTools MCP",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Inspect browser performance, network activity, and runtime behavior.",
      "repository": "ChromeDevTools/chrome-devtools-mcp",
      "homepage": "https://github.com/ChromeDevTools/chrome-devtools-mcp",
      "license": "Apache-2.0",
      "stars": 54261,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:22:41Z",
      "archived": false,
      "install": null,
      "notes": "Browser lifecycle and environment requirements are configured upstream.",
      "evidence": [
        "https://api.github.com/repos/ChromeDevTools/chrome-devtools-mcp",
        "https://github.com/ChromeDevTools/chrome-devtools-mcp"
      ]
    },
    {
      "id": "sequential-thinking",
      "name": "Sequential Thinking MCP",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "A reference server for structured problem-solving tool calls.",
      "repository": "modelcontextprotocol/servers",
      "homepage": "https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking",
      "license": "Apache-2.0 / MIT; docs CC-BY-4.0",
      "stars": 91599,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T13:43:37Z",
      "archived": false,
      "install": null,
      "notes": "Current npm release 2.0.0 requires Node.js >=24. Kept out of the starter runtime and installer until separately tested.",
      "evidence": [
        "https://api.github.com/repos/modelcontextprotocol/servers",
        "https://github.com/modelcontextprotocol/servers",
        "https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking"
      ]
    },
    {
      "id": "openspec",
      "name": "OpenSpec",
      "kind": "reference",
      "category": "spec-driven-development",
      "description": "Spec-driven change workflows with per-agent skills and initialization.",
      "repository": "Fission-AI/OpenSpec",
      "homepage": "https://github.com/Fission-AI/OpenSpec",
      "license": "MIT",
      "stars": 73139,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T10:54:47Z",
      "archived": false,
      "install": null,
      "notes": "Use the upstream CLI for its coordinated workflow artifacts and update semantics.",
      "evidence": [
        "https://api.github.com/repos/Fission-AI/OpenSpec",
        "https://github.com/Fission-AI/OpenSpec"
      ]
    },
    {
      "id": "spec-kit",
      "name": "Spec Kit",
      "kind": "reference",
      "category": "spec-driven-development",
      "description": "Specification, planning, and implementation templates for coding agents.",
      "repository": "github/spec-kit",
      "homepage": "https://github.com/github/spec-kit",
      "license": "MIT",
      "stars": 143181,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T22:23:41Z",
      "archived": false,
      "install": null,
      "notes": "Use the official Specify CLI to initialize its own project structure.",
      "evidence": [
        "https://api.github.com/repos/github/spec-kit",
        "https://github.com/github/spec-kit"
      ]
    },
    {
      "id": "anthropic-skills",
      "name": "Anthropic Skills",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "Official examples of reusable agent skills and document workflows.",
      "repository": "anthropics/skills",
      "homepage": "https://github.com/anthropics/skills",
      "license": "Per-skill licenses; see upstream",
      "stars": 184157,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-09T18:45:52Z",
      "archived": false,
      "install": null,
      "notes": "Licenses vary by skill, especially document skills. Review the selected directory before redistribution.",
      "evidence": [
        "https://api.github.com/repos/anthropics/skills",
        "https://github.com/anthropics/skills"
      ]
    },
    {
      "id": "vercel-agent-skills",
      "name": "Vercel Agent Skills",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "Frontend and deployment-oriented skills maintained by Vercel.",
      "repository": "vercel-labs/agent-skills",
      "homepage": "https://github.com/vercel-labs/agent-skills",
      "license": "See upstream and individual skills",
      "stars": 33096,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T04:16:22Z",
      "archived": false,
      "install": null,
      "notes": "Select skills and inspect their individual licenses and runtime assumptions.",
      "evidence": [
        "https://api.github.com/repos/vercel-labs/agent-skills",
        "https://github.com/vercel-labs/agent-skills"
      ]
    },
    {
      "id": "skills-cli",
      "name": "Skills CLI",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "Discover and install Agent Skills across supported coding agents.",
      "repository": "vercel-labs/skills",
      "homepage": "https://github.com/vercel-labs/skills",
      "license": "MIT",
      "stars": 36801,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T02:03:06Z",
      "archived": false,
      "install": null,
      "notes": "Useful when a skill is outside this curated catalog; upstream manages its own installation.",
      "evidence": [
        "https://api.github.com/repos/vercel-labs/skills",
        "https://github.com/vercel-labs/skills"
      ]
    },
    {
      "id": "uv",
      "name": "uv",
      "kind": "reference",
      "category": "python-toolchain",
      "description": "Python environments, dependency management, and isolated tool execution.",
      "repository": "astral-sh/uv",
      "homepage": "https://github.com/astral-sh/uv",
      "license": "Apache-2.0 OR MIT",
      "stars": 91242,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T04:16:27Z",
      "archived": false,
      "install": null,
      "notes": "Installed separately; provides uvx for the Fetch MCP preset.",
      "evidence": [
        "https://api.github.com/repos/astral-sh/uv",
        "https://github.com/astral-sh/uv"
      ]
    },
    {
      "id": "ruff",
      "name": "Ruff",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Python linting, formatting, and the built-in Ruff language server for diagnostics and code actions.",
      "repository": "astral-sh/ruff",
      "homepage": "https://docs.astral.sh/ruff/editors/",
      "license": "MIT",
      "stars": 50317,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:46:40Z",
      "archived": false,
      "install": null,
      "notes": "Ruff remains useful as a project CLI dependency. Native LSP command is ruff server; combine with a navigation/type server when needed. The former ruff-lsp wrapper is superseded by the built-in server.",
      "evidence": [
        "https://api.github.com/repos/astral-sh/ruff",
        "https://docs.astral.sh/ruff/editors/",
        "https://github.com/astral-sh/ruff"
      ]
    },
    {
      "id": "pytest",
      "name": "pytest",
      "kind": "reference",
      "category": "python-toolchain",
      "description": "Python testing with fixtures and a broad plugin ecosystem.",
      "repository": "pytest-dev/pytest",
      "homepage": "https://github.com/pytest-dev/pytest",
      "license": "MIT",
      "stars": 14649,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T09:09:50Z",
      "archived": false,
      "install": null,
      "notes": "Add to the target project development dependencies; the testing skill does not install pytest.",
      "evidence": [
        "https://api.github.com/repos/pytest-dev/pytest",
        "https://github.com/pytest-dev/pytest"
      ]
    },
    {
      "id": "pre-commit",
      "name": "pre-commit",
      "kind": "reference",
      "category": "python-toolchain",
      "description": "Run configured repository checks before commits.",
      "repository": "pre-commit/pre-commit",
      "homepage": "https://github.com/pre-commit/pre-commit",
      "license": "MIT",
      "stars": 15664,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-20T17:15:55Z",
      "archived": false,
      "install": null,
      "notes": "Project hooks require an explicit project configuration.",
      "evidence": [
        "https://api.github.com/repos/pre-commit/pre-commit",
        "https://github.com/pre-commit/pre-commit"
      ]
    },
    {
      "id": "fastmcp",
      "name": "FastMCP",
      "kind": "reference",
      "category": "build-mcp",
      "description": "Build Python MCP servers and clients with a high-level API.",
      "repository": "jlowin/fastmcp",
      "homepage": "https://github.com/jlowin/fastmcp",
      "license": "Apache-2.0",
      "stars": 28217,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:54:16Z",
      "archived": false,
      "install": null,
      "notes": "Development framework, not a ready-to-register MCP server.",
      "evidence": [
        "https://api.github.com/repos/jlowin/fastmcp",
        "https://github.com/jlowin/fastmcp"
      ]
    },
    {
      "id": "mcp-python-sdk",
      "name": "MCP Python SDK",
      "kind": "reference",
      "category": "build-mcp",
      "description": "Official Python SDK for implementing MCP servers and clients.",
      "repository": "modelcontextprotocol/python-sdk",
      "homepage": "https://github.com/modelcontextprotocol/python-sdk",
      "license": "MIT",
      "stars": 24684,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T11:15:12Z",
      "archived": false,
      "install": null,
      "notes": "Development dependency; follow the protocol version supported by your clients.",
      "evidence": [
        "https://api.github.com/repos/modelcontextprotocol/python-sdk",
        "https://github.com/modelcontextprotocol/python-sdk"
      ]
    },
    {
      "id": "security-review",
      "name": "Security Review",
      "kind": "skill",
      "category": "security",
      "description": "Review authentication, authorization, untrusted input, secrets, and sensitive application changes.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/security-review",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/security-review",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/security-review"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version. Includes cloud-infrastructure-security.md; this guidance does not execute a scanner or establish a security audit."
    },
    {
      "id": "coding-standards",
      "name": "Coding Standards",
      "kind": "skill",
      "category": "engineering-standards",
      "description": "Shared naming, readability, error-handling, immutability, and code-quality conventions.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/coding-standards",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/coding-standards",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/coding-standards"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version. Its short-rule alternative is available as ecc-common-rules."
    },
    {
      "id": "python-patterns",
      "name": "Python Patterns",
      "kind": "skill",
      "category": "python-skills",
      "description": "Python idioms, type hints, error handling, resource management, and maintainable code structure.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/python-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/python-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/python-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "fastapi-patterns",
      "name": "FastAPI Patterns",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "FastAPI application structure, Pydantic v2, async dependencies, service layers, and HTTP testing.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/fastapi-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/fastapi-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/fastapi-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "django-patterns",
      "name": "Django Patterns",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "Django and DRF architecture, ORM access, caching, middleware, and service organization.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/django-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/django-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/django-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "django-security",
      "name": "Django Security",
      "kind": "skill",
      "category": "security",
      "description": "Django authentication, authorization, request protections, and production security settings.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/django-security",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/django-security",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/django-security"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "frontend-patterns",
      "name": "Frontend Patterns",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "React and Next.js component composition, state, data fetching, forms, performance, and accessibility.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/frontend-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/frontend-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/frontend-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "nextjs-turbopack",
      "name": "Next.js and Turbopack",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "Next.js 16+ bundler selection, development performance, and middleware-to-proxy migration guidance.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/nextjs-turbopack",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/nextjs-turbopack",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/nextjs-turbopack"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version. Intended for Next.js 16+; do not apply version-specific migration guidance to older apps without checking official docs."
    },
    {
      "id": "backend-patterns",
      "name": "Backend Patterns",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "Node.js, Express, and Next.js API architecture, data access, caching, and observability.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/backend-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/backend-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/backend-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "springboot-patterns",
      "name": "Spring Boot Patterns",
      "kind": "skill",
      "category": "framework-best-practices",
      "description": "Spring Boot REST layers, transactional services, repositories, caching, and production defaults.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/springboot-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/springboot-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/springboot-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "springboot-security",
      "name": "Spring Boot Security",
      "kind": "skill",
      "category": "security",
      "description": "Spring Security authentication, authorization, validation, secrets, headers, and release checks.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/springboot-security",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/springboot-security",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/springboot-security"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "golang-patterns",
      "name": "Go Patterns",
      "kind": "skill",
      "category": "language-best-practices",
      "description": "Idiomatic Go errors, interfaces, concurrency, package organization, and resource lifecycle patterns.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/golang-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/golang-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/golang-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "api-design",
      "name": "API Design",
      "kind": "skill",
      "category": "engineering-standards",
      "description": "REST resources, HTTP semantics, pagination, versioning, error contracts, and rate limits.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/api-design",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/api-design",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/api-design"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "database-migrations",
      "name": "Database Migrations",
      "kind": "skill",
      "category": "data-workflows",
      "description": "Expand-contract schema changes, safe indexes, batched backfills, and migration-tool workflows.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/database-migrations",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/database-migrations",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/database-migrations"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "deployment-patterns",
      "name": "Deployment Patterns",
      "kind": "skill",
      "category": "delivery-workflows",
      "description": "Deployment strategies, container builds, health checks, CI/CD, rollback, and production readiness.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/deployment-patterns",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "skill",
        "subdir": "skills/deployment-patterns",
        "license_path": "LICENSE"
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/deployment-patterns"
      ],
      "notes": "Selected ECC skill directory only. No ECC plugin, hooks, agents, commands, memory service, or settings are installed. Framework examples must be checked against the target project version."
    },
    {
      "id": "ecc-common-rules",
      "name": "ECC Common Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable cross-language engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/common",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/common",
        "license_path": "LICENSE",
        "files": [
          "coding-style.md",
          "security.md",
          "testing.md",
          "git-workflow.md",
          "patterns.md",
          "development-workflow.md"
        ],
        "globs": []
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/common"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md.",
      "source_bytes": 9399
    },
    {
      "id": "ecc-python-rules",
      "name": "ECC Python Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable python-specific engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/python",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/python",
        "license_path": "LICENSE",
        "files": [
          "coding-style.md",
          "security.md",
          "testing.md",
          "patterns.md"
        ],
        "globs": [
          "**/*.py",
          "**/*.pyi"
        ]
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/python"
      ],
      "requires": [
        "ecc-common-rules"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md.",
      "source_bytes": 2639
    },
    {
      "id": "ecc-typescript-rules",
      "name": "ECC TypeScript Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable typescript-specific engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/typescript",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/typescript",
        "license_path": "LICENSE",
        "files": [
          "coding-style.md",
          "security.md",
          "testing.md",
          "patterns.md"
        ],
        "globs": [
          "**/*.ts",
          "**/*.tsx",
          "**/*.js",
          "**/*.jsx"
        ]
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/typescript"
      ],
      "requires": [
        "ecc-common-rules"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md.",
      "source_bytes": 6230
    },
    {
      "id": "ecc-golang-rules",
      "name": "ECC Go Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable golang-specific engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/golang",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/golang",
        "license_path": "LICENSE",
        "files": [
          "coding-style.md",
          "security.md",
          "testing.md",
          "patterns.md"
        ],
        "globs": [
          "**/*.go",
          "**/go.mod",
          "**/go.sum"
        ]
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/golang"
      ],
      "requires": [
        "ecc-common-rules"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md.",
      "source_bytes": 2484
    },
    {
      "id": "ecc-java-rules",
      "name": "ECC Java Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable java-specific engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/java",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/java",
        "license_path": "LICENSE",
        "files": [
          "coding-style.md",
          "security.md",
          "testing.md",
          "patterns.md"
        ],
        "globs": [
          "**/*.java"
        ]
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/java"
      ],
      "requires": [
        "ecc-common-rules"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md.",
      "source_bytes": 14794
    },
    {
      "id": "ecc-fastapi-rules",
      "name": "ECC FastAPI Rules",
      "kind": "rules",
      "category": "engineering-rules",
      "description": "Portable fastapi-specific engineering guidance selected from ECC rules.",
      "repository": "affaan-m/ECC",
      "homepage": "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/python",
      "license": "MIT",
      "stars": 290505,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T04:56:56Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/affaan-m/ECC/tar.gz/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "sha256": "7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1",
        "ref": "25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b",
        "type": "rules",
        "subdir": "rules/python",
        "license_path": "LICENSE",
        "files": [
          "fastapi.md"
        ],
        "globs": [
          "**/app/**/*.py",
          "**/fastapi/**/*.py",
          "**/*_api.py"
        ]
      },
      "evidence": [
        "https://api.github.com/repos/affaan-m/ECC",
        "https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/rules/python"
      ],
      "requires": [
        "ecc-python-rules"
      ],
      "notes": "Selected Markdown rules only; excludes ECC hooks, agent orchestration, and model-selection rule files. Native activation adapts language scopes and crosslinks; original sources retain MIT attribution. Named ECC reviewer/planner roles and Claude settings assumptions require the portable adaptation described in docs/ECC-MIGRATION.md. Select for FastAPI apps only; broad app-directory globs also match other Python frameworks.",
      "source_bytes": 1736
    },
    {
      "id": "pyright",
      "name": "Pyright",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Python type checking and language-server support for navigation and diagnostics.",
      "repository": "microsoft/pyright",
      "homepage": "https://github.com/microsoft/pyright",
      "license": "MIT",
      "stars": 15707,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-26T21:20:29Z",
      "archived": false,
      "install": null,
      "notes": "Standalone LSP reference. Install through the upstream guide and configure pyright-langserver --stdio in an LSP-capable client. Serena has a separately managed Python backend.",
      "evidence": [
        "https://api.github.com/repos/microsoft/pyright",
        "https://github.com/microsoft/pyright",
        "https://github.com/microsoft/pyright/blob/main/docs/installation.md",
        "https://github.com/microsoft/pyright/blob/main/LICENSE.txt"
      ]
    },
    {
      "id": "python-lsp-server",
      "name": "Python LSP Server",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Jedi-based Python completion and navigation with configurable linting and formatting plugins.",
      "repository": "python-lsp/python-lsp-server",
      "homepage": "https://github.com/python-lsp/python-lsp-server",
      "license": "MIT",
      "stars": 2605,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-07-27T18:27:08Z",
      "archived": false,
      "install": null,
      "notes": "Standalone LSP reference. Install python-lsp-server into the appropriate environment and launch pylsp from an LSP client; extras/plugins are chosen separately.",
      "evidence": [
        "https://api.github.com/repos/python-lsp/python-lsp-server",
        "https://github.com/python-lsp/python-lsp-server"
      ]
    },
    {
      "id": "typescript-language-server",
      "name": "TypeScript Language Server",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Language Server Protocol wrapper around TypeScript language services for JavaScript and TypeScript.",
      "repository": "typescript-language-server/typescript-language-server",
      "homepage": "https://github.com/typescript-language-server/typescript-language-server",
      "license": "Apache-2.0; MIT portions",
      "stars": 2587,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T06:17:16Z",
      "archived": false,
      "install": null,
      "notes": "Standalone LSP reference. Requires a compatible TypeScript installation and Node.js; launch typescript-language-server --stdio. Check the upstream version compatibility guidance.",
      "evidence": [
        "https://api.github.com/repos/typescript-language-server/typescript-language-server",
        "https://github.com/typescript-language-server/typescript-language-server",
        "https://github.com/typescript-language-server/typescript-language-server/blob/master/LICENSE"
      ]
    },
    {
      "id": "gopls",
      "name": "gopls",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Official Go language server providing code navigation, diagnostics, and refactoring.",
      "repository": "golang/tools",
      "homepage": "https://go.dev/gopls/",
      "license": "BSD-3-Clause",
      "stars": 8009,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T14:52:31Z",
      "archived": false,
      "install": null,
      "notes": "Requires a supported Go toolchain and project module/workspace configuration. Follow upstream installation; launch gopls. Star count is for golang/tools, which contains gopls.",
      "evidence": [
        "https://api.github.com/repos/golang/tools",
        "https://go.dev/gopls/",
        "https://github.com/golang/tools/tree/master/gopls"
      ]
    },
    {
      "id": "rust-analyzer",
      "name": "rust-analyzer",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Rust language server with code navigation, completion, diagnostics, and assists.",
      "repository": "rust-lang/rust-analyzer",
      "homepage": "https://rust-analyzer.github.io/",
      "license": "MIT OR Apache-2.0",
      "stars": 16949,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T15:26:54Z",
      "archived": false,
      "install": null,
      "notes": "Install through the Rust toolchain/editor as documented upstream. rustup component add rust-analyzer provides the rust-analyzer command.",
      "evidence": [
        "https://api.github.com/repos/rust-lang/rust-analyzer",
        "https://rust-analyzer.github.io/",
        "https://rust-analyzer.github.io/book/rust_analyzer_binary.html",
        "https://github.com/rust-lang/rust-analyzer#license"
      ]
    },
    {
      "id": "clangd",
      "name": "clangd",
      "kind": "lsp",
      "category": "language-servers",
      "description": "C/C++ language server with completion, cross-references, diagnostics, and refactoring support.",
      "repository": "clangd/clangd",
      "homepage": "https://clangd.llvm.org/",
      "license": "Apache-2.0 WITH LLVM-exception",
      "stars": 2315,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-06T08:51:22Z",
      "archived": false,
      "install": null,
      "notes": "Install a suitable LLVM/clangd binary and provide compile_commands.json for accurate project analysis. Repository is the official issue/release tracker; implementation lives in llvm/llvm-project.",
      "evidence": [
        "https://api.github.com/repos/clangd/clangd",
        "https://clangd.llvm.org/",
        "https://clangd.llvm.org/installation",
        "https://github.com/clangd/clangd/blob/master/LICENSE"
      ]
    },
    {
      "id": "semgrep",
      "name": "Semgrep",
      "kind": "reference",
      "category": "security-tooling",
      "description": "Rule-based static analysis for security issues and code patterns across multiple languages.",
      "repository": "semgrep/semgrep",
      "homepage": "https://github.com/semgrep/semgrep",
      "license": "LGPL-2.1 (community engine); additional offerings/rules have separate terms",
      "stars": 17306,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T00:06:04Z",
      "archived": false,
      "install": null,
      "notes": "Use the official CLI/integration to select reviewed rules. Configuration, rule licensing, telemetry, and hosted features depend on the selected workflow; not automatically installed or run.",
      "evidence": [
        "https://api.github.com/repos/semgrep/semgrep",
        "https://github.com/semgrep/semgrep",
        "https://semgrep.dev/docs/getting-started/",
        "https://github.com/semgrep/semgrep/blob/develop/LICENSE"
      ]
    },
    {
      "id": "bandit",
      "name": "Bandit",
      "kind": "reference",
      "category": "security-tooling",
      "description": "Find common Python security issues through AST-based static analysis.",
      "repository": "PyCQA/bandit",
      "homepage": "https://github.com/PyCQA/bandit",
      "license": "Apache-2.0",
      "stars": 8352,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-27T00:31:12Z",
      "archived": false,
      "install": null,
      "notes": "Add as a development or CI dependency, configure exclusions and severity/confidence policy, and review findings. Does not replace dependency or secret scanning.",
      "evidence": [
        "https://api.github.com/repos/PyCQA/bandit",
        "https://github.com/PyCQA/bandit",
        "https://bandit.readthedocs.io/en/latest/start.html"
      ]
    },
    {
      "id": "pip-audit",
      "name": "pip-audit",
      "kind": "reference",
      "category": "security-tooling",
      "description": "Audit Python environments and dependency specifications against known vulnerability data.",
      "repository": "pypa/pip-audit",
      "homepage": "https://github.com/pypa/pip-audit",
      "license": "Apache-2.0",
      "stars": 1386,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-25T16:04:41Z",
      "archived": false,
      "install": null,
      "notes": "Select the actual project environment or supported requirements/lock inputs. Uses external vulnerability data; can require dependency resolution. Not automatically installed or run.",
      "evidence": [
        "https://api.github.com/repos/pypa/pip-audit",
        "https://github.com/pypa/pip-audit"
      ]
    },
    {
      "id": "gitleaks",
      "name": "Gitleaks",
      "kind": "reference",
      "category": "security-tooling",
      "description": "Detect committed or working-tree secrets using configurable rules and allowlists.",
      "repository": "gitleaks/gitleaks",
      "homepage": "https://github.com/gitleaks/gitleaks",
      "license": "MIT",
      "stars": 30384,
      "checked_at": "2026-10-27",
      "last_pushed_at": "2026-10-23T20:45:02Z",
      "archived": false,
      "install": null,
      "notes": "Install the CLI or official CI integration, select history/directory scan scope, and keep findings private. Review and rotate real leaked credentials; deleting a finding does not revoke a secret.",
      "evidence": [
        "https://api.github.com/repos/gitleaks/gitleaks",
        "https://github.com/gitleaks/gitleaks"
      ]
    },
    {
      "id": "code-review-and-quality",
      "name": "Code Review and Quality",
      "kind": "skill",
      "category": "engineering-skills",
      "description": "Multi-axis review of a diff or pull request across correctness, readability, architecture, security, and performance before merge.",
      "repository": "addyosmani/agent-skills",
      "homepage": "https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d/skills/code-review-and-quality",
      "license": "MIT",
      "stars": 111131,
      "checked_at": "2026-10-28",
      "last_pushed_at": "2026-10-13T20:24:07Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/addyosmani/agent-skills/tar.gz/aeac41d4d005999432bb7312f7ff06383a91d59d",
        "sha256": "0211a580aab7d45c73886d6f96d2f0679416119b4f9add08b6ceea5c0c15fbf1",
        "ref": "aeac41d4d005999432bb7312f7ff06383a91d59d",
        "type": "skill",
        "subdir": "skills/code-review-and-quality",
        "license_path": "LICENSE"
      },
      "notes": "Single-file skill from a 25-skill engineering collection; the pinned directory contains only SKILL.md, so no supporting files are copied. It reviews any diff, including agent-authored work, and overlaps security-review on one axis only. Collection plugin manifests, hooks, and the other skills are not installed.",
      "evidence": [
        "https://api.github.com/repos/addyosmani/agent-skills",
        "https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d/skills/code-review-and-quality",
        "https://github.com/addyosmani/agent-skills/blob/aeac41d4d005999432bb7312f7ff06383a91d59d/LICENSE"
      ]
    },
    {
      "id": "observability-and-instrumentation",
      "name": "Observability and Instrumentation",
      "kind": "skill",
      "category": "delivery-workflows",
      "description": "Instrument features with logging, metrics, tracing, and alerting so production behavior is visible and diagnosable.",
      "repository": "addyosmani/agent-skills",
      "homepage": "https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d/skills/observability-and-instrumentation",
      "license": "MIT",
      "stars": 111131,
      "checked_at": "2026-10-28",
      "last_pushed_at": "2026-10-13T20:24:07Z",
      "archived": false,
      "install": {
        "url": "https://codeload.github.com/addyosmani/agent-skills/tar.gz/aeac41d4d005999432bb7312f7ff06383a91d59d",
        "sha256": "0211a580aab7d45c73886d6f96d2f0679416119b4f9add08b6ceea5c0c15fbf1",
        "ref": "aeac41d4d005999432bb7312f7ff06383a91d59d",
        "type": "skill",
        "subdir": "skills/observability-and-instrumentation",
        "license_path": "LICENSE"
      },
      "notes": "Same pinned archive as code-review-and-quality; the selected directory contains only SKILL.md. Covers production readiness after deployment-patterns but does not choose a telemetry vendor or configure collectors.",
      "evidence": [
        "https://api.github.com/repos/addyosmani/agent-skills",
        "https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d/skills/observability-and-instrumentation",
        "https://github.com/addyosmani/agent-skills/blob/aeac41d4d005999432bb7312f7ff06383a91d59d/LICENSE"
      ]
    },
    {
      "id": "hypothesis",
      "name": "Hypothesis",
      "kind": "reference",
      "category": "python-toolchain",
      "description": "Property-based testing for Python that generates inputs and shrinks failing examples.",
      "repository": "HypothesisWorks/hypothesis",
      "homepage": "https://hypothesis.readthedocs.io/",
      "license": "MPL-2.0",
      "stars": 9113,
      "checked_at": "2026-10-28",
      "last_pushed_at": "2026-10-26T17:23:29Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: a project test dependency rather than an agent skill or MCP server. Adds generated-case coverage next to the pytest entry; recording it does not run or configure any test suite.",
      "evidence": [
        "https://api.github.com/repos/HypothesisWorks/hypothesis",
        "https://hypothesis.readthedocs.io/",
        "https://github.com/HypothesisWorks/hypothesis/blob/master/LICENSE.txt"
      ]
    },
    {
      "id": "ty",
      "name": "ty",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Fast Rust-based Python type checker and language server with editor integrations.",
      "repository": "astral-sh/ty",
      "homepage": "https://docs.astral.sh/ty/",
      "license": "MIT",
      "stars": 19973,
      "checked_at": "2026-10-28",
      "last_pushed_at": "2026-10-27T16:21:19Z",
      "archived": false,
      "install": null,
      "notes": "Standalone LSP reference for the Astral toolchain alongside uv and Ruff; upstream labels it beta. Distributed as a PyPI binary (uvx ty check, ty server) and configured through the editor integration guide. Overlaps pyright on Python typing; configure one type checker per project. Not an MCP server, so no launch recipe is recorded.",
      "evidence": [
        "https://api.github.com/repos/astral-sh/ty",
        "https://docs.astral.sh/ty/features/language-server/",
        "https://docs.astral.sh/ty/editors/",
        "https://github.com/astral-sh/ty/blob/main/LICENSE"
      ]
    },
    {
      "id": "agent-lsp",
      "name": "agent-lsp",
      "kind": "lsp",
      "category": "lsp-bridge",
      "description": "MCP server that orchestrates native language servers into batch, refactor, and speculative-edit workflows for coding agents.",
      "repository": "blackwell-systems/agent-lsp",
      "homepage": "https://www.agent-lsp.com/",
      "license": "MIT",
      "stars": 166,
      "checked_at": "2026-10-28",
      "last_pushed_at": "2026-10-27T17:39:10Z",
      "archived": false,
      "install": null,
      "notes": "LSP bridge distributed as a single Go binary through an upstream install script, release archive, or container image; no pinned npx/uvx package exists, so no installer recipe is recorded. Unlike Serena it ships no symbol server of its own: it manages external servers (gopls, pyright, rust-analyzer) in one session and targets batch or preview workflows. Requires the underlying language servers to be installed separately.",
      "evidence": [
        "https://api.github.com/repos/blackwell-systems/agent-lsp",
        "https://github.com/blackwell-systems/agent-lsp",
        "https://github.com/blackwell-systems/agent-lsp/blob/main/docs/guide/speculative-execution.md",
        "https://github.com/blackwell-systems/agent-lsp/blob/main/LICENSE"
      ]
    },
    {
      "id": "code-review-graph",
      "name": "code-review-graph",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Local Tree-sitter code graph served over MCP for review context, change impact, and affected-test hints.",
      "repository": "tirth8205/code-review-graph",
      "homepage": "https://github.com/tirth8205/code-review-graph",
      "license": "MIT",
      "stars": 32459,
      "checked_at": "2026-10-29",
      "last_pushed_at": "2026-10-16T11:20:26Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--from",
          "code-review-graph==2.3.9",
          "code-review-graph",
          "serve",
          "--repo",
          "{project}"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "2.3.9",
        "runtime": "uv/uvx; Python >=3.10 selected by uvx"
      },
      "notes": "Pins the latest published PyPI release 2.3.9 (upstream tag v2.3.9). The upstream .mcp.json launches `uvx code-review-graph serve`; the recipe adds the documented --repo flag so the server always indexes the project apd configures. Graph data lives in the project directory (.code-review-graph) and is created by the CLI's own build/update commands, not by this recipe; upstream `install` additionally writes hooks, skills, and rules files, which apd does not do. Smoke-checked on macOS: `uvx --from code-review-graph==2.3.9 code-review-graph build` parsed a one-file temporary Python project (5 nodes, 5 edges), `status` reported the same graph, and the pinned launch command completed MCP initialize and listed 30 tools. No real repository indexing, agent session, or benchmark was run.",
      "evidence": [
        "https://api.github.com/repos/tirth8205/code-review-graph",
        "https://github.com/tirth8205/code-review-graph/blob/main/.mcp.json",
        "https://github.com/tirth8205/code-review-graph/blob/main/docs/USAGE.md",
        "https://pypi.org/project/code-review-graph/2.3.9/",
        "https://github.com/tirth8205/code-review-graph/blob/main/LICENSE"
      ]
    },
    {
      "id": "mcp-tools-py",
      "name": "MCP Tools Py",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Run pylint, pytest, mypy, Ruff, Bandit, formatting, and symbol refactors on one Python project through a scoped MCP server.",
      "repository": "MarcusJellinghaus/mcp-tools-py",
      "homepage": "https://github.com/MarcusJellinghaus/mcp-tools-py",
      "license": "MIT",
      "stars": 20,
      "checked_at": "2026-10-29",
      "last_pushed_at": "2026-10-23T12:39:42Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--from",
          "mcp-tools-py==0.1.10",
          "--with",
          "mcp<2",
          "mcp-tools-py",
          "--project-dir",
          "{project}"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.1.10",
        "runtime": "uv/uvx; Python >=3.11 selected by uvx"
      },
      "notes": "Python-specific companion to the reference-only pytest, Ruff, and Bandit entries: one server exposes the checks, formats, and symbol refactorings for a single project directory. The extra `--with mcp<2` pin is required because published 0.1.10 imports mcp.server.fastmcp without capping the mcp dependency, so the default resolution to mcp 2.x fails at startup; with the pin the server starts normally. The server runs the project's checks with its own environment by default and exposes --python-executable/--venv-path when pylint, pytest, and mypy live elsewhere; apd writes only the launch configuration. Smoke-checked on macOS: the pinned command completed MCP initialize (service 1.30.0) and listed 17 tools, including run_pylint_check, run_pytest_check, run_mypy_check, run_ruff_check, and rename_symbol. No check was executed against a real test suite.",
      "evidence": [
        "https://api.github.com/repos/MarcusJellinghaus/mcp-tools-py",
        "https://github.com/MarcusJellinghaus/mcp-tools-py#mcp-client-configuration",
        "https://pypi.org/project/mcp-tools-py/0.1.10/",
        "https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/INSTALL.md",
        "https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/LICENSE"
      ]
    },
    {
      "id": "codebase-memory-mcp",
      "name": "Codebase Memory MCP",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Local knowledge graph MCP server linking code, documentation, configuration, and infrastructure for navigation and change impact.",
      "repository": "DeusData/codebase-memory-mcp",
      "homepage": "https://deusdata.github.io/codebase-memory-mcp/",
      "license": "MIT",
      "stars": 47734,
      "checked_at": "2026-10-29",
      "last_pushed_at": "2026-10-28T17:16:38Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: releases ship a native pure-C binary plus install.sh/install.ps1, an upstream Homebrew formula, and a Nix flake, and the documented MCP configuration points at the installed executable rather than a registry launch command. The npm, PyPI, and Go packages of the same name only verify and cache that native runtime for the host, and the upstream installer also writes agent configuration, rules, skills, and hooks, so this catalog records no launch command for it and does not run the installer. Upstream reports 17 MCP tools, 162 parsed languages and formats, Hybrid LSP type resolution, an optional daemon plus UI, and 45 client integrations; indexing persists to a shared cache directory. Installation, indexing, and any MCP session were not run in this pass.",
      "evidence": [
        "https://api.github.com/repos/DeusData/codebase-memory-mcp",
        "https://github.com/DeusData/codebase-memory-mcp#mcp-tools",
        "https://github.com/DeusData/codebase-memory-mcp/blob/main/server.json",
        "https://deusdata.github.io/codebase-memory-mcp/",
        "https://github.com/DeusData/codebase-memory-mcp/blob/main/LICENSE"
      ]
    },
    {
      "id": "mcpls",
      "name": "mcpls",
      "kind": "lsp",
      "category": "lsp-bridge",
      "description": "MCP-to-LSP bridge that runs rust-analyzer, pyright, gopls, and other language servers and exposes 31 code tools to agents.",
      "repository": "bug-ops/mcpls",
      "homepage": "https://bug-ops.github.io/mcpls/",
      "license": "MIT OR Apache-2.0",
      "stars": 80,
      "checked_at": "2026-10-29",
      "last_pushed_at": "2026-10-28T21:48:33Z",
      "archived": false,
      "install": null,
      "notes": "Second reference-only LSP bridge next to agent-lsp, and the third bridge entry overall: it is distributed as a Rust binary through cargo install mcpls, an upstream install script, release archives, or a container image, so there is no registry package revision for the installer to pin. It manages several language servers in one session and exposes hover, references, diagnostics, and rename as 31 MCP tools, with stdio and optional HTTP transport; it needs at least one language server installed separately (pyright for Python). Repository metadata, the documentation book, license files, and release v0.8.0 were checked; no server startup or MCP session was run in this pass.",
      "evidence": [
        "https://api.github.com/repos/bug-ops/mcpls",
        "https://bug-ops.github.io/mcpls/getting-started/installation.html",
        "https://bug-ops.github.io/mcpls/tools/overview.html",
        "https://github.com/bug-ops/mcpls/releases/tag/v0.8.0",
        "https://github.com/bug-ops/mcpls/blob/main/LICENSE-MIT"
      ]
    },
    {
      "id": "awesome-copilot",
      "name": "Awesome Copilot",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "Community-contributed GitHub Copilot instructions, custom agents, skills, and prompts for Python and web projects.",
      "repository": "github/awesome-copilot",
      "homepage": "https://awesome-copilot.github.com/",
      "license": "MIT",
      "stars": 40570,
      "checked_at": "2026-10-30",
      "last_pushed_at": "2026-10-29T23:35:41Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: a very large community collection of instructions, chat modes, custom agent definitions, skills, prompts and per-language configuration for GitHub Copilot, contributed file by file rather than shipped as one pinnable artifact. This catalog records the collection and its setup documentation instead of copying a reviewed selection, so nothing here installs or activates any instruction file. Pick the files a project needs, review them as you would any third-party prompt, and follow the upstream contribution and license notes.",
      "evidence": [
        "https://api.github.com/repos/github/awesome-copilot",
        "https://github.com/github/awesome-copilot",
        "https://awesome-copilot.github.com/",
        "https://github.com/github/awesome-copilot/blob/main/LICENSE"
      ]
    },
    {
      "id": "chunkhound",
      "name": "ChunkHound",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Local-first codebase index served over MCP for cited code research across current code, git history, and web sources.",
      "repository": "chunkhound/chunkhound",
      "homepage": "https://chunkhound.ai/docs/getting-started/",
      "license": "MIT",
      "stars": 1455,
      "checked_at": "2026-10-30",
      "last_pushed_at": "2026-10-29T13:34:05Z",
      "archived": false,
      "install": null,
      "notes": "Reference only, after a launch check that did not pass: this is a recording boundary, not a judgement on the project, which is current, MIT-licensed and documented. Upstream documents `chunkhound mcp [path]` as the stdio server, but the server never answered an MCP `initialize` request inside a fresh project within a 300-second window on this host. It failed in two different ways: left to itself uvx resolved Python 3.10, whose scipy build does not load on arm64 macOS, so the process died before accepting a connection; with Python 3.12 pinned it started but then stalled for minutes on an outbound HTTPS request with idle CPU, with and without `--no-daemon` and `--no-embeddings`, so `tools/list` was never reached. `--read-only` avoids that startup path and fails fast instead, because it needs an index that a fresh project does not have. Indexing is a separate explicit step (`chunkhound index .`), the database is created inside the project at `.chunkhound/db`, and semantic search or deep research also needs an embedding or LLM provider and credentials. Nothing here configures the tool, indexes a repository, or calls one of its tools.",
      "evidence": [
        "https://api.github.com/repos/chunkhound/chunkhound",
        "https://github.com/chunkhound/chunkhound/blob/main/site/src/pages/docs/cli-reference.md",
        "https://pypi.org/project/chunkhound/6.1.0/",
        "https://chunkhound.ai/docs/getting-started/",
        "https://github.com/chunkhound/chunkhound/blob/main/LICENSE"
      ]
    },
    {
      "id": "fallow",
      "name": "Fallow",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "TypeScript and JavaScript codebase health over MCP: complexity, duplication, architecture boundaries, styling drift, and dead code.",
      "repository": "fallow-rs/fallow",
      "homepage": "https://fallow.tools/docs/integrations/mcp/",
      "license": "MIT",
      "stars": 5273,
      "checked_at": "2026-10-30",
      "last_pushed_at": "2026-10-29T20:23:46Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "--yes",
          "--package",
          "fallow@3.37.0",
          "fallow-mcp"
        ],
        "requirements": [
          "npx",
          "Node.js >=22"
        ],
        "version": "3.37.0",
        "runtime": "Node.js >=22 (npm package vendors a pinned per-platform binary)"
      },
      "notes": "Pins the current npm release 3.37.0 of the launcher package; upstream documents exactly this `npx --yes --package fallow fallow-mcp` stdio launch and notes that a `node_modules/.bin` copy is not on PATH, which is why the npx form is recorded here. The server analyses the directory it is launched in and has no documented project argument, so no {project} placeholder is used. `fallow agent install` additionally writes an AGENTS.md task map, installs two skills, registers the server, and adds git commit/push gates; apd performs none of that and writes only the launch configuration. The analysis targets TypeScript and JavaScript projects; CLI-backed calls expect a resolvable `fallow` binary unless FALLOW_BIN is set. Smoke-checked on macOS: the pinned launch command completed MCP initialize and listed its tools; no project was analysed.",
      "evidence": [
        "https://api.github.com/repos/fallow-rs/fallow",
        "https://fallow.tools/docs/integrations/mcp/",
        "https://www.npmjs.com/package/fallow/v/3.37.0",
        "https://github.com/fallow-rs/fallow#with-coding-agents",
        "https://github.com/fallow-rs/fallow/blob/main/LICENSE"
      ]
    },
    {
      "id": "skillevaluator",
      "name": "SkillEvaluator",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "NVIDIA framework that scores agent skill quality, detects overlap, and measures a skill's effect on live agent runs.",
      "repository": "NVIDIA/SkillEvaluator",
      "homepage": "https://docs.nvidia.com/skills/skillevaluator/",
      "license": "Apache-2.0",
      "stars": 612,
      "checked_at": "2026-10-30",
      "last_pushed_at": "2026-10-30T00:00:41Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the PyPI name `skillevaluator` is a zero-version placeholder and the documented quickstart runs `uv run --python 3.13 skillevaluator ...` from a source checkout, so there is no published package version for this catalog to pin. Skill directories are checked against the Agent Skills layout used by the other entries here. The static quality path needs no API key, scanner, GPU or container; model-backed rubric scoring needs an NVIDIA Build key and the security coverage needs separate scanners, so installing the catalog's skills does not evaluate them. Part of NVIDIA's Verified Skills pipeline.",
      "evidence": [
        "https://api.github.com/repos/NVIDIA/SkillEvaluator",
        "https://github.com/NVIDIA/SkillEvaluator",
        "https://docs.nvidia.com/skills/skillevaluator/",
        "https://github.com/NVIDIA/SkillEvaluator/blob/main/LICENSE"
      ]
    },
    {
      "id": "deptry",
      "name": "deptry",
      "kind": "reference",
      "category": "python-toolchain",
      "description": "Detects unused, missing, and transitive dependency issues in a Python project.",
      "repository": "osprey-oss/deptry",
      "homepage": "https://deptry.com/",
      "license": "MIT",
      "stars": 1498,
      "checked_at": "2026-11-01",
      "last_pushed_at": "2026-10-31T21:04:08Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: deptry is a CLI that must run inside the project's own environment, because it reads the metadata of installed distributions and the declared dependencies to compare them against the modules the source actually imports. It supports uv, Poetry, PDM, pip and any PEP 621 project, so it complements the packaging and dependency guidance the catalog already ships without being a skill, rule pack or MCP server for apd to configure. Upstream ships no MCP entry point and no launch command to pin. The repository moved from fpgmaas/deptry to osprey-oss/deptry and the GitHub API resolves the old path to the new name. Recording this tool neither adds it to a project nor runs the check; installing it in a project requires a dev-dependency install in that project's virtual environment.",
      "evidence": [
        "https://api.github.com/repos/osprey-oss/deptry",
        "https://github.com/osprey-oss/deptry/blob/main/LICENSE",
        "https://deptry.com/",
        "https://pypi.org/project/deptry/"
      ]
    },
    {
      "id": "osv-scanner",
      "name": "OSV-Scanner",
      "kind": "reference",
      "category": "security-tooling",
      "description": "Scans lockfiles, SBOMs, source trees and container images against the OSV vulnerability database.",
      "repository": "google/osv-scanner",
      "homepage": "https://google.github.io/osv-scanner/",
      "license": "Apache-2.0",
      "stars": 11342,
      "checked_at": "2026-11-01",
      "last_pushed_at": "2026-10-31T20:56:42Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: OSV-Scanner is a Go binary distributed through upstream release archives, a container image and a GitHub Action, so there is no registry package or dependency version for this catalog to pin, and no MCP entry point to configure. Its scope is wider than the Python-only pip-audit entry: it reads lockfiles and SBOMs across many ecosystems and can scan container images and Linux packages. Scanning needs network access to the OSV.dev API (a local database and offline mode exist for air-gapped runs), and results are advisory matches against a database that changes continuously. Recording it neither installs a scanner, runs a scan, nor establishes an audit result, and it does not replace reviewing the advisories it reports.",
      "evidence": [
        "https://api.github.com/repos/google/osv-scanner",
        "https://github.com/google/osv-scanner/blob/main/LICENSE",
        "https://google.github.io/osv-scanner/",
        "https://osv.dev/"
      ]
    },
    {
      "id": "pyrefly",
      "name": "Pyrefly",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Rust-written Python type checker with a full language server for navigation, completion and inlay hints.",
      "repository": "meta/pyrefly",
      "homepage": "https://pyrefly.org/",
      "license": "MIT",
      "stars": 7172,
      "checked_at": "2026-11-01",
      "last_pushed_at": "2026-10-31T23:55:56Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: Pyrefly is a raw Python language server, not an MCP bridge, so it keeps kind lsp with install null like pyright, ty and Python LSP Server. It is installed as an editor extension or as the `pyrefly` package, and the language server is the `pyrefly lsp` subcommand: upstream's own VSCode extension defaults `pyrefly.lspArguments` to `[\"lsp\"]`, and neovim/nvim-lspconfig registers the same command as `cmd = { 'pyrefly', 'lsp' }`. It is the third Python type-checking server in this catalog alongside pyright and ty, and upstream's installation notes tell you to disable other Python language servers, so a project should enable one of the three. Upstream does not follow strict semantic versioning: minor releases may introduce new type errors, and `pyrefly init` plus `pyrefly suppress` are the documented adoption path. No language-server handshake, editor session or MCP session was run for this entry; the metadata, the documented launch command and the client registration were verified against upstream files only.",
      "evidence": [
        "https://api.github.com/repos/meta/pyrefly",
        "https://github.com/meta/pyrefly/blob/main/LICENSE",
        "https://pyrefly.org/en/docs/IDE/",
        "https://github.com/neovim/nvim-lspconfig/blob/master/lsp/pyrefly.lua"
      ]
    },
    {
      "id": "repomix",
      "name": "Repomix",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Packs a repository into a single AI-friendly file and serves packing, searching and reading over MCP.",
      "repository": "yamadashy/repomix",
      "homepage": "https://repomix.com",
      "license": "MIT",
      "stars": 29100,
      "checked_at": "2026-11-01",
      "last_pushed_at": "2026-10-31T22:00:10Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "repomix@1.18.1",
          "--mcp"
        ],
        "requirements": [
          "npx",
          "Node.js >=22"
        ],
        "version": "1.18.1",
        "runtime": "Node.js >=22 selected by npx"
      },
      "notes": "Pins the current npm release 1.18.1; upstream documents `repomix --mcp` as the stdio server and the npx form as the client configuration, and the package declares Node.js >=22. Without `--sandbox` the server may read any path the host user can and trusts the `repomix.config.*` of whatever directory it packs, which upstream describes as running code; `repomix --mcp --sandbox path/to/project` confines the file tools to one workspace and drops the config loading, remote packing and skill generation paths. This recipe records the documented default and does not enable sandbox mode, so point the server at projects you trust. Upstream also ships a Claude Code plugin, agent-skill generation and a GitHub Action, none of which apd configures. Smoke-checked on macOS with the pinned launch command: MCP initialize succeeded and the server reported `repomix-mcp-server` 1.18.1 with six tools. No repository was packed and no MCP tool was invoked.",
      "evidence": [
        "https://api.github.com/repos/yamadashy/repomix",
        "https://github.com/yamadashy/repomix/blob/main/website/client/src/en/guide/mcp-server.md",
        "https://repomix.com/guide/mcp-server",
        "https://github.com/yamadashy/repomix/blob/main/LICENSE"
      ]
    },
    {
      "id": "roam-code",
      "name": "roam-code",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Serve a reusable local codebase index over MCP for symbol search, dependency and coupling maps, dead-code, taint and change-impact questions.",
      "repository": "Cranot/roam-code",
      "homepage": "https://roam-code.com/",
      "license": "Apache-2.0",
      "stars": 516,
      "checked_at": "2026-11-02",
      "last_pushed_at": "2026-10-31T03:59:35Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--from",
          "roam-code[mcp]==14.1.0",
          "roam",
          "mcp"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "14.1.0",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (package requires >=3.10)"
      },
      "notes": "Pins the published PyPI release 14.1.0 with its `mcp` extra, matching upstream tag v14.1.0-r1. The launcher pins `--python 3.12` because the package requires Python >=3.10 while an unpinned `uvx` resolution on the smoke host selected Python 3.9 and exited before the MCP handshake; without the pin the entry fails on any machine whose default `python3` is older than 3.10. `roam mcp` analyses the directory the server starts in and keeps an SQLite index plus lock/state sidecars in `.roam/`; upstream documents `roam init` (index plus project configuration) and `roam index` (index only), `ROAM_DB_DIR` to relocate the store, and `ROAM_NO_AUTO_INDEX=1` to refuse implicit builds. The CLI and MCP server are Apache-2.0 and need no account or API key for local analysis; upstream's paid layers (PR Replay reports and a planned Roam Cloud) are not used by this recipe, and its README states that ordinary local analysis does not upload source code, indexes, findings or telemetry. Smoke-checked on macOS: the pinned command completed MCP initialize (server roam-code 14.1.0, protocol 2025-11-25) and listed 17 tools, including roam_search_symbol, roam_deps, roam_uses, roam_dead_code, roam_coupling, roam_taint, roam_grep, roam_file_info and roam_metrics. No tool was called when the check ran, so index quality, language coverage and answer correctness are unverified.",
      "evidence": [
        "https://api.github.com/repos/Cranot/roam-code",
        "https://github.com/Cranot/roam-code/blob/main/README.md",
        "https://github.com/Cranot/roam-code/blob/main/docs/mcp-tools.md",
        "https://pypi.org/project/roam-code/14.1.0/",
        "https://github.com/Cranot/roam-code/blob/main/LICENSE"
      ]
    },
    {
      "id": "orm-lens",
      "name": "orm-lens",
      "kind": "mcp",
      "category": "python-toolchain",
      "description": "Answer Django model questions over MCP from static parsing — relations, ER diagrams, migration risk, N+1 candidates and schema drift — with SQLAlchemy and Alembic preview support.",
      "repository": "FROWNINGdev/orm-lens",
      "homepage": "https://frowningdev.github.io/orm-lens/",
      "license": "MIT",
      "stars": 96,
      "checked_at": "2026-11-02",
      "last_pushed_at": "2026-10-31T09:36:12Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--from",
          "orm-lens[mcp]==1.16.0",
          "orm-lens-mcp"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "1.16.0",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the `mcp` extra requires >=3.10)"
      },
      "notes": "Pins the published PyPI release 1.16.0 (renamed from django-orm-lens; the old name still resolves to the same distribution). The base package accepts Python >=3.9 but the `mcp` extra needs >=3.10, so the launcher pins `--python 3.12` for a deterministic resolution. The server parses model and migration files statically: upstream states it needs no database, no `runserver` and no working virtualenv, and that it still reports every app and model from a cold clone with a broken environment. Django models and migrations are the main target; SQLAlchemy models, Alembic revisions and FastAPI/Flask projects are documented as preview support. Everything this recipe uses ships under MIT and needs no account or subscription; upstream's comparison table marks only a competing IDE as paid. The same repository also ships a VS Code/Open VSX extension, an `orm-lens` CLI, a pre-commit hook shim and an agent skill directory; this recipe writes only the MCP launch configuration and installs none of those. Smoke-checked on macOS: the pinned command completed MCP initialize (server orm-lens 1.16.0, protocol 2025-11-25) and listed 13 tools, including list_models, find_relations, er_diagram, cascade_preview, nplusone_scan, drift and impact. The temporary project held a one-model `models.py`; no real Django or SQLAlchemy project was analysed and no tool was called.",
      "evidence": [
        "https://api.github.com/repos/FROWNINGdev/orm-lens",
        "https://github.com/FROWNINGdev/orm-lens/blob/main/README.md",
        "https://github.com/FROWNINGdev/orm-lens/blob/main/cli/pyproject.toml",
        "https://pypi.org/project/orm-lens/1.16.0/",
        "https://github.com/FROWNINGdev/orm-lens/blob/main/LICENSE"
      ]
    },
    {
      "id": "lsp-mcp-server",
      "name": "lsp-mcp-server",
      "kind": "lsp",
      "category": "lsp-bridge",
      "description": "Bridge MCP clients to whichever language server a project configures, exposing navigation, references, diagnostics, completion and edits as 29 tools.",
      "repository": "ProfessioneIT/lsp-mcp-server",
      "homepage": "https://www.professioneit.com/en/blog/lsp-mcp-server/",
      "license": "MIT",
      "stars": 24,
      "checked_at": "2026-11-02",
      "last_pushed_at": "2026-10-22T16:14:06Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "lsp-mcp-server@1.1.27"
        ],
        "requirements": [
          "npx",
          "Node.js >=18"
        ],
        "version": "1.1.27",
        "runtime": "npx; Node.js >=18; language-server executables must be installed and on the agent's PATH"
      },
      "notes": "The second installable bridge next to Serena, and a TypeScript one rather than a Python one: it drives whatever language server the project configures, so Python coverage depends on pyright, python-lsp-server or another LSP binary installed separately. Pins npm release 1.1.27, which is upstream tag v1.1.27 (commit 2b9005387fbf5ebd101ec84cfc34a8196bf9d347). Custom server settings live in a project `.lsp-mcp.json`; upstream's Codex and Claude Code guides add the MCP entry and recommend a longer tool timeout because the first call starts a language server and its initial analysis. The npm package also ships a SKILL.md that teaches tool selection and warns that it should be re-copied when the server version changes; the catalog installs only the MCP launch configuration. Smoke-checked on macOS: the pinned command completed MCP initialize (server lsp-mcp-server 1.1.27) and listed 29 tools including lsp_goto_definition, lsp_find_references, lsp_hover, lsp_diagnostics, lsp_rename and lsp_format_document. No language server was started through it, no project file was read by a tool call and no agent client was configured, so the LSP round trip itself is unverified; Serena remains the bridge exercised through a profile.",
      "evidence": [
        "https://api.github.com/repos/ProfessioneIT/lsp-mcp-server",
        "https://github.com/ProfessioneIT/lsp-mcp-server/blob/main/README.md",
        "https://github.com/ProfessioneIT/lsp-mcp-server/blob/main/SKILL.md",
        "https://www.npmjs.com/package/lsp-mcp-server/v/1.1.27",
        "https://github.com/ProfessioneIT/lsp-mcp-server/blob/main/LICENSE"
      ]
    },
    {
      "id": "ai-rulez",
      "name": "ai-rulez",
      "kind": "reference",
      "category": "engineering-rules",
      "description": "Compile one rules, skills and MCP source into native instruction files for dozens of coding agents, with lock files, signing and policy enforcement.",
      "repository": "Goldziher/ai-rulez",
      "homepage": "https://goldziher.github.io/ai-rulez/",
      "license": "MIT",
      "stars": 166,
      "checked_at": "2026-11-02",
      "last_pushed_at": "2026-11-01T09:37:42Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the npm and PyPI packages of the same name are Go installer wrappers that download a native release binary, so there is no registry launch command this catalog can pin. On the smoke host the wrapper's own fetch of the v5.10.0 darwin/arm64 archive timed out and retried before any MCP handshake, which matches the codebase-memory-mcp pattern of a wrapper rather than a pinnable server. Upstream also publishes the binary as release archives, through Homebrew and as a Go module. It is an authoring and governance layer for agent knowledge - one `.ai-rulez/` source generates native files for the harnesses a team uses, with `ai-rulez.lock` pins, Sigstore signing, SBOM output, reviewer approvals, an organization policy layer and its own read-only MCP server for configuration reports and skill serving. The catalog's skill and rule-pack recipes model copied files, not generated output across dozens of targets, so nothing is copied or activated here; it overlaps `skills-cli` and `awesome-copilot` as discovery and authoring tooling. Recorded so a project can evaluate the folder layout and lock model before adopting it.",
      "evidence": [
        "https://api.github.com/repos/Goldziher/ai-rulez",
        "https://github.com/Goldziher/ai-rulez/blob/main/README.md",
        "https://github.com/Goldziher/ai-rulez/blob/main/docs/cli-reference.md",
        "https://github.com/Goldziher/ai-rulez/blob/main/docs/lockfile.md",
        "https://github.com/Goldziher/ai-rulez/blob/main/LICENSE"
      ]
    },
    {
      "id": "headroom",
      "name": "Headroom",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Local context-compression layer that shrinks tool output, logs, files and RAG chunks before they reach the model, with cached originals retrievable over MCP.",
      "repository": "headroomlabs-ai/headroom",
      "homepage": "https://docs.headroomlabs.ai/docs",
      "license": "Apache-2.0",
      "stars": 78668,
      "checked_at": "2026-11-03",
      "last_pushed_at": "2026-11-02T13:17:36Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.13",
          "--from",
          "headroom-ai[mcp]==0.42.0",
          "headroom",
          "mcp",
          "serve"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.42.0",
        "runtime": "uv/uvx; Python 3.13 pinned for the launcher (package requires >=3.10)"
      },
      "notes": "Pins the published PyPI release 0.42.0 with its `mcp` extra; upstream's registry entry and MCP docs describe the same `headroom mcp serve` contract, which a client can also write through `headroom mcp install`. The launcher pins `--python 3.13` because the package requires Python 3.10 or newer and an unpinned `uvx` can resolve to an older default interpreter, the same reason the roam-code recipe pins. The CLI ships only in the PyPI package: the npm `headroom-ai` package is the TypeScript SDK and provides no `headroom` command, and upstream notes that Codex and other clients which do not inherit an interactive PATH need the absolute path to the `headroom` executable. Only the MCP server mode is configured here. Upstream's proxy, `headroom wrap` (which also registers Serena for the wrapped project), `headroom learn` and cross-agent memory are separate features a project should evaluate on its own, and this recipe does not install the `[ml]` extra that downloads the Kompress-v2-base model from Hugging Face. The README states that compression runs locally and that prompt and file content is not sent anywhere to be compressed. Smoke-checked on macOS: the pinned command completed MCP initialize (server headroom, reported version 1.30.0, protocol 2025-11-25) and listed the three tools headroom_compress, headroom_retrieve and headroom_stats. No tool was called, so compression ratios, retrieval fidelity and token savings are unverified.",
      "evidence": [
        "https://api.github.com/repos/headroomlabs-ai/headroom",
        "https://github.com/headroomlabs-ai/headroom/blob/main/README.md",
        "https://github.com/headroomlabs-ai/headroom/blob/main/server.json",
        "https://pypi.org/project/headroom-ai/0.42.0/",
        "https://docs.headroomlabs.ai/docs/mcp",
        "https://github.com/headroomlabs-ai/headroom/blob/main/LICENSE"
      ]
    },
    {
      "id": "open-code-review",
      "name": "Open Code Review",
      "kind": "reference",
      "category": "engineering-skills",
      "description": "Alibaba's agent-driven code review CLI: deterministic analysis pipelines feed a tuned review model, with matching skills and plugins for Claude Code, Codex, Cursor and OpenCode.",
      "repository": "alibaba/open-code-review",
      "homepage": "https://open-codereview.ai",
      "license": "Apache-2.0",
      "stars": 49294,
      "checked_at": "2026-11-03",
      "last_pushed_at": "2026-11-02T15:05:55Z",
      "archived": false,
      "install": null,
      "notes": "Reference only. The review engine is a standalone CLI (`npm install -g @alibaba-group/open-code-review`, command `ocr`) that needs an LLM provider and an API key configured through its own interactive setup, plus repository access and per-review token spend, so there is no skill or MCP recipe this catalog can pin. Upstream ships the pieces this collection models as separate artifacts: portable agent skills under `skills/open-code-review` (review) and `skills/open-code-review-delegate`, a Claude Code plugin marketplace in `.claude-plugin/`, and per-agent plugin directories under `plugins/open-code-review/` for Claude Code, Codex, Cursor, Kimi Code, OpenCode and QCA Forward, including an OpenCode tool set. Delegation mode runs the review through the calling agent's own model and needs no OCR API key, which is the cheapest way to try it. Upstream's own benchmark table claims higher precision and F1 than a general-purpose agent at roughly one ninth of the tokens, with deliberately lower recall; those numbers are upstream measurements and were not reproduced here. It overlaps `code-review-and-quality` (portable review guidance) and `code-review-graph` (local review context served over MCP) but is the first entry in this catalog that is an actual review engine. No review was executed, no plugin was installed and no skill was activated for this entry; the install command, plugin layout and skill directories were read from upstream files only.",
      "evidence": [
        "https://api.github.com/repos/alibaba/open-code-review",
        "https://github.com/alibaba/open-code-review/blob/main/README.md",
        "https://github.com/alibaba/open-code-review/tree/main/skills/open-code-review",
        "https://github.com/alibaba/open-code-review/tree/main/plugins/open-code-review",
        "https://open-codereview.ai",
        "https://github.com/alibaba/open-code-review/blob/main/LICENSE"
      ]
    },
    {
      "id": "mcp-inspector",
      "name": "MCP Inspector",
      "kind": "reference",
      "category": "build-mcp",
      "description": "The reference MCP debugging client: launch, inspect and call any stdio, SSE or streamable-HTTP server from a web UI, TUI or CLI.",
      "repository": "modelcontextprotocol/inspector",
      "homepage": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector",
      "license": "MIT and Apache-2.0 (project relicensing in progress)",
      "stars": 11216,
      "checked_at": "2026-11-03",
      "last_pushed_at": "2026-10-29T06:32:33Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the Inspector is an interactive client and debugger for MCP servers, not an MCP server a project registers, so it keeps kind reference with install null next to `fastmcp` and `mcp-python-sdk`. Upstream runs it with `npx @modelcontextprotocol/inspector` (web UI), `--cli` (scriptable), `--tui`, or the bundled `mcpdo` runner, and `npm install -g @modelcontextprotocol/inspector` or Docker are the documented alternatives; every mode downloads a package at start, so nothing is written into a project. It is the practical way to check whether a newly configured server in this catalog actually completes initialization and exposes the tools its recipe claims - the same handshake `scripts/smoke_mcp.py` performs - and to call individual tools with hand-written arguments, which the smoke check deliberately does not do. Secrets entered in the UI (OAuth tokens, client secrets, stdio `env:` values) are stored in the OS keychain where available and otherwise in an unencrypted `~/.mcp-inspector/secrets.json`, as upstream documents in docs/secret-storage.md. The repository is on its v2 line: active development is on `v2/main`, merged into `main` at milestones, with security-only fixes for v1 on the npm `v1-latest` tag; pinning is left to the user because the inspector is a global dev tool. No server was launched, no tool was called and no secret was stored for this entry.",
      "evidence": [
        "https://api.github.com/repos/modelcontextprotocol/inspector",
        "https://github.com/modelcontextprotocol/inspector/blob/main/README.md",
        "https://github.com/modelcontextprotocol/inspector/blob/main/docs/secret-storage.md",
        "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector",
        "https://github.com/modelcontextprotocol/inspector/blob/main/LICENSE"
      ]
    },
    {
      "id": "mcp-toolbox",
      "name": "MCP Toolbox for Databases",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Google's MCP server and framework that connects coding agents to PostgreSQL, MySQL, SQLite, BigQuery and other databases with prebuilt or hand-defined SQL tools.",
      "repository": "googleapis/mcp-toolbox",
      "homepage": "https://mcp-toolbox.dev/",
      "license": "Apache-2.0",
      "stars": 16792,
      "checked_at": "2026-11-03",
      "last_pushed_at": "2026-11-02T23:43:59Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the server is a Go binary published as platform npm packages (`npx -y @toolbox-sdk/server --prebuilt=postgres --stdio`), an OCI image and release archives, and every useful launch needs a connection decision this catalog cannot make for a project. Prebuilt mode reads credentials from environment variables per database, while the framework mode needs a hand-written `tools.yaml` that defines sources, tools and toolsets - parameters a recipe cannot guess, and credentials that must never be committed. A launch without either exits or exposes nothing, so no MCP handshake was run for this entry. It is the broadest database integration in this collection: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, CockroachDB, ClickHouse, Couchbase, Neo4j, Snowflake, Trino, plus Google Cloud AlloyDB, Cloud SQL, Spanner, BigQuery and Firestore. For a Python or web project the prebuilt `list_tables` and `execute_sql` tools are the quick path to schema exploration and database-aware code, and the SDKs (`toolbox-core` on PyPI, `@toolbox-sdk/core` on npm) embed the same tools in application code. Star count is a dated observation. Reviewed from the README, `server.json`, the npm package manifest and the documentation quickstart only.",
      "evidence": [
        "https://api.github.com/repos/googleapis/mcp-toolbox",
        "https://github.com/googleapis/mcp-toolbox/blob/main/README.md",
        "https://github.com/googleapis/mcp-toolbox/blob/main/server.json",
        "https://github.com/googleapis/mcp-toolbox/blob/main/npm/server/package.json",
        "https://mcp-toolbox.dev/documentation/introduction/",
        "https://github.com/googleapis/mcp-toolbox/blob/main/LICENSE"
      ]
    },
    {
      "id": "ripwire",
      "name": "ripwire",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "Ranked, deterministic call-graph CLI that maps a repository before an agent reads it and checks an edit's blast radius, reachable tests and quality regressions, with an optional MCP interface.",
      "repository": "redhat-et/ripwire",
      "homepage": "https://github.com/redhat-et/ripwire",
      "license": "Apache-2.0",
      "stars": 2513,
      "checked_at": "2026-11-04",
      "last_pushed_at": "2026-11-04T00:00:15Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: ripwire is a self-contained C++ binary distributed through a curl-piped installer (`RIPWIRE_REPO=redhat-et/ripwire bash -c \"$(curl -fsSL https://raw.githubusercontent.com/redhat-et/ripwire/main/scripts/install.sh)\"`), SHA-256-verified GitHub release archives and a from-source CMake build, and no package of this name exists on npm or PyPI, so there is no registry command for a recipe to pin. The one-line install also stages seventeen task-shaped skills under `~/.local/share/ripwire/skills` and activates them for every agent it finds (Claude Code, Codex, Cursor, Windsurf, Gemini, opencode, aider) - a machine-level change beyond what the installers here write. The MCP server is the optional second interface of the same binary (`ripwire --mcp`, wired up as `claude mcp add ... -- ripwire --mcp`), which is why no registry launch command and no MCP handshake exist for this entry. What it gives a Python or web project: a ranked, deterministic call graph that answers what to touch, what an edit breaks and which tests reach it (`--pack-task`, `--outline`, `--slice`, `--expand`, `--compress`), edit-time checks (`--edit-check`, `--pr-context`, `--merge-scout`), quality deltas that report only regressions across twelve kinds (`--quality-panel`, `--hotspots`, `--clones`, `--metrics`, `--deps`, `--lint`), ambiguous-name and forgotten-co-change detection, and `--scan-skill`/`--scan-skills` for reviewing an agent skill file before installing it. Bodies are redacted by default while identifiers and signatures never are. It overlaps `code-review-graph`, `repomix` and `codebase-memory-mcp` as code-context tooling, with a CLI-first, offline, single-binary shape and an explicit comparison against a graph-database context server in its own docs. Star count is a dated observation. Reviewed from the README, INSTALL.md, docs/COMMANDS.md and the release page only; nothing was installed.",
      "evidence": [
        "https://api.github.com/repos/redhat-et/ripwire",
        "https://github.com/redhat-et/ripwire/blob/main/README.md",
        "https://github.com/redhat-et/ripwire/blob/main/INSTALL.md",
        "https://github.com/redhat-et/ripwire/blob/main/docs/COMMANDS.md",
        "https://github.com/redhat-et/ripwire/releases/latest",
        "https://github.com/redhat-et/ripwire/blob/main/LICENSE"
      ]
    },
    {
      "id": "hippo-memory",
      "name": "Hippo",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Local-first long-term memory server for coding agents that stores project or global memories over MCP, strengthens them on recall and lets mistakes decay.",
      "repository": "kitfunso/hippo-memory",
      "homepage": "https://hippo-memory.com",
      "license": "MIT",
      "stars": 791,
      "checked_at": "2026-11-04",
      "last_pushed_at": "2026-11-03T23:57:48Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "hippo-memory@3.2.2",
          "mcp"
        ],
        "requirements": [
          "npx",
          "Node.js >=22.16"
        ],
        "version": "3.2.2",
        "runtime": "npx (Node.js 22.16 or newer, which the package declares in engines); the memory store is local - `~/.hippo` globally, or `.hippo/` in a project after `hippo init`"
      },
      "notes": "Pins the published npm release 3.2.2 in the form upstream documents for a client that does not want a global install (`\"command\": \"npx\", \"args\": [\"-y\", \"hippo-memory\", \"mcp\"]`); its README shows the same server as `hippo mcp` and `claude mcp add hippo-memory -- hippo mcp` for Claude Code. Only the MCP launch configuration is written here: `hippo init` does more - it inserts a Hippo block into instruction files that already exist (`CLAUDE.md`, `AGENTS.md`; it never creates one), adds a daily 6:15am run through crontab or the Windows scheduler, and learns from each registered project's git history, with `--no-hooks`, `--no-schedule` and `--no-learn` to limit that and Codex session capture opt-in through `hippo hook`. With no store present the first tool call creates the global store in `~/.hippo`; a project store appears only after `hippo init`. Requires Node.js 22.16 or newer and has no other runtime dependency. The design claim is outcome learning rather than storage with search: memories are strengthened each time they are recalled, a memory marked wrong drops out of the top results, and stale ones decay; the same server is documented for Cursor, Claude Code, Codex, OpenCode and OpenClaw, and data stays local. It overlaps `codebase-memory-mcp` and `headroom` in name only - this stores what an agent learned across sessions rather than a code index or compressed tool output. Upstream publishes its evals including failures and a retracted magnitude, and records that on Z0 round 2 over 16 repositories the repeat-mistake drop was not shown (-8.9 points, under the pre-registered 15-point minimum) while teach and correction turns cost about 12% less. Smoke-checked on macOS: the pinned command completed MCP initialize (server hippo-memory, reported version 3.2.2, protocol 2024-11-05) and listed 13 tools including hippo_recall, hippo_remember, hippo_outcome, hippo_conflicts and hippo_status. No tool was called, so recall quality, decay behaviour and the benchmark claims are unverified here.",
      "evidence": [
        "https://api.github.com/repos/kitfunso/hippo-memory",
        "https://github.com/kitfunso/hippo-memory/blob/master/README.md",
        "https://github.com/kitfunso/hippo-memory/blob/master/llms-install.md",
        "https://github.com/kitfunso/hippo-memory/blob/master/LICENSE",
        "https://hippo-memory.com/mcp/",
        "https://registry.npmjs.org/hippo-memory/latest"
      ]
    },
    {
      "id": "reticle",
      "name": "Reticle",
      "kind": "mcp",
      "category": "browser",
      "description": "MCP server that drives a web app from inside a real browser and returns pass/fail/cannot-tell verdicts with the file:line to fix, for change verification, access control, accessibility, performance and SEO checks.",
      "repository": "reticlehq/reticle",
      "homepage": "https://docs.reticle.sh",
      "license": "Apache-2.0",
      "stars": 1308,
      "checked_at": "2026-11-04",
      "last_pushed_at": "2026-11-04T00:02:50Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "@reticlehq/server@3.9.0",
          "mcp"
        ],
        "requirements": [
          "npx",
          "Node.js >=20.11"
        ],
        "version": "3.9.0",
        "runtime": "npx (Node.js 20.11 or newer, which the package declares in engines); a real browser and the project's own running app are needed before a flow can be verified"
      },
      "notes": "Pins the published npm release 3.9.0 in the form upstream documents for an existing client config (`\"command\": \"npx\", \"args\": [\"-y\", \"@reticlehq/server@3.9.0\", \"mcp\"]`); the README also describes a one-time CLI setup (the one-line installer `curl -fsSL https://raw.githubusercontent.com/reticlehq/reticle/main/install/install.sh | sh` plus a PowerShell equivalent, then `reticle setup mcp`). Those fuller paths do more than this catalog writes: they append blocks to `CLAUDE.md`, `AGENTS.md`, `RETICLE.md` and `.claude/commands/reticle.md`, add a prompt hook to each agent's project config so the agent verifies before claiming done, and keep run state under `.reticle/`, with `--no-mcp` skipping the files. The agent drives the project's own running app from inside a real browser and gets a verdict with the file:line behind it, so a browser and a served app are prerequisites before anything can be verified. Anonymous usage counts are sent by default (`reticle telemetry disable`, `RETICLE_TELEMETRY=0` or `DO_NOT_TRACK=1`); prompts stay redacted locally and are only uploaded after the project is linked with `reticle connect` or `RETICLE_API_KEY` in CI. Verdicts and evidence are computed locally and need no account. Playwright is the closest neighbour in this collection - both drive a browser - but this one is asked for a verdict rather than raw page state, which is what its own \"why not Playwright\" section argues. Every npm package in the repository became Apache-2.0 in this release, which is why the repository-level LICENSE file reads as an overview and GitHub reports the licence as unrecognised. Smoke-checked on macOS: the pinned command completed MCP initialize (server reticle, reported version 3.9.0, protocol 2025-11-25) and listed 10 tools. The handshake ran in a temporary directory with no app and no browser, and no tool was called, so no real flow, verdict or check was verified.",
      "evidence": [
        "https://api.github.com/repos/reticlehq/reticle",
        "https://github.com/reticlehq/reticle/blob/main/README.md",
        "https://github.com/reticlehq/reticle/blob/main/install/install.sh",
        "https://github.com/reticlehq/reticle/blob/main/LICENSE",
        "https://docs.reticle.sh",
        "https://registry.npmjs.org/@reticlehq/server/latest"
      ]
    },
    {
      "id": "tombi",
      "name": "Tombi",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Schema-driven TOML formatter, linter and language server that gives editors and coding agents completion, diagnostics and formatting for project configuration such as pyproject.toml.",
      "repository": "tombi-toml/tombi",
      "homepage": "https://tombi-toml.github.io/tombi/",
      "license": "MIT",
      "stars": 1192,
      "checked_at": "2026-11-04",
      "last_pushed_at": "2026-11-04T00:06:24Z",
      "archived": false,
      "install": null,
      "notes": "Reference only, alongside the other standalone language servers: Tombi is a raw LSP server (`tombi lsp`), not an MCP server, so no MCP handshake applies and no launch recipe is pinned. It is one Rust binary reachable through a curl installer, `brew install tombi`, `winget`, `uvx tombi` / `uv add --dev tombi` / `uv tool install tombi` on Python and `npx tombi` / `npm install -g tombi` on npm, with the same binary behind the VS Code, Open VSX, Zed, JetBrains, Helix, Neovim and Emacs integrations, so the command worth writing depends on the client a project already uses. Its relevance here is configuration rather than Python source: `pyproject.toml`, uv, ruff and pytest settings are all TOML, and Tombi validates and formats them against the JSON Schema Store with auto-sorted keys, so an agent editing project configuration gets diagnostics instead of a plausible-looking file. The helptext of an editor integration shows the shape - root markers `tombi.toml`, `pyproject.toml`, `.git`. It is the only configuration-file language server in this collection; the others cover Python, TypeScript, Go, Rust and C++ source. Star count is a dated observation. Reviewed from the repository README, the installation and language-server documentation pages and the npm and PyPI package metadata; nothing was installed and no editor session was run.",
      "evidence": [
        "https://api.github.com/repos/tombi-toml/tombi",
        "https://github.com/tombi-toml/tombi/blob/main/README.md",
        "https://github.com/tombi-toml/tombi/blob/main/LICENSE",
        "https://tombi-toml.github.io/tombi/docs/installation",
        "https://tombi-toml.github.io/tombi/docs/language-server",
        "https://pypi.org/project/tombi/"
      ]
    },
    {
      "id": "graphify",
      "name": "graphify",
      "kind": "reference",
      "category": "engineering-skills",
      "description": "Turn a repository, its documentation, SQL schemas and configuration into a queryable knowledge graph through a coding-agent skill that answers architecture, dependency and change-impact questions from local deterministic parsing with no vector store.",
      "repository": "Graphify-Labs/graphify",
      "homepage": "https://www.graphify.com",
      "license": "Apache-2.0",
      "stars": 142432,
      "checked_at": "2026-11-05",
      "last_pushed_at": "2026-11-03T22:46:46Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the entry point is a CLI-registered agent skill, not a pinnable launch configuration. The graph engine ships as the PyPI package `graphifyy` (`uv tool install graphifyy` or `pipx install graphifyy`, Python 3.10+) and `graphify install` detects the assistants on the machine (Claude Code, Codex, Cursor, Gemini CLI, CodeBuddy, plus a Windows variant) and registers the `/graphify` skill, with `--project` and `--platform` for a scoped registration. Copying the skill directory alone would leave a project with graph query instructions and no engine, which is the same boundary recorded for `open-code-review`, and the registration writes into agent configuration the way `ripwire` does. Its distinguishing property is determinism rather than retrieval: local AST parsing over source, docs, SQL schemas, configs and PDFs, every edge explained with its origin, and no vector store or embedding provider, so answers can be traced instead of ranked by similarity. The repository also carries the engine package (`graphify/`), `docs/how-it-works.md`, `docs/docker-mcp-sqlite.md`, benchmarks and its own AGENTS.md. Apache-2.0 with an additional `LICENSE-MIT` file, and the default branch is named `v8`. Star count is a dated observation. Reviewed from the README, `docs/how-it-works.md`, `pyproject.toml` and the license files only; nothing was installed and no graph was built.",
      "evidence": [
        "https://api.github.com/repos/Graphify-Labs/graphify",
        "https://github.com/Graphify-Labs/graphify/blob/v8/README.md",
        "https://github.com/Graphify-Labs/graphify/blob/v8/docs/how-it-works.md",
        "https://github.com/Graphify-Labs/graphify/blob/v8/pyproject.toml",
        "https://github.com/Graphify-Labs/graphify/blob/v8/LICENSE",
        "https://pypi.org/project/graphifyy/"
      ]
    },
    {
      "id": "codeboarding",
      "name": "CodeBoarding",
      "kind": "reference",
      "category": "documentation",
      "description": "Render a codebase as interactive architecture maps and Markdown, HTML, MDX or reStructuredText documentation so reviewers and coding agents can see which components a change touches before merging.",
      "repository": "CodeBoarding/CodeBoarding",
      "homepage": "https://www.codeboarding.org",
      "license": "MIT",
      "stars": 2663,
      "checked_at": "2026-11-05",
      "last_pushed_at": "2026-11-04T23:24:02Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: the packaged CLI needs a configured model provider before it produces anything, and only an existing analysis can be rendered without one. Install is `pipx install codeboarding --python python3.12` (or pip into a virtual environment), then `codeboarding-setup` and `codeboarding full --local <repo>`, which writes `.codeboarding/analysis.json` plus nested component diagrams; `--render md|html|mdx|rst` emits an overview and one file per expanded component, and `codeboarding-render` re-renders a stored analysis with no LLM. Static analysis builds the component graph and a configured provider (OpenAI, Anthropic, Google, Vercel, Ollama, OpenRouter, or an OpenAI-compatible gateway, set in `~/.codeboarding/config.toml`) describes component responsibilities, so code excerpts are sent to that provider - the same credential boundary that keeps `open-code-review` a reference. It is the first entry here whose product is architecture documentation rather than code context for a tool call: the output feeds documentation, pull-request review and a coding agent's next prompt. Upstream also ships a VS Code/Open VSX extension, a GitHub Action that publishes architecture changes on pull requests, and a web viewer that parses local analysis files in the browser. Star count is a dated observation. Reviewed from the README, the getting-started page, `pyproject.toml` and the license file only; nothing was installed and no analysis was generated.",
      "evidence": [
        "https://api.github.com/repos/CodeBoarding/CodeBoarding",
        "https://github.com/CodeBoarding/CodeBoarding/blob/main/README.md",
        "https://github.com/CodeBoarding/CodeBoarding/blob/main/LICENSE",
        "https://github.com/CodeBoarding/CodeBoarding/blob/main/pyproject.toml",
        "https://codeboarding.org/getting-started",
        "https://pypi.org/project/codeboarding/"
      ]
    },
    {
      "id": "mcp-context-forge",
      "name": "MCP Context Forge",
      "kind": "reference",
      "category": "mcp-ecosystem",
      "description": "IBM's gateway, registry and proxy in front of MCP, A2A and REST/gRPC servers that exposes one governed endpoint with virtual servers, auth, rate limiting, guardrails and an admin UI.",
      "repository": "IBM/mcp-context-forge",
      "homepage": "https://ibm.github.io/mcp-context-forge/",
      "license": "Apache-2.0",
      "stars": 4752,
      "checked_at": "2026-11-05",
      "last_pushed_at": "2026-11-04T19:04:44Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: this is a long-running gateway rather than a stdio server a project registers, and it will not start without secrets. The documented launch is `uvx --from mcp-contextforge-gateway mcpgateway --host 0.0.0.0 --port 4444` after `python3 -m mcpgateway.scripts.init_secrets` generates `JWT_SECRET_KEY` and `AUTH_ENCRYPTION_SECRET`, which upstream states are required in every environment including local development; pip installs, Docker/Compose, and a source checkout are the other paths. It speaks HTTP, JSON-RPC, WebSocket, SSE and streamable HTTP, with stdio transport only for server-side use, so a written stdio configuration would register a server that cannot answer its first call - the same reasoning that keeps `mcp-toolbox` and GitHub's MCP server reference-only. What it adds to a project is federation and governance rather than another tool: a registry that federates MCP, A2A and REST/gRPC servers behind one endpoint, virtual servers, tool and prompt aggregation, plugins, OAuth/JWT/basic auth with conditional passthrough of upstream authorization headers, rate limiting, retries, health checks, metrics and an admin UI. Its repository also carries Python and JavaScript lint/test configuration, a smoke test and its own AGENTS.md. Star count is a dated observation. Reviewed from the README, the documented setup and secrets sections, the documentation site and the PyPI metadata; nothing was installed and no gateway was started.",
      "evidence": [
        "https://api.github.com/repos/IBM/mcp-context-forge",
        "https://github.com/IBM/mcp-context-forge/blob/main/README.md",
        "https://github.com/IBM/mcp-context-forge/blob/main/.env.example",
        "https://github.com/IBM/mcp-context-forge/blob/main/LICENSE",
        "https://ibm.github.io/mcp-context-forge/",
        "https://pypi.org/project/mcp-contextforge-gateway/"
      ]
    },
    {
      "id": "ruler",
      "name": "Ruler",
      "kind": "reference",
      "category": "engineering-rules",
      "description": "Apply one `.ruler/` source of instructions and MCP settings to the native rule, skill, subagent and MCP files of more than thirty coding agents, keeping the generated files out of version control.",
      "repository": "intellectronica/ruler",
      "homepage": "https://github.com/intellectronica/ruler",
      "license": "MIT",
      "stars": 2959,
      "checked_at": "2026-11-05",
      "last_pushed_at": "2026-11-04T17:06:53Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: one run rewrites many native agent files across a project, which is a broader change than the single launch configuration or copied skill directory the recipes here model. The launcher is the npm package `@intellectronica/ruler` (`npm install -g @intellectronica/ruler`, or `npx @intellectronica/ruler apply` for a one-off), and the source of truth is a `.ruler/` directory holding `AGENTS.md` and `ruler.toml` (legacy `mcp.json` and `instructions.md` fallbacks still resolve), with nested `.ruler/` directories for context-specific scopes and a global configuration used when no local one exists. It writes the target's own files rather than an adaptation: `AGENTS.md`, `CLAUDE.md`, `.amazonq/rules/ruler_q_rules.md`, `.idx/airules.md`, `firebender.json` and others for instructions; `.mcp.json`, `.cursor/mcp.json`, `.codex/config.toml`, `.gemini/settings.json`, `opencode.json` and similar for MCP servers; and the per-agent skill and subagent directories (`.claude/skills/`, `.github/skills/`, `.agents/skills/`, `.opencode/agents/`, `.codex/agents/`) where an agent supports them. It also automates `.gitignore` for the generated paths. It overlaps `ai-rulez`, which authors, locks, signs and policy-checks one source; this applies an existing source to every harness in a project, so a team adopting both would author in one and apply with the other. Star count is a dated observation. Reviewed from the README, its agent support table, `AGENTS.md`, the license file and the npm metadata; nothing was installed and no rule or MCP file was generated.",
      "evidence": [
        "https://api.github.com/repos/intellectronica/ruler",
        "https://github.com/intellectronica/ruler/blob/main/README.md",
        "https://github.com/intellectronica/ruler/blob/main/AGENTS.md",
        "https://github.com/intellectronica/ruler/blob/main/LICENSE",
        "https://registry.npmjs.org/@intellectronica%2fruler"
      ]
    },
    {
      "id": "agnix",
      "name": "agnix",
      "kind": "lsp",
      "category": "language-servers",
      "description": "Linter and language server for agent configuration: 758 rules that validate CLAUDE.md, AGENTS.md, SKILL.md, hooks, plugin and MCP files per client, with autofixes.",
      "repository": "agent-sh/agnix",
      "homepage": "https://agent-sh.github.io/agnix/",
      "license": "MIT OR Apache-2.0",
      "stars": 471,
      "checked_at": "2026-11-06",
      "last_pushed_at": "2026-11-04T15:05:09Z",
      "archived": false,
      "install": null,
      "notes": "Reference only, and the first entry here that lints the agent files themselves: agnix validates CLAUDE.md, AGENTS.md, SKILL.md, `.claude/rules/*.md`, hooks, plugin manifests and MCP configuration against 758 rules, several hundred of them scoped per client (Claude Code 170, Codex CLI 89, Cursor 40, Cline 16, Gemini CLI 35, and more on the same table), and it can auto-fix two of the most common findings. Upstream calls it \"the missing linter and lsp for AI coding assistants\" and ships three binaries - the `agnix` CLI, `agnix-lsp` and `agnix-mcp` - under one Cargo workspace, so no single pinned recipe represents it: the documented paths are `npx agnix .` or `uvx agnix .` in a project, `npm install -g agnix` (npm 0.61.0), `brew tap agent-sh/agnix && brew install agnix`, `pip install agnix` (0.61.0 on PyPI, same summary as the repository) and `cargo install agnix-cli`, plus VS Code, JetBrains, Neovim and Zed extensions and a GitHub Action that lints changed files in CI. It is filed under the language-server category as its README does, next to Tombi as the second configuration-file language server rather than a programming-language one: the LSP binary is a raw editor server, not an MCP server, so there is no stdio handshake to smoke-test and the CLI in CI is the primary use. Repository metadata, README install and rule tables, both license files and the npm and PyPI package metadata were read; nothing was installed and no CLI, LSP or editor session was run for this entry, and the rule and client counts are upstream numbers.",
      "evidence": [
        "https://api.github.com/repos/agent-sh/agnix",
        "https://github.com/agent-sh/agnix/blob/main/README.md",
        "https://github.com/agent-sh/agnix/blob/main/LICENSE-APACHE",
        "https://github.com/agent-sh/agnix/blob/main/LICENSE-MIT",
        "https://pypi.org/project/agnix/"
      ]
    },
    {
      "id": "skillspector",
      "name": "SkillSpector",
      "kind": "reference",
      "category": "security-tooling",
      "description": "NVIDIA's security scanner for agent skills and MCP servers: static pattern checks plus optional LLM analysis for prompt injection, data exfiltration and supply-chain risk before a skill is installed.",
      "repository": "NVIDIA/SkillSpector",
      "homepage": "https://docs.nvidia.com/skills/scanning-agent-skills",
      "license": "Apache-2.0",
      "stars": 24520,
      "checked_at": "2026-11-06",
      "last_pushed_at": "2026-11-05T23:35:59Z",
      "archived": false,
      "install": null,
      "notes": "Reference only, and the first security entry here that scans the agent tooling instead of the project: SkillSpector runs static pattern checks for prompt injection, data exfiltration, credential access, obfuscation and supply-chain risk over a skill directory, an MCP server config, a Git URL, a zip, or an MCP registry snapshot, and can add LLM semantic analysis on top. Three things keep it out of the installable set: the documented distributions are `uv tool install git+https://github.com/NVIDIA/skillspector.git`, a container image and a source checkout, which this repository's install rules cannot pin - and there is no PyPI distribution of the name to pin instead (checked: `https://pypi.org/pypi/skillspector/json` answers 404); the `mcp` extra that enables `skillspector mcp` has to be requested at install time; and the LLM stages need a provider key plus network access, with `--no-llm` as the offline path, while the package requires Python >=3.12,<3.16 per its pyproject. Static-only scanning of a local skill directory is the cheapest way to try it. It is the safety counterpart to the existing `skillevaluator` reference in this collection (that one measures how well a skill performs, this one whether it can be trusted), and NVIDIA documents it as part of the Verified Skills pipeline behind their published skill catalog. Repository metadata, README, pyproject and license were read; no skill was scanned, no image was pulled and no MCP session was started.",
      "evidence": [
        "https://api.github.com/repos/NVIDIA/SkillSpector",
        "https://github.com/NVIDIA/SkillSpector/blob/main/README.md",
        "https://github.com/NVIDIA/SkillSpector/blob/main/pyproject.toml",
        "https://github.com/NVIDIA/SkillSpector/blob/main/LICENSE",
        "https://docs.nvidia.com/skills/scanning-agent-skills"
      ]
    },
    {
      "id": "brooks-lint",
      "name": "brooks-lint",
      "kind": "reference",
      "category": "engineering-skills",
      "description": "Six portable Agent Skills that review a codebase for architecture decay, technical debt, test weakness and remediation, reporting book-derived risk codes with a 0-100 health score.",
      "repository": "hyhmrright/brooks-lint",
      "homepage": "https://hyhmrright.github.io/brooks-lint/",
      "license": "MIT",
      "stars": 1561,
      "checked_at": "2026-11-06",
      "last_pushed_at": "2026-11-05T04:42:33Z",
      "archived": false,
      "install": null,
      "notes": "Reference only even though it is a skill pack, and that is a delivery-boundary call rather than a scope one: upstream ships six skills under `skills/` (brooks-audit, brooks-debt, brooks-health, brooks-review, brooks-sweep, brooks-test) that all load a shared `skills/_shared/` directory (common.md, decay-risks.md, remedy-guide.md, test-decay-risks.md, source-coverage.md, custom-risks-guide.md), and the documented installers copy `skills/*` flat into the client's skills directory: `npx brooks-lint install <platform>` (npm 1.9.1), `curl -fsSL .../scripts/install.sh | bash -s -- <platform>`, `/plugin marketplace add hyhmrright/brooks-lint`, or a manual `cp -r skills/*`. This catalog's skill recipe pins exactly one subtree and requires a SKILL.md at that subtree's root, so pinning `skills/` is impossible (no top-level SKILL.md there) and pinning a single skill would install a directory whose `../_shared/*.md` references dangle - so there is no faithful pin to record. Fourteen platform targets are documented (claude, codex, cursor, copilot, gemini, opencode, windsurf, antigravity, kiro, droid, dsh, pi, bob, agents), each with its own plugin metadata, hooks and short-form commands, and the README notes that automated checks verify file layouts and resources, not runtime behaviour on every host. The content is six review modes that audit architecture decay, technical debt, test weakness and remediation using book-derived risk codes and a 0-100 health score; it overlaps `code-review-and-quality`, `open-code-review` and `graphify` in intent, so it is included for its dependency-aware cross-file review shape and its named decay taxonomy rather than as another generic reviewer. Repository metadata, README structure, the brooks-review SKILL.md and npm package metadata were read; nothing was installed and no skill was activated.",
      "evidence": [
        "https://api.github.com/repos/hyhmrright/brooks-lint",
        "https://github.com/hyhmrright/brooks-lint/blob/main/README.md",
        "https://github.com/hyhmrright/brooks-lint/tree/main/skills",
        "https://github.com/hyhmrright/brooks-lint/blob/main/LICENSE",
        "https://registry.npmjs.org/brooks-lint/latest"
      ]
    },
    {
      "id": "misata",
      "name": "Misata",
      "kind": "mcp",
      "category": "python-toolchain",
      "description": "Declarative synthetic test data over MCP: state the facts a dataset must hold and get multi-table rows that satisfy them, with a certificate a DuckDB run re-checks.",
      "repository": "rasinmuhammed/misata",
      "homepage": "https://misata.studio",
      "license": "MIT",
      "stars": 75,
      "checked_at": "2026-11-06",
      "last_pushed_at": "2026-11-01T14:01:07Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--from",
          "misata[mcp]==0.9.8.1",
          "misata-mcp"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.9.8.1",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the `mcp` extra needs mcp>=1,<2 and the package requires >=3.10)"
      },
      "notes": "Pins the published PyPI release 0.9.8.1 with its `mcp` extra, matching the `claude mcp add misata -- uvx --from \"misata[mcp]\" misata-mcp` form upstream documents (`misata mcp install --client all` writes the same server for Cursor, Windsurf and Claude Desktop). The launcher pins `--python 3.12` for a deterministic resolution: the package itself accepts Python >=3.10 and the `mcp` extra caps `mcp>=1.0.0,<2.0.0`, so an unpinned interpreter could resolve a FastMCP line the server was not written against. It is the test-fixture entry of this collection rather than another schema or query tool: a declaration of the facts the data must hold (monthly revenue, channel shares, balanced ledgers, foreign keys, state machines) is compiled into multi-table rows written to CSV, Parquet, JSONL, DuckDB or Postgres, together with a certificate `misata` can re-run later. The server exposes 15 tools - list_domains, preview_story, inspect_schema, generate_dataset, generate_from_schema, seed_database, create_sandbox, query_sandbox, validate_yaml, audit_dataset, explain_schema, solve_outcome, attest_dataset, check_realism, validate_domain - and upstream flags `seed_database` as the only one that writes to a database. The same package also ships a CLI, a pytest plugin entry point, a Streamlit studio and a `SKILL.md`; this recipe configures only the MCP server. Limits are stated upstream: exactness holds for declared facts (sums, rates, shares, roll-ups, keys, lifecycles) and not for arbitrary SQL or window functions, and it does not learn a joint distribution from private data - the `mimic` path fits to real rows and is not anonymised. Smoke-checked on macOS with `scripts/smoke_mcp.py`: the pinned command completed MCP initialize (server `misata` 0.9.8.1, protocol 2025-11-25) and listed the 15 tools. No tool was called, no dataset was generated and no certificate was re-verified here.",
      "evidence": [
        "https://api.github.com/repos/rasinmuhammed/misata",
        "https://github.com/rasinmuhammed/misata/blob/main/README.md",
        "https://github.com/rasinmuhammed/misata/blob/main/pyproject.toml",
        "https://pypi.org/project/misata/0.9.8.1/",
        "https://github.com/rasinmuhammed/misata/blob/main/LICENSE"
      ]
    },
    {
      "id": "seleniumbase",
      "name": "SeleniumBase MCP",
      "kind": "mcp",
      "category": "browser",
      "description": "Stealthy browser automation over MCP: drive real Chrome through SeleniumBase's pure CDP mode to open pages, inspect and click elements, type, assert conditions and manage cookies, storage and tabs.",
      "repository": "SeleniumBase/SeleniumBase",
      "homepage": "https://seleniumbase.io",
      "license": "MIT",
      "stars": 13228,
      "checked_at": "2026-11-07",
      "last_pushed_at": "2026-11-06T21:44:39Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.13",
          "--from",
          "seleniumbase[mcp]==4.57.1",
          "seleniumbase-mcp"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "4.57.1",
        "runtime": "uv/uvx; Python 3.13 pinned for the launcher (package requires >=3.10, the `mcp` extra needs >=3.10)"
      },
      "notes": "Pins the published PyPI release 4.57.1 with its `mcp` extra, which is upstream's simplest path: `pip install \"seleniumbase[mcp]\"` registers the `seleniumbase-mcp` console script and the MCP client config becomes just `seleniumbase-mcp`. That server is the one in the repository's `mcp_servers/` directory and is the only variant configured here; SeleniumBase's `Driver()` and `SB()` automation styles have separate servers in the `seleniumbase/seleniumbase-mcp` repository. This launcher pins `--python 3.13` for a deterministic resolution: the distribution requires Python >=3.10 and an unpinned `uvx` on a host whose default interpreter is older (this repository's smoke host ships 3.9) fails before the MCP handshake, the same reason the roam-code, orm-lens, headroom and misata recipes pin. The server drives Chrome over the DevTools Protocol with no WebDriver in the loop (`seleniumbase.sb_cdp.Chrome`), so no chromedriver download is needed, but a working Chrome/Chromium install is, and the browser is started only when the agent calls `start_browser`. Upstream documents `headless` defaulting to `None`, which resolves to headless on Linux and headed on macOS/Windows, and a `solve_captcha()` capability; CAPTCHA solving and stealth behaviour are uninspected here. The rest of SeleniumBase remains a general pytest-based browser-test framework with its own extras (playwright, mss, pdfminer, pyautogui); this recipe writes only the MCP launch configuration and installs none of those, and it does not configure the underlying test framework. Smoke-checked on macOS with `scripts/smoke_mcp.py`: the pinned command completed MCP initialize (server `seleniumbase-mcp`, protocol 2025-11-25; the server reports no version string) and listed 24 tools - start_browser, close_browser, get_page_info, open_url, manage_history, find_elements, get_content, get_attributes, check_if_condition, click_element, hover_action, type_text, select_option, focus_element, wait_for_condition, assert_condition, manage_cookies, manage_storage, scroll_page, manage_window, manage_tabs, solve_captcha, save_page, run_javascript. No tool was called, so no Chrome session, page load or CAPTCHA solve was exercised, and whether the upstream README's shorter tool list still matches the server was not re-checked beyond this listing.",
      "evidence": [
        "https://api.github.com/repos/SeleniumBase/SeleniumBase",
        "https://github.com/SeleniumBase/SeleniumBase/blob/master/README.md",
        "https://github.com/SeleniumBase/SeleniumBase/blob/master/mcp_servers/README.md",
        "https://pypi.org/project/seleniumbase/4.57.1/",
        "https://github.com/SeleniumBase/SeleniumBase/blob/master/LICENSE"
      ]
    },
    {
      "id": "dbhub",
      "name": "DBHub",
      "kind": "mcp",
      "category": "mcp-ecosystem",
      "description": "Token-efficient database MCP server: two default tools to run SQL and search schemas across PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite, with read-only guardrails, SSH tunnelling and SSL options.",
      "repository": "bytebase/dbhub",
      "homepage": "https://dbhub.ai",
      "license": "MIT",
      "stars": 3801,
      "checked_at": "2026-11-07",
      "last_pushed_at": "2026-11-03T06:59:40Z",
      "archived": false,
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "@bytebase/dbhub@1.5.1",
          "--transport",
          "stdio",
          "--demo"
        ],
        "requirements": [
          "npx",
          "Node.js >=22.5.0"
        ],
        "version": "1.5.1",
        "runtime": "Node.js >=22.5.0 (the server uses the built-in `node:sqlite` module)"
      },
      "notes": "Pins the published npm release 1.5.1 and the stdio transport the agent starts, with `--demo` so the shipped configuration works before any database is chosen: upstream documents a bundled SQLite sample \"employee\" database for testing. Replace `--demo` with `--dsn \"<your-dsn>\"` (or the DB_* environment variables) to point it at a real database, which is what the upstream examples show, including the PostgreSQL form used in the Claude Code MCP documentation; this recipe stores no credentials and the user's DSN is supplied at launch like any other MCP server. It is the database entry of this collection: other MCP database tools appear here only as reference (mcp-toolbox, mongodb-mcp-server-adjacent guides) and none of them is a pinned launch recipe, so DBHub is the one-command path from a database to an agent. Upstream's token-efficiency claim is the reason it is worth a recipe: two tools by default (`execute_sql`, `search_objects`) at roughly 1.4k tokens, with `explain_sql` and other tools opt-in, against alternatives that load a full toolbelt. Guardrails are documented as read-only mode, row limiting and query timeouts, and one process can serve multiple databases through a TOML config with `--id` suffixes for tool names; there is also a web workbench (`--transport http --port 8080`), a Docker image, an MCP Bundle and a Claude Code plugin, none of which this recipe configures. Node.js >=22.5.0 is a hard requirement because the server uses the built-in `node:sqlite` module; the smoke host's v22.22.2 satisfied it. Smoke-checked on macOS with `scripts/smoke_mcp.py`: the pinned command completed MCP initialize (server `DBHub MCP Server` 1.5.1, protocol 2025-11-25) and listed the two default tools, execute_sql and search_objects. No query was executed against the bundled sample database, so query results, guardrail behaviour and multi-database configuration remain unverified.",
      "evidence": [
        "https://api.github.com/repos/bytebase/dbhub",
        "https://github.com/bytebase/dbhub/blob/main/README.md",
        "https://dbhub.ai/installation",
        "https://dbhub.ai/config/command-line",
        "https://registry.npmjs.org/@bytebase%2fdbhub/1.5.1",
        "https://github.com/bytebase/dbhub/blob/main/LICENSE"
      ]
    },
    {
      "id": "spec-kitty",
      "name": "Spec Kitty",
      "kind": "reference",
      "category": "spec-driven-development",
      "description": "Spec-driven development CLI that keeps specs, work packages, review and merge state in the repository and runs parallel coding agents in isolated git worktrees.",
      "repository": "spec-kitty/spec-kitty",
      "homepage": "https://spec-kitty.ai",
      "license": "MIT",
      "stars": 1716,
      "checked_at": "2026-11-07",
      "last_pushed_at": "2026-11-06T23:48:15Z",
      "archived": false,
      "install": null,
      "notes": "Reference only, for two reasons. First, the artifact is a whole workflow rather than one pinned capability: the CLI turns intent into the chain `spec -> plan -> tasks -> next -> review -> accept -> merge`, stores mission artifacts under `kitty-specs/` with lifecycle lanes (`planned`, `in_progress`, `for_review`, `approved`, `done`), gives each agent an isolated worktree under `.worktrees/`, and integrates by writing slash commands or skills into Claude Code, Codex, Cursor, Gemini, Copilot, Windsurf, OpenCode and others at initialization time - a machine- and harness-level change beyond the four install types this catalog writes. Second, there is no single artifact to pin: the published stable PyPI release is 3.2.7 (2026-09-09) while `main` carries the 4.x release-candidate line (`spec-kitty-cli==4.0.0rc2`), and upstream states that stable launch acceptance remains pending, so neither the stable nor the RC represents the project faithfully for a pinned recipe. It sits next to `spec-kit` and `openspec`: those record a spec workflow, while this one adds governance around it - a repository-native charter, review and accept gates, lane-based progress (`spec-kitty agent tasks status --json` for tools), parallel-agent worktree isolation and a retrospective generated per completed mission. Upstream is explicit that it is overkill for one-off edits, tiny scripts, or teams that do not use Git, and that it is designed for humans defining intent and acceptance criteria rather than lights-out autonomy. Reviewed from the README and the published PyPI metadata only; the CLI was not installed and no workflow was run, so command behaviour, worktree isolation and multi-agent concurrency are unverified. Star count is a dated observation.",
      "evidence": [
        "https://api.github.com/repos/spec-kitty/spec-kitty",
        "https://github.com/spec-kitty/spec-kitty/blob/main/README.md",
        "https://spec-kitty.ai/",
        "https://pypi.org/project/spec-kitty-cli/3.2.7/",
        "https://github.com/spec-kitty/spec-kitty/blob/main/LICENSE"
      ]
    },
    {
      "id": "cross-code-organizer",
      "name": "Cross-Code Organizer",
      "kind": "reference",
      "category": "skill-ecosystem",
      "description": "Local cross-harness dashboard that inventories, edits and cleans up Claude Code, Codex CLI, OpenCode and DSH configs, memories, skills, agents and MCP servers, and scans MCP tool descriptions for poisoning.",
      "repository": "mcpware/cross-code-organizer",
      "homepage": "https://github.com/mcpware/cross-code-organizer",
      "license": "MIT",
      "stars": 386,
      "checked_at": "2026-11-07",
      "last_pushed_at": "2026-11-04T12:01:18Z",
      "archived": false,
      "install": null,
      "notes": "Reference only: it is an interactive local dashboard application (`npx @mcpware/cross-code-organizer`, Node.js >=20) that a person opens in a browser, not a skill, rule pack, MCP server or LSP bridge, so none of the four install types this catalog writes applies and an agent-side launch config would not describe its use. It was renamed from Claude Code Organizer, and upstream ships a rename note for search. What it adds beyond the browser entries here: one view of what each harness actually loads (Claude Code memories, skills, agents, hooks, slash commands, MCP servers, sessions and context budget; Codex AGENTS instructions, profiles, sessions, history, snapshots, TOML config, plugins, hooks and skills; OpenCode layered JSON/JSONC config; DSH profiles and skill roots), normalised per adapter instead of assuming identical precedence, with in-place Markdown editing, duplicate memory and skill cleanup, reversible exact-duplicate repair and copy-only skill migration in the newer line. Its security side is the pairing with a scanner over MCP server configs and tool descriptions for prompt-injection-style poisoning, including an \"Activation Scanner\" research preview that probes local model activations before an untrusted capability runs; upstream positions it against standalone scanners by letting a finding navigate straight to the offending server entry. Two caveats recorded here: the published npm release is 0.19.3 while the README documents a v0.20.0 line with additional repair and harness support, so the dashboard and the published package are not the same surface, and its config-hygiene purpose overlaps `mcp-inspector` and `mcp-context-forge` in this collection without replacing either. Privacy: it reads local harness config directories and project configs, telemetry is explicit opt-in and documented as anonymous counters with no paths, prompts or file contents, and it uploads no configuration. Reviewed from the README, PRIVACY.md and registry metadata only; nothing was installed or launched and no scanner verdict was reproduced. Star count is a dated observation.",
      "evidence": [
        "https://api.github.com/repos/mcpware/cross-code-organizer",
        "https://github.com/mcpware/cross-code-organizer/blob/main/README.md",
        "https://github.com/mcpware/cross-code-organizer/blob/main/PRIVACY.md",
        "https://registry.npmjs.org/@mcpware%2fcross-code-organizer/0.19.3",
        "https://github.com/mcpware/cross-code-organizer/blob/main/LICENSE"
      ]
    },
    {
      "archived": false,
      "category": "python-toolchain",
      "checked_at": "2026-11-08",
      "description": "Orchestrate Ruff, Bandit, Oxlint and pip-audit behind one stdio MCP server and return a compressed repository map instead of raw files.",
      "evidence": [
        "https://api.github.com/repos/mustel-py/mustel",
        "https://github.com/mustel-py/mustel/blob/main/README.md",
        "https://github.com/mustel-py/mustel/blob/main/pyproject.toml",
        "https://pypi.org/project/mustel/0.3.4/",
        "https://github.com/mustel-py/mustel/blob/main/LICENSE"
      ],
      "homepage": "https://mustel.vercel.app/",
      "id": "mustel",
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--with",
          "mcp<2",
          "--from",
          "mustel==0.3.4",
          "mustel",
          "serve"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.3.4",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); published 0.3.4 imports `mcp.server.fastmcp` without capping `mcp`, so the recipe adds `--with mcp<2`"
      },
      "kind": "mcp",
      "last_pushed_at": "2026-10-24T20:06:44Z",
      "license": "MIT",
      "name": "Mustel",
      "notes": "Python static-analysis orchestrator exposed over stdio MCP; the five tools `review`, `review_file`, `get_code_map`, `env` and `bootstrap` were discovered in a fresh temporary project in this pass (`initialize` + `tools/list`, protocol 2025-11-25, the server reporting FastMCP `1.30.0`). It coordinates Ruff, Bandit, Oxlint, pip-audit and local YAML pattern files in parallel and switches profile by environment: dev mode (default) runs only local, non-networked checks with a stat-based (`mtime` + `size`) cache, while audit mode adds the deeper Bandit and pip-audit passes when `CI`, `GITHUB_ACTIONS` or `PRE_COMMIT` is set. Its difference from the other Python checker recipe here (`mcp-tools-py`: pylint, pytest, mypy, Ruff and symbol renames) is the dependency-vulnerability lane plus the compressed repository map: `get_code_map` returns an AST/regex skeleton of paths, classes, functions and docstrings that upstream describes as a 1,500-token budget, and `.ipynb` code cells are parsed natively so an agent reads structure instead of whole files. Ruff, Bandit, pip-audit, Semgrep and OSV-Scanner remain reference-only entries; this recipe is the wiring that puts two of those scanners behind MCP in one server, and upstream records a guardrail that injects compile/syntax failures into the agent's tool output on save. Caveats: the `bootstrap` tool and `mustel bootstrap` rewrite machine-level configuration (`~/.cursor/mcp.json`, `~/.claude.json`, Claude Desktop configs, project `.cursorrules`/`.windsurfrules` and git pre-commit hooks), so this catalog registers only the stdio server and never calls it; audit mode needs network access for vulnerability data; the pinned `0.3.4` matches the version in `main`'s `pyproject.toml`, but that PyPI release predates the repository's October commits. The smoke check started the launcher and listed the tools; no tool was called, no project was analysed, no code map was generated and no IDE or hook configuration was written.",
      "repository": "mustel-py/mustel",
      "stars": 19
    },
    {
      "archived": false,
      "category": "skill-ecosystem",
      "checked_at": "2026-11-08",
      "description": "Lint, autofix and baseline the skills, plugins, hooks and instruction files a coding agent loads across the major agent ecosystems.",
      "evidence": [
        "https://api.github.com/repos/stbenjam/skillsaw",
        "https://github.com/stbenjam/skillsaw/blob/main/README.md",
        "https://skillsaw.org/rules/",
        "https://pypi.org/project/skillsaw/0.23.0/",
        "https://github.com/stbenjam/skillsaw/blob/main/LICENSE",
        "https://github.com/stbenjam/skillsaw/blob/main/.pre-commit-hooks.yaml"
      ],
      "homepage": "https://skillsaw.org/",
      "id": "skillsaw",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-07T23:40:46Z",
      "license": "Apache-2.0",
      "name": "Skillsaw",
      "notes": "A linter for the files that steer a coding agent, recorded next to `agnix` with a different delivery shape: agnix is a Rust LSP binary with 758 per-client rules, skillsaw is a Python package on PyPI that runs as `uvx skillsaw tree` (report what it detects), `uvx skillsaw` (lint), `uvx skillsaw fix` (deterministic autofixes) and `uvx skillsaw baseline` (accept existing findings, fail only on new ones), with `.pre-commit-hooks.yaml` for a commit-time gate. It validates structure across ecosystems: Agent Skills (`SKILL.md`), Agent Plugins v1 (`plugin.json`, `mcp.json`), Claude Code and OpenAI Codex plugins and marketplaces, Cursor, Grok Build, Z.ai ZCode, Google Antigravity, GitHub Copilot / VS Code custom agents, OpenCode, Pi, native OpenClaw plugins, APM packages, MCP server maps and MCP Registry `server.json`, Vercel skills CLI lockfiles, `CLAUDE.md`/`AGENTS.md`/`GEMINI.md`/`QWEN.md`, hooks and eval formats. On top of schema and frontmatter checks it applies content and token-economy rules (instruction drift across duplicate files, instruction budget, section length, weak language, contradictions, repetitive inline tool-call examples), discovery integrity checks (unreferenced bundled files, broken internal references, inconsistent terminology, missing stop conditions, stale baselines) and supply-chain rules (dangerous `hooks.json` lifecycle hooks, `curl | sh` download-and-execute, `eval` obfuscation, strict MCP allowlists, invisible-unicode and prompt-injection payloads, embedded credentials). It stays reference-only because it is a CLI linter rather than one of the catalog's four install types; its own `npx skills add stbenjam/skillsaw` path installs only the `skillsaw-onboard` skill, which then drives the same `uvx` CLI. Adjacent to `cross-code-organizer` (harness inventory), `skillevaluator` (skill quality scoring) and `SkillSpector` (skill security scanning) rather than a duplicate of any of them. Nothing was installed and no repository was linted in this pass.",
      "repository": "stbenjam/skillsaw",
      "stars": 71
    },
    {
      "archived": false,
      "category": "python-skills",
      "checked_at": "2026-11-08",
      "description": "Checklist-driven Claude Code skills for the Python library lifecycle, with shared and other-language bundles from the same collection.",
      "evidence": [
        "https://api.github.com/repos/wdm0006/python-skills",
        "https://github.com/wdm0006/python-skills/blob/main/README.md",
        "https://github.com/wdm0006/python-skills/blob/main/.claude-plugin/marketplace.json",
        "https://github.com/wdm0006/python-skills/tree/main/skills/python",
        "https://github.com/wdm0006/python-skills/blob/main/LICENSE"
      ],
      "homepage": "https://github.com/wdm0006/python-skills",
      "id": "python-dev-skills",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-07T22:44:31Z",
      "license": "MIT",
      "name": "Python Dev Skills",
      "notes": "A multi-language Claude Code skill collection whose Python half is the largest and most directly useful here: checklist-driven `SKILL.md` files for `api-design`, `cli-development`, `code-quality`, `documentation`, `lazy-dependencies`, `library-review`, `llm-features`, `mcp-servers`, `packaging`, `performance`, `project-setup`, `release-management`, `security-audit`, `testing-strategy`, `web-app-architecture` and `community`, plus twenty shared `skills/common/` skills (git hygiene, GitHub Actions, CI permissions, rendering untrusted content, destructive operations, UI design, defect reports and more) and smaller Go, Rust, Scala, Swift and browser-extension sets. Delivery is a Claude Code plugin marketplace: `/plugin marketplace add wdm0006/python-skills` then `/plugin install python-library-complete@dev-skills` or a narrower bundle (`python-library-foundations`, `python-library-quality`, `python-web-app`, `python-mcp-servers`, `swift-apps`, `browser-extensions`), whose exact membership is declared in `.claude-plugin/marketplace.json`; the collection grew out of a Python library-development guide and its README states a repository rename is planned now that it covers several languages. It is reference-only for two reasons: the delivered unit is a plugin bundle whose members share `skills/common/*` rather than one self-contained subtree this catalog can pin with a full commit and archive SHA-256, and the repository path the marketplace command depends on is scheduled to change, so a pin now would need re-verification on rename. It sits next to the ECC and `wshobson/agents` Python skills this catalog installs and to `awesome-copilot` as discovery sources for the same idea. Nothing was installed and no bundle was activated.",
      "repository": "wdm0006/python-skills",
      "stars": 111
    },
    {
      "archived": false,
      "category": "skill-ecosystem",
      "checked_at": "2026-11-08",
      "description": "Google's seven Agent Skills plus a CLI for building, evaluating, deploying, observing and publishing agents on Google ADK.",
      "evidence": [
        "https://api.github.com/repos/google/agents-cli",
        "https://github.com/google/agents-cli/blob/main/README.md",
        "https://github.com/google/agents-cli/blob/main/skills/README.md",
        "https://pypi.org/project/google-agents-cli/1.13.0/",
        "https://github.com/google/agents-cli/blob/main/LICENSE"
      ],
      "homepage": "https://google.github.io/agents-cli/",
      "id": "agents-cli",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-04T17:44:57Z",
      "license": "Apache-2.0",
      "name": "Agents CLI (Google ADK)",
      "notes": "The first entry here whose subject is building the agent rather than tooling a Python or Web project: Agents CLI gives a coding agent seven Agent Skills that cover the ADK development lifecycle — `google-agents-cli-workflow` (lifecycle, code preservation, model selection), `google-agents-cli-adk-code` (ADK Python API: agents, tools, orchestration, callbacks, state, graph Workflow API), `google-agents-cli-scaffold`, `google-agents-cli-eval` (datasets, metrics, generate/grade, compare, analyze, optimize, LLM-as-judge), `google-agents-cli-deploy` (Agent Runtime on the Gemini enterprise platform, Cloud Run, GKE, CI/CD, secrets), `google-agents-cli-publish` (Gemini registration) and `google-agents-cli-observability` (Cloud Trace, Cloud Logging) — shipped in the same repository as a PyPI CLI (`uvx google-agents-cli setup`, package `google-agents-cli` `1.13.0`, Python >=3.11) whose commands stay usable standalone (`agents-cli create`, `scaffold enhance`, `eval`, `deploy`). The documented skill path is the same `npx skills add google/agents-cli` CLI this catalog records as `skills-cli`, with `.claude-plugin`, `plugin.json` and `gemini-extension.json` manifests for the plugin marketplaces. It is reference-only because the delivered unit is a seven-skill bundle plus a generator CLI rather than one pinnable subtree or MCP launch command, and because the parts that matter most (deployment, publishing, hosted evaluation) require the user's own Google Cloud project and credentials while only local `create`/`run`/`eval` works with an AI Studio API key. Upstream also states that its usage telemetry writes a structured log entry into the user's own Google Cloud project (command name, exit code, error class, duration). Recorded next to the other skill collections as a discovery source; nothing was installed, no project was scaffolded and no agent was deployed.",
      "repository": "google/agents-cli",
      "stars": 6315
    },
    {
      "archived": false,
      "category": "spec-driven-development",
      "checked_at": "2026-11-09",
      "description": "Agent plugin that drafts a software design and then reviews it adversarially with a team of reviewer agents across Claude Code, Codex, Cursor, Copilot, Gemini and Antigravity.",
      "evidence": [
        "https://api.github.com/repos/google/elephant-goldfish-model",
        "https://github.com/google/elephant-goldfish-model/blob/main/README.md",
        "https://github.com/google/elephant-goldfish-model/tree/main/agents",
        "https://github.com/google/elephant-goldfish-model/tree/main/distributions/claude/skills",
        "https://github.com/google/elephant-goldfish-model/blob/main/.cursor-plugin/rules/egm.mdc",
        "https://github.com/google/elephant-goldfish-model/blob/main/AI_POLICY.md",
        "https://github.com/google/elephant-goldfish-model/blob/main/LICENSE"
      ],
      "homepage": "https://egm.dev",
      "id": "elephant-goldfish",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-08T13:33:11Z",
      "license": "Apache-2.0",
      "name": "Elephant Goldfish Model",
      "notes": "A Google-published, multi-harness agent plugin for the design half of the loop, recorded in `spec-driven-development` next to `spec-kit` and `spec-kitty` with a different lever: rather than generating and gating specification documents, it runs an agent ensemble that drafts a design and then attacks it. Ten reviewer prompts live in `agents/` (`bootstrap_orchestrator`, `comprehension`, `structural`, `style`, `design_critic`, `implementation_readiness`, `inventive_catalyst`, `synthesizer`, `zoom_out`, `codebase_details`) and the shipped skills walk the loop (`egm-bootstrap`, `egm-brainstorm`, `egm-draft`, `egm-review` / `egm-review-loop`, `egm-resolve`, `egm-drift-report`). It ships per-harness manifests and rule files for Claude Code (`.claude-plugin/`, `distributions/claude/skills/*`), Codex (`.codex-plugin/`), Cursor (`.cursor-plugin/` plus `.cursor-plugin/rules/egm.mdc`), Antigravity/Gemini (`.agents/`, `.gemini/`) and Copilot (`com.github.copilot`), with per-client setup under `docs/` (`claude.md`, `codex.md`, `cursor.md`, `copilot.md`); the Claude route upstream documents is `claude plugin marketplace add google/elephant-goldfish-model` then `claude plugin install egm@egm`. It is reference-only for the reason upstream states itself - install the complete plugin so its skills can read the reviewer prompts and document standards: the skills are not self-contained, they read the repository-level `agents/` prompts, so a pinned skill subtree would be incomplete and a recipe would ship half the product. Repository metadata, README, plugin manifests, the `agents/` and `distributions/claude/skills/` trees, `AI_POLICY.md` and `LICENSE` (Apache-2.0) were read in this pass; 15k+ stars and a push the day before this review. Nothing was installed, no plugin or skill was activated and no design review was run.",
      "repository": "google/elephant-goldfish-model",
      "stars": 15063
    },
    {
      "archived": false,
      "category": "security-tooling",
      "checked_at": "2026-11-09",
      "description": "Inline AI-agent firewall and MCP security control that scans outbound and inbound traffic, enforces egress policy and emits signed receipts.",
      "evidence": [
        "https://api.github.com/repos/pipelab-org/pipelock",
        "https://github.com/pipelab-org/pipelock/blob/main/README.md",
        "https://github.com/pipelab-org/pipelock/blob/main/docs/bypass-resistance.md",
        "https://github.com/pipelab-org/pipelock/blob/main/docs/mediation-envelope.md",
        "https://github.com/pipelab-org/pipelock/blob/main/docs/receipts/versioning.md",
        "https://github.com/pipelab-org/pipelock/blob/main/docs/owasp-agentic-top15-mapping.md",
        "https://github.com/pipelab-org/pipelock/releases/tag/v3.7.1",
        "https://github.com/pipelab-org/pipelock/blob/main/LICENSE"
      ],
      "homepage": "https://pipelab.org",
      "id": "pipelock",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-09T00:03:05Z",
      "license": "Apache-2.0",
      "name": "Pipelock",
      "notes": "An AI-agent firewall for the layer this catalog otherwise covers only statically: it sits inline between the agent and the network (and on the MCP path), scans outbound requests and inbound responses, and mediates egress against a policy file instead of auditing a repository after the fact. Detection is layered - an ordered URL scanner pipeline (scheme, CRLF and path-traversal checks, allow/block lists, immutable literal-IP SSRF and core-DLP floors, path/query/subdomain entropy analysis, nested URL destinations, DNS SSRF and rebinding protection, per-domain rate limits and data budgets), 65 built-in DLP patterns with checksum validation, and 34 prompt-injection / state-poisoning response patterns with six-pass normalization for zero-width characters, homoglyphs and leetspeak; DLP runs before DNS resolution so secrets are caught before a query leaves the proxy. Decisions can be exported as signed receipts plus mediation metadata (`docs/receipts/versioning.md`, `docs/mediation-envelope.md`) and mapped to the OWASP Agentic Top 15 and LLM Top 10, and the repository ships a GitHub Action (`action.yml`), Helm charts, Dockerfiles and a policy spec. Reference-only: it is a Go binary distributed as source builds, verified prebuilt releases, containers or a GitHub Action, not as one of this catalog's four installer types. It is the runtime counterpart of the recorded `gitleaks` and `SkillSpector` entries, which find secrets and unsafe content at rest; it is not a duplicate of them. Caveats: the README quick start targets v3.8.0 and says to use those examples after the release is published, while the latest published release checked here is v3.7.1, and upstream states AARP/SVID workload-identity appraisal is verifier-side today. No proxy was started, no policy was loaded and no traffic was intercepted in this pass.",
      "repository": "pipelab-org/pipelock",
      "stars": 987
    },
    {
      "archived": false,
      "category": "browser",
      "checked_at": "2026-11-09",
      "description": "Website audit CLI and stdio MCP server that returns LLM-optimized SEO, accessibility and performance findings a coding agent can fix.",
      "evidence": [
        "https://api.github.com/repos/squirrelscan/squirrelscan",
        "https://github.com/squirrelscan/squirrelscan/blob/main/README.md",
        "https://github.com/squirrelscan/squirrelscan/blob/main/apps/cli/src/cli/commands/mcp.ts",
        "https://github.com/squirrelscan/squirrelscan/tree/main/apps/cli/src/mcp/tools",
        "https://www.npmjs.com/package/squirrelscan/v/0.0.173",
        "https://github.com/squirrelscan/squirrelscan/blob/main/LICENSE"
      ],
      "homepage": "https://squirrelscan.com",
      "id": "squirrelscan",
      "install": {
        "type": "mcp",
        "command": "npx",
        "args": [
          "-y",
          "squirrelscan@0.0.173",
          "mcp"
        ],
        "requirements": [
          "npx"
        ],
        "version": "0.0.173",
        "runtime": "Node.js >=18; the audit fetches the target site over HTTP, so the server needs network access and an explicit site argument per call; the hosted HTTP endpoint and signed-in report scopes were not part of this recipe"
      },
      "kind": "mcp",
      "last_pushed_at": "2026-11-08T23:55:50Z",
      "license": "MIT",
      "name": "Squirrelscan",
      "notes": "A website-audit CLI and stdio MCP server for the Web half of this catalog's scope, recorded in `browser` next to `playwright`, `reticle` and `seleniumbase`: those three drive or inspect a page a developer is still building, while this one audits a deployed site and returns findings shaped for an agent to act on (upstream states every finding carries how to fix it, in LLM-optimized output, and every rule has its own documentation page). It exposes the audit, entity, issue, report, rule and feedback tool groups over MCP (`apps/cli/src/mcp/tools/*.ts`) plus Agent Skills, and it is installable here because the CLI publishes a pinnable npm package whose `mcp` subcommand runs the local stdio server (`apps/cli/src/cli/commands/mcp.ts`, upstream issue #112): the smoke check started `npx -y squirrelscan@0.0.173 mcp` from a temporary project and negotiated `initialize` + `tools/list` (protocol 2025-11-25, the server reporting itself as `squirrelscan` 0.0.173, 15 tools: `audit_website`, `quick_check`, `get_report`, `list_audits`, `list_issues`, `get_issue`, `comment_on_issue`, `list_rules`, `get_rule`, `list_entities`, `get_entity`, `get_entity_graph`, `compare_entities`, `get_entity_findings`, `send_feedback`). The hosted endpoint (`https://mcp.squirrelscan.com/mcp`, HTTP transport) and the Claude Code plugin marketplace route stay upstream setup rather than part of this recipe, and signed-in report scopes need the user's own account. Nothing was audited: no site was fetched, no report was written and no MCP tool was called.",
      "repository": "squirrelscan/squirrelscan",
      "stars": 308
    },
    {
      "archived": false,
      "category": "lsp-bridge",
      "checked_at": "2026-11-09",
      "description": "MCP server and CLI that answer Python go-to-definition, references, outline, diagnostic and rename-preview queries through ty and Ruff instead of text search.",
      "evidence": [
        "https://api.github.com/repos/iyazerski/lspyx",
        "https://github.com/iyazerski/lspyx/blob/main/README.md",
        "https://github.com/iyazerski/lspyx/tree/main/src/daemon",
        "https://github.com/iyazerski/lspyx/blob/main/src/lsp/rename.rs",
        "https://github.com/iyazerski/lspyx/releases/tag/v0.6.0",
        "https://crates.io/crates/lspyx",
        "https://github.com/iyazerski/lspyx/blob/main/LICENSE"
      ],
      "homepage": "https://github.com/iyazerski/lspyx",
      "id": "lspyx",
      "install": null,
      "kind": "lsp",
      "last_pushed_at": "2026-11-07T20:49:14Z",
      "license": "MIT",
      "name": "lspyx",
      "notes": "A Python-specific bridge in `lsp-bridge`, next to the general bridges (`serena`, `lsp-mcp-server`, `agent-lsp`, `mcpls`). The difference is the semantic backend: instead of driving pyright's language server it answers go-to-definition, references, outline, diagnostics and rename-preview queries through `ty`, Astral's type checker, plus Ruff, behind one small stdio MCP server with a per-workspace daemon (`src/daemon/`, `src/lsp/rename.rs`, `src/mcp/*`), and the same answers are available from the CLI. Launch is `lspyx mcp serve` (`claude mcp add --scope user lspyx -- lspyx mcp serve`), it needs `ty` and Ruff in the project `.venv` or on `PATH` (`lspyx doctor` checks the setup), and it is distributed as a Rust binary through `brew install iyazerski/tap/lspyx`, `cargo install lspyx --locked` or an install script - so, like `mcpls` and `agent-lsp`, there is no pinned registry package the installer could own, and the pair of external tools it depends on is another reason the entry stays reference-only. Evidence read in this pass: repository metadata, README, tags, the `src/` tree, eight tagged releases with eight binary assets each (latest v0.6.0, 2026-11-07) and the MIT license. Caveat worth weighing before adopting it: it is a young, single-maintainer project with 0 stars observed on 2026-11-09, recorded because the Python semantic-navigation lane has no other bridge and its ty/Ruff backend is unrepresented in this catalog. Nothing was installed and no MCP session was started.",
      "repository": "iyazerski/lspyx",
      "stars": 0
    },
    {
      "archived": false,
      "category": "engineering-skills",
      "checked_at": "2026-11-10",
      "description": "File-based planning skill for coding agents: crash-proof markdown plans on disk, session recovery after /clear or compaction, per-turn plan re-injection against context rot, and a deterministic completion gate, installed from a pinned archive.",
      "evidence": [
        "https://api.github.com/repos/OthmanAdi/planning-with-files",
        "https://github.com/OthmanAdi/planning-with-files/blob/master/README.md",
        "https://github.com/OthmanAdi/planning-with-files/tree/master/skills/planning-with-files",
        "https://github.com/OthmanAdi/planning-with-files/blob/master/skills/planning-with-files/SKILL.md",
        "https://github.com/OthmanAdi/planning-with-files/blob/master/skills/planning-with-files/scripts/init-session.sh",
        "https://github.com/OthmanAdi/planning-with-files/blob/master/skills/planning-with-files/templates/task_plan.md",
        "https://codeload.github.com/OthmanAdi/planning-with-files/tar.gz/2362ca385ad74f061aa0e7b73f56543a4b7e6df2",
        "https://github.com/OthmanAdi/planning-with-files/blob/master/LICENSE"
      ],
      "homepage": "https://github.com/OthmanAdi/planning-with-files",
      "id": "planning-with-files",
      "install": {
        "url": "https://codeload.github.com/OthmanAdi/planning-with-files/tar.gz/2362ca385ad74f061aa0e7b73f56543a4b7e6df2",
        "sha256": "cf60990c520c8f5d6fff876524450ce67172ad8ce785213a9bc50dbb06ac2227",
        "ref": "2362ca385ad74f061aa0e7b73f56543a4b7e6df2",
        "type": "skill",
        "subdir": "skills/planning-with-files",
        "license_path": "LICENSE"
      },
      "kind": "skill",
      "last_pushed_at": "2026-11-07T11:24:31Z",
      "license": "MIT",
      "name": "planning-with-files",
      "notes": "Adds the persistent-plan lane to `engineering-skills`, next to the one-shot planning skills already there: instead of a single plan document the skill keeps `.planning/<date>-<slug>/task_plan.md`, `progress.md` and `findings.md` on disk, re-injects the active plan every turn against context rot, recovers the plan after `/clear` or compaction, and gates completion with `scripts/check-complete.sh` (plus a SHA-256 attestation of the plan it injected). The recipe copies the archived `skills/planning-with-files` subtree from the pinned commit `2362ca38` - `SKILL.md`, `scripts/` (bash, PowerShell and Python implementations), `templates/`, `evals/`, `examples.md`, `plan-inventory.md`, `reference.md` - so the installed skill is self-contained: every path in `SKILL.md` is relative to the skill directory (`${CLAUDE_SKILL_DIR}`, `$PWF_SKILL_DIR`, `./scripts/...`) with no `../` escapes, and the Claude Code/Codex hooks it needs are declared in the skill's own frontmatter, which the clients read from the installed file. Upstream additionally ships an npm launcher, plugin-marketplace entries and an `npx skills` path for 60+ agents; this entry deliberately pins only the commit archive. Evidence read in this pass: repository metadata, README, the `skills/` tree at the pinned commit, `SKILL.md`, the `scripts/`, `templates/` and `evals/` listings, and the downloaded archive (24,950,981 bytes, SHA-256 verified, 37 files under the skill subtree, `LICENSE` at the archive root copied as `license_path`). Nothing was installed and no agent session was started.",
      "repository": "OthmanAdi/planning-with-files",
      "stars": 27973
    },
    {
      "archived": false,
      "category": "framework-best-practices",
      "checked_at": "2026-11-10",
      "description": "Design-intelligence skill for building UI/UX in web and app projects: 80 styles, 192 palettes, 74 font pairings, 120 UX guidelines and 25 chart types in local CSV data, queried with Python scripts through a per-client CLI installer.",
      "evidence": [
        "https://api.github.com/repos/nextlevelbuilder/ui-ux-pro-max-skill",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/README.md",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/skill.json",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/tree/main/.claude/skills/ui-ux-pro-max",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/.claude/skills/ui-ux-pro-max/SKILL.md",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/.claude/skills/ui-ux-pro-max/scripts/search.py",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/.claude/skills/ui-ux-pro-max/references/quick-reference.md",
        "https://www.npmjs.com/package/ui-ux-pro-max-cli",
        "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/main/LICENSE"
      ],
      "homepage": "https://uupm.cc",
      "id": "ui-ux-pro-max",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-07T19:05:11Z",
      "license": "MIT",
      "name": "UI/UX Pro Max",
      "notes": "The Web-side counterpart of the Python-focused skills in this catalog: a design-intelligence skill that answers style, palette, typography, icon, motion and UX-guideline questions from 3.1 MB of local CSV/JSON data (39 files, 3,103,749 bytes under `.claude/skills/ui-ux-pro-max/data/`, 22 tech stacks) through `scripts/search.py` and `design_system.py`, which need only a Python 3 standard library and make no network calls. Recorded reference-only on purpose. Upstream ships a per-client generator (`npm install -g ui-ux-pro-max-cli`, `uipro init --ai claude`, also `npx ... init --ai <client>`, with `update`/`uninstall`/`--dry-run` subcommands and a Claude Code marketplace path), and its README says to *always* use the CLI; the repository tree is the CLI's source template rather than the installed layout, and the commands inside `SKILL.md` are anchored to `${CLAUDE_PLUGIN_ROOT}/.claude/skills/ui-ux-pro-max/scripts/search.py`, so a bare commit-archive copy would not reproduce it. That, plus the CLI's own activation and update path, is why no pinned recipe is claimed and the entry stays next to `skillsaw` and `graphify` as a reference. License MIT (`LICENSE` at the repository root; `skill.json` also declares MIT). Evidence read in this pass: repository metadata, README (install and troubleshooting sections, including the pre-v2.5.1 symlink packaging note), `skill.json` 2.15.0, the `.claude/skills/` and `.claude/skills/ui-ux-pro-max` trees at commit `4f2dbb67`, `SKILL.md` and its path references. Nothing was installed and no client files were generated.",
      "repository": "nextlevelbuilder/ui-ux-pro-max-skill",
      "stars": 147361
    },
    {
      "archived": false,
      "category": "skill-ecosystem",
      "checked_at": "2026-11-10",
      "description": "The Agent Skills specification plus skills-ref, the Python reference implementation that validates a skill directory, reads its properties and renders the available-skills prompt block.",
      "evidence": [
        "https://api.github.com/repos/agentskills/agentskills",
        "https://agentskills.io",
        "https://github.com/agentskills/agentskills/blob/main/docs/specification.mdx",
        "https://github.com/agentskills/agentskills/blob/main/skills-ref/README.md",
        "https://github.com/agentskills/agentskills/blob/main/skills-ref/pyproject.toml",
        "https://github.com/agentskills/agentskills/tree/main/skills-ref/src",
        "https://pypi.org/project/skills-ref/",
        "https://github.com/agentskills/agentskills/blob/main/LICENSE"
      ],
      "homepage": "https://agentskills.io",
      "id": "agent-skills-spec",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-04T19:47:27Z",
      "license": "Apache-2.0",
      "name": "Agent Skills specification",
      "notes": "The normative document behind the `skill` kind in this catalog: `docs/specification.mdx` defines the `SKILL.md` frontmatter (`name`, `description`, optional `license`/`allowed-tools`/`metadata`), the directory layout and the progressive-disclosure rules that the `skill` recipes here follow, and `skills-ref/` is the Python reference implementation (`skills-ref validate <dir>`, `read-properties <dir>`, `to-prompt <dir>...`; importable API in `src/`, tests alongside, PyPI release 0.1.1, Python >=3.11, Apache-2.0). Recorded as a reference next to `anthropics/skills` and `agents-cli`: it is not a tool this installer puts into a client project, it is what to check a skill against, so there is no pinned recipe. Upstream marks `skills-ref` as demonstration-only rather than production tooling, which is recorded here as a caveat; the specification itself is what makes the entry useful. Evidence read in this pass: repository metadata, README, the `docs/` and `skills-ref/` trees, `skills-ref/README.md`, `skills-ref/pyproject.toml` and the PyPI release metadata. Nothing was installed and no skill was validated with it.",
      "repository": "agentskills/agentskills",
      "stars": 27113
    },
    {
      "archived": false,
      "category": "build-mcp",
      "checked_at": "2026-11-10",
      "description": "Open-source Python framework for building MCP servers and tools: decorator API over the full MCP spec (tools, resources, prompts, sampling, elicitation), authorization hooks, and an arcade-mcp CLI for scaffolding and running servers.",
      "evidence": [
        "https://api.github.com/repos/ArcadeAI/arcade-mcp",
        "https://github.com/ArcadeAI/arcade-mcp/blob/main/README.md",
        "https://github.com/ArcadeAI/arcade-mcp/tree/main/libs",
        "https://github.com/ArcadeAI/arcade-mcp/blob/main/libs/arcade-mcp-server/pyproject.toml",
        "https://github.com/ArcadeAI/arcade-mcp/tree/main/examples/mcp_servers",
        "https://pypi.org/project/arcade-mcp/",
        "https://docs.arcade.dev",
        "https://github.com/ArcadeAI/arcade-mcp/blob/main/LICENSE"
      ],
      "homepage": "https://docs.arcade.dev",
      "id": "arcade-mcp",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-09T21:03:13Z",
      "license": "MIT",
      "name": "Arcade MCP",
      "notes": "Third entry in the `build-mcp` lane next to `fastmcp` and the official `mcp-python-sdk`, and the most widely deployed of the three (the README attributes 7,500+ prebuilt tools across 81 hosted MCP servers to it): a decorator API covering tools, resources, prompts, sampling, elicitation, progress and logging, `requires_auth=` declarations that let the framework own OAuth and token refresh, a vendor-neutral client story, and the `arcade-mcp` CLI for scaffolding, running and deploying servers. It is reference-only for the same reason as `fastmcp`: it is a Python library (`pyproject.toml`, monorepo `libs/arcade-core`, `libs/arcade-mcp-server`, `libs/arcade-cli`, `libs/arcade-evals`, `libs/arcade-serve`, `examples/mcp_servers/`) installed as a dependency inside a server project, not an agent-side MCP server this installer can configure by launching a command, so there is no pinned recipe; `pip install arcade-mcp` resolves PyPI 1.17.6 (Python >=3.10) and the server package publishes separately as `arcade-mcp-server` 1.33.0. MIT license. Evidence read in this pass: repository metadata, README (framework highlights and install sections), the `libs/` and `examples/` trees, and the PyPI metadata for both packages. Nothing was installed and no server was started.",
      "repository": "ArcadeAI/arcade-mcp",
      "stars": 1088
    },
    {
      "archived": false,
      "category": "language-servers",
      "checked_at": "2026-11-10",
      "description": "Fork of Pyright that adds Pylance features, configurable checking modes, a baseline file and an `--outputjson` report, shipped with a `basedpyright-langserver` that speaks LSP.",
      "evidence": [
        "https://api.github.com/repos/DetachHead/basedpyright",
        "https://github.com/DetachHead/basedpyright/blob/main/README.md",
        "https://github.com/DetachHead/basedpyright/blob/main/docs/installation/command-line-and-language-server.md",
        "https://github.com/DetachHead/basedpyright/blob/main/.zed/settings.json",
        "https://github.com/DetachHead/basedpyright/blob/main/LICENSE.txt",
        "https://pypi.org/project/basedpyright/1.40.2/"
      ],
      "homepage": "https://docs.basedpyright.com",
      "id": "basedpyright",
      "install": null,
      "kind": "lsp",
      "last_pushed_at": "2026-11-10T11:06:10Z",
      "license": "MIT",
      "name": "basedpyright",
      "notes": "Recorded next to `pyright`, `ty`, `pyrefly` and `python-lsp-server` as the third Python type checker here that also ships a language server, because it exists for the parts upstream Pyright does not open-source: Pylance-style features (inlay hints, semantic highlighting, import organization), the `recommended` and `all` checking modes, a baseline file that lets an existing project adopt strict typing incrementally instead of fixing everything at once, and a CLI report in `--outputjson` for CI. Upstream describes it as a fork of Pyright with type-checking improvements and Pylance features, and publishes a documentation site for the differences. Distribution: PyPI package `basedpyright` 1.40.2 (published 2026-10-04, Python >=3.10, bundles a Node.js runtime), a Homebrew formula, and VS Code, Open VSX and Sublime Text integrations; the launch command `basedpyright-langserver --stdio` is taken from the repository's own Zed configuration (`.zed/settings.json`). It stays reference-only for the same reason as every raw language server here: LSP does not speak MCP, so an editor or an MCP-to-LSP bridge has to start it. License note: `LICENSE.txt` carries the MIT text inherited from Pyright, the PyPI classifiers say MIT, and the GitHub API reports `NOASSERTION` because of the modified header. 3,647 stars and 138 forks on 2026-11-10; nothing was installed and no language-server or editor session was started for this entry.",
      "repository": "DetachHead/basedpyright",
      "stars": 3647
    },
    {
      "archived": false,
      "category": "mcp-ecosystem",
      "checked_at": "2026-11-10",
      "description": "Server-side memory, handoff and experience layer for coding agents, exposed through an HTTP contract with a Python client, CLI, dashboard and a curated Agent-facing MCP projection over revisioned artifacts.",
      "evidence": [
        "https://api.github.com/repos/oceanbase/powercontext",
        "https://github.com/oceanbase/powercontext/blob/main/README.md",
        "https://github.com/oceanbase/powercontext/blob/main/LICENSE",
        "https://powercontext.oceanbase.io",
        "https://github.com/oceanbase/powercontext/blob/main/docs/en/docs/integrations/claude-code.md",
        "https://pypi.org/project/powercontext/1.5.1/"
      ],
      "homepage": "https://powercontext.oceanbase.io",
      "id": "powercontext",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-10T15:32:42Z",
      "license": "Apache-2.0",
      "name": "PowerContext",
      "notes": "Recorded in the memory lane that already holds `hippo-memory` and `codebase-memory-mcp`, with a different shape: memory, handoff, experience and skill are server-side artifacts behind an HTTP contract, and the Python client, CLI, dashboard, in-process Core SDK and MCP endpoint are views over the same server rather than files inside one agent's home directory. Delivery is a server the user runs and binds - `uv tool install --force \"powercontext[cli,server]==1.5.1\"` (PyPI 1.5.1, Apache-2.0) followed by creating the Scopes and using the returned `scope_id` - so no stdio launch command can be pinned and no install type in this catalog fits. Automatic capture additionally needs the client-side integration enabled, including trusting the PowerContext hooks in Codex, where the `UserPromptSubmit` hook is what makes prompt capture and recall run; the repository documents per-host integrations under `docs/en/docs/integrations/` (Codex is the `official` host, Claude Code and others are `community`) plus agent plugins, and all of it writes agent configuration rather than one launch entry. 1,575 stars, 631 forks and a push on 2026-11-10. Nothing was installed: no server was started, no scope was created, no hook was trusted and no MCP session was started.",
      "repository": "oceanbase/powercontext",
      "stars": 1575
    },
    {
      "archived": false,
      "category": "language-servers",
      "checked_at": "2026-11-10",
      "description": "Rust language server for pytest that resolves fixture definitions across `conftest.py` and third-party plugins, and answers yield navigation, fixture call hierarchy, completion, references, rename and diagnostics for test code.",
      "evidence": [
        "https://api.github.com/repos/bellini666/pytest-language-server",
        "https://github.com/bellini666/pytest-language-server/blob/master/README.md",
        "https://github.com/bellini666/pytest-language-server/blob/master/LICENSE",
        "https://pypi.org/project/pytest-language-server/0.26.0/",
        "https://crates.io/crates/pytest-language-server"
      ],
      "homepage": "https://github.com/bellini666/pytest-language-server",
      "id": "pytest-language-server",
      "install": null,
      "kind": "lsp",
      "last_pushed_at": "2026-11-07T09:22:51Z",
      "license": "MIT",
      "name": "pytest-language-server",
      "notes": "Recorded for a lane no other entry covers: pytest fixture semantics. It answers go-to-definition for fixtures in the same file, in `conftest.py` files and in third-party fixtures from plugins such as pytest-mock and pytest-asyncio while respecting pytest's fixture shadowing and priority rules; jumps to the `yield` that produces a generator fixture (with teardown navigation); exposes incoming and outgoing call hierarchy so the tests and fixtures around a dependency are visible; completes fixture names inside test and fixture functions with hierarchy-aware suggestions; finds references; renames; and reports diagnostics. The README documents root markers `pytest.ini`, `pyproject.toml`, `setup.py`, `setup.cfg` and `.git`. It stays reference-only because it is a raw LSP binary launched as `pytest-language-server`, the same boundary as `ruff`, `pyright` and `tombi`. Distribution: PyPI `pytest-language-server` 0.26.0 (published 2026-11-03, Python >=3.10, prebuilt wheels), `uv tool install` / `pip install` / `pipx`, a Homebrew tap, crates.io, GitHub release binaries and a source build. It is early-stage and single-maintainer (Rust, 124 stars, first release November 2025) and its README states it was built with AI coding agents and reviewed afterwards, so treat it as an addition to - not a replacement for - a navigation and type server. Nothing was installed and no editor or language-server session was started.",
      "repository": "bellini666/pytest-language-server",
      "stars": 124
    },
    {
      "archived": false,
      "category": "security",
      "checked_at": "2026-11-10",
      "description": "Trail of Bits plugin marketplace of 47 Agent Skills for security and development workflows: audit context building, differential and variant analysis, Semgrep rule authoring, property-based and mutation testing, supply-chain auditing and a modern Python project skill.",
      "evidence": [
        "https://api.github.com/repos/trailofbits/skills",
        "https://github.com/trailofbits/skills/blob/main/README.md",
        "https://github.com/trailofbits/skills/blob/main/.claude-plugin/marketplace.json",
        "https://github.com/trailofbits/skills/blob/main/LICENSE",
        "https://github.com/trailofbits/skills/tree/main/plugins"
      ],
      "homepage": "https://github.com/trailofbits/skills",
      "id": "trailofbits-skills",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-06T15:20:09Z",
      "license": "CC-BY-SA-4.0",
      "name": "Trail of Bits Skills",
      "notes": "The most complete security-workflow skill collection found in this pass, from an upstream that publishes security research and audits: 47 plugins in `.claude-plugin/marketplace.json`, including audit-context-building, differential-review, variant-analysis, patching-bugs, post-patch-validation, semgrep-rule-creator and semgrep-rule-variant-creator, cvss-scoring, sharp-edges, insecure-defaults, supply-chain-risk-auditor, plus traces of adjacent domains this catalog does not cover (smart contracts, malware and YARA, proofs), and a development group that does serve Python and Web work (`modern-python`, `code-improver`, `review-walkthrough`, `second-opinion`, `regression-hunt`, `property-based-testing`, `mutation-testing`, `static-analysis`, `gh-cli`, `devcontainer-setup`). It does not duplicate `security-review` (one ECC skill), `open-code-review`, or the scanner references (`semgrep`, `bandit`, `osv-scanner`, `gitleaks`, `pipelock`, `skillspector`): this is the workflow layer that decides what to audit, how to reproduce a finding and how to verify a patch, and upstream keeps a public trophy case of bugs found with it. It is reference-only because upstream delivers it as a plugin marketplace (`/plugin marketplace add trailofbits/skills`) and as per-plugin skill directories whose scripts and references differ, so there is no single subtree this catalog can pin and verify; the license is a second reason not to copy text - the content is CC-BY-SA-4.0 with a share-alike term, unlike the MIT skill collections already recorded (`anthropics/skills`, `vercel-labs/agent-skills`). 8,109 stars and 692 forks on 2026-11-10, last pushed 2026-11-06. Nothing was installed, no plugin was activated and no skill was run.",
      "repository": "trailofbits/skills",
      "stars": 8109
    },
    {
      "archived": false,
      "category": "python-toolchain",
      "checked_at": "2026-11-11",
      "description": "Structural search, lint and rewrite CLI over tree-sitter that matches code by AST pattern instead of text, shipped on PyPI as `ast-grep-cli` and recorded as the precise-rewrite layer a coding agent can call when a textual edit is not enough.",
      "evidence": [
        "https://api.github.com/repos/ast-grep/ast-grep",
        "https://github.com/ast-grep/ast-grep/blob/main/README.md",
        "https://github.com/ast-grep/ast-grep/blob/main/pyproject.toml",
        "https://github.com/ast-grep/ast-grep/tree/main/crates",
        "https://github.com/ast-grep/ast-grep/blob/main/LICENSE",
        "https://pypi.org/project/ast-grep-cli/",
        "https://ast-grep.github.io/"
      ],
      "homepage": "https://ast-grep.github.io/",
      "id": "ast-grep",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-11T11:55:46Z",
      "license": "MIT",
      "name": "ast-grep",
      "notes": "Reference only because the delivered unit is a native CLI, not one of this catalog's four install types: the repository is a Rust workspace (`crates/cli`, `core`, `language`, `config`, `lsp`, `pyo3`, `napi`, `wasm`) whose Python packaging path is `pip install ast-grep-cli` (root `pyproject.toml`, maturin backend, 0.51.2), so it belongs in a project environment next to `ruff` and `deptry` rather than in a client configuration. It fills the structural-rewrite lane this catalog did not have: the tree-sitter grammar for Python (`crates/language`) lets patterns such as `def $F($$$ARGS)` match by syntax and `--rewrite` apply one change across a repository, which a `grep`/`sed` pass cannot express safely. Upstream also carries an `lsp` subcommand (`crates/cli/src/lsp.rs`) for reporting ast-grep rules in an editor; that is rule diagnostics for the tool itself, not a Python language server, so it is not recorded in the LSP lane. Third-party MCP wrappers exist but are not this project's; no upstream skill or server is registered here. Evidence read in this pass: repository metadata, README, root `pyproject.toml`, the `crates/` tree, `LICENSE` (MIT) and the documentation site. Nothing was installed and no search or rewrite was run.",
      "repository": "ast-grep/ast-grep",
      "stars": 16554
    },
    {
      "archived": false,
      "category": "skill-ecosystem",
      "checked_at": "2026-11-11",
      "description": "Anthropic-managed directory of vetted Claude Code plugins — 317 entries covering skills, agents, hooks, commands and MCP servers — installed with `/plugin install <name>@claude-plugins-official`.",
      "evidence": [
        "https://api.github.com/repos/anthropics/claude-plugins-official",
        "https://github.com/anthropics/claude-plugins-official/blob/main/README.md",
        "https://github.com/anthropics/claude-plugins-official/blob/main/.claude-plugin/marketplace.json",
        "https://github.com/anthropics/claude-plugins-official/tree/main/plugins",
        "https://github.com/anthropics/claude-plugins-official/tree/main/external_plugins",
        "https://github.com/anthropics/claude-plugins-official/blob/main/LICENSE"
      ],
      "homepage": "https://code.claude.com/docs/en/plugins",
      "id": "claude-plugins-official",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-11T07:28:56Z",
      "license": "Apache-2.0",
      "name": "Claude Code plugin directory (official)",
      "notes": "Reference only because the delivered unit is a marketplace, not one pinnable subtree: each name in `.claude-plugin/marketplace.json` resolves to its own repository, subdirectory or version tag, so there is no single commit to pin and no skill directory to install. It is recorded next to `anthropics/skills`, `skills-cli` and `awesome-copilot` as the reviewed directory a project should prefer when it wants a Claude Code plugin, and it covers this catalog's lanes too — `plugins/` groups the Anthropic-maintained entries (including the MCP servers recorded here as `serena`, `context7`, `playwright` and `github`), while `external_plugins/` carries 14 partner entries that point back to their own projects. Upstream states the trust boundary explicitly: Anthropic does not control the MCP servers, files or software that third-party plugins reference and cannot verify they behave as intended, so review stays with the user. Evidence read in this pass: repository metadata, README (structure, installation and submission sections), `.claude-plugin/marketplace.json` (317 names, 41 top-level `plugins/` entries, 14 `external_plugins/` entries) and `LICENSE` (Apache-2.0). Nothing was installed and no plugin was activated.",
      "repository": "anthropics/claude-plugins-official",
      "stars": 46870
    },
    {
      "archived": false,
      "category": "security",
      "checked_at": "2026-11-11",
      "description": "Modular, stack-agnostic toolkit of 19 security-review skills plus a Google ADK reference harness that lets coding agents threat-model, research, reproduce, deduplicate, patch and calibrate vulnerabilities across a codebase.",
      "evidence": [
        "https://api.github.com/repos/google/mantis",
        "https://github.com/google/mantis/blob/main/README.md",
        "https://github.com/google/mantis/tree/main/skills",
        "https://github.com/google/mantis/blob/main/reference/README.md",
        "https://github.com/google/mantis/blob/main/reference/install.sh",
        "https://github.com/google/mantis/blob/main/schema.json",
        "https://github.com/google/mantis/blob/main/LICENSE"
      ],
      "homepage": "https://github.com/google/mantis",
      "id": "mantis",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-10T03:41:46Z",
      "license": "Apache-2.0",
      "name": "Mantis (Google)",
      "notes": "Reference only because the delivered unit is a skill collection plus a separate harness rather than one subtree to copy: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-structural-index`, `mantis-reflect` and the rest) that an agent loads on demand, while `reference/` is a Google ADK pipeline for the same method (`./install.sh`, `python3 scripts/configure.py --auto`, `./run.sh path/to/code`) that needs its own model provider (Vertex AI ADC or an API key) and `action/` runs it over a pull request. It is recorded in `security` next to `trailofbits-skills` and the scanner references because it orchestrates existing tools instead of adding another scanner, with upstream stating that AI findings and patches must be verified by a security expert before they are reported. Upstream's README also marks the pull-request scan as untested end to end and says not to use it to gate merges. Evidence read in this pass: repository metadata, README (installation, run modes, overview and warnings), the `skills/` listing (20 entries including its own README), `reference/README.md`, `reference/install.sh`, `schema.json` and `LICENSE` (Apache-2.0). Nothing was installed, no campaign was run and no code was scanned.",
      "repository": "google/mantis",
      "stars": 2758
    },
    {
      "archived": false,
      "category": "data-workflows",
      "checked_at": "2026-11-11",
      "description": "Self-contained product-analytics skill that turns user-level event logs into reproducible path, transition, funnel, segment, retention and sequence analysis results on top of the Apache-2.0 Retentioneering Python library.",
      "evidence": [
        "https://api.github.com/repos/retentioneering/retentioneering-tools",
        "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/SKILL.md",
        "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/references/analysis-recipes.md",
        "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/scripts/inspect_event_log.py",
        "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/LICENSE",
        "https://codeload.github.com/retentioneering/retentioneering-tools/tar.gz/68f699f67674375c59ea26c6a719e91e83905f51",
        "https://pypi.org/project/retentioneering/",
        "https://retentioneering.com/docs/"
      ],
      "homepage": "https://retentioneering.com",
      "id": "retentioneering",
      "install": {
        "license_path": "LICENSE",
        "ref": "68f699f67674375c59ea26c6a719e91e83905f51",
        "sha256": "c0fe070c7ad635c57b69f4d24ce394b6f21664c234ccdcf24db49af554568781",
        "subdir": ".agents/skills/retentioneering-product-analytics",
        "type": "skill",
        "url": "https://codeload.github.com/retentioneering/retentioneering-tools/tar.gz/68f699f67674375c59ea26c6a719e91e83905f51"
      },
      "kind": "skill",
      "last_pushed_at": "2026-11-08T11:26:31Z",
      "license": "Apache-2.0",
      "name": "Retentioneering",
      "notes": "Installable as one self-contained skill directory: `.agents/skills/retentioneering-product-analytics/` holds `SKILL.md` (with `name`, `description` and `license: Apache-2.0` frontmatter) plus `references/` (api-map, analysis-recipes, gotchas-and-validation) and `scripts/inspect_event_log.py`, five files whose every referenced path stays inside that directory, so the pinned archive recipe copies a working unit rather than a fragment. The same repository publishes the `retentioneering` Python package (Python >= 3.11) and an MCP server, which are the engine this skill drives; only the skill is installed here, so the library still has to be present in the environment that holds the event data. It is recorded in `data-workflows` because it answers product questions from user-level event data — paths, transitions, funnels, segments, retention, step matrices and sequence mining — which is the analysis lane this catalog had for schemas and migrations but not for clickstream behaviour. Evidence read in this pass: repository metadata, `SKILL.md` and its bundled-reference table, the `references/` and `scripts/` listings, `LICENSE` (Apache-2.0) and the downloaded archive at the pinned commit (5,951,483 bytes, subtree file count 5). Nothing was installed and no dataset was analysed.",
      "repository": "retentioneering/retentioneering-tools",
      "stars": 946
    },
    {
      "archived": false,
      "category": "mcp-ecosystem",
      "checked_at": "2026-11-11",
      "description": "Local-first Go MCP server (9 tools) that keeps a Git-versioned, agent-written map of a codebase and its database schema so a coding agent can orient itself without re-reading the repository on every task.",
      "evidence": [
        "https://api.github.com/repos/aoci-spec/aoci-code",
        "https://github.com/aoci-spec/aoci-code/blob/main/README.md",
        "https://github.com/aoci-spec/aoci-code/blob/main/README.zh-CN.md",
        "https://github.com/aoci-spec/aoci-code/tree/main/docs",
        "https://github.com/aoci-spec/aoci-code/tree/main/spec",
        "https://github.com/aoci-spec/aoci-code/blob/main/LICENSE"
      ],
      "homepage": "https://www.aoci.ai",
      "id": "aoci-code",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-11T07:21:07Z",
      "license": "FSL-1.1-MIT",
      "name": "AOCI-CODE",
      "notes": "Reference only because the delivered unit is a Go binary that starts a local MCP server a project registers itself: `.goreleaser.yml`, `docs/` (22 entries) and `spec/` (the index grammar) describe the release binaries and the file format, and the README documents the agent-written index (`aoci.txt`, `aoci.code.txt`, `aoci.meta.txt`) committed next to the code and updated through the server's 9 tools as work lands, with the badge still marking v0.2.0-rc1. It is recorded in `mcp-ecosystem` next to `codebase-memory-mcp`, `chunkhound`, `powercontext` and `code-review-graph` for the same problem — a repository an agent should not re-read on every task — with a different mechanism: one model-written line per file, versioned by Git and re-verified against the tree instead of retrieved by embedding. License caveat recorded with the entry: the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`, FSL-1.1-MIT; the GitHub API reports `NOASSERTION` because the header is adapted), which permits non-competing use and converts to MIT later, so no text from `spec/` or `docs/` is copied into this repository and the entry stays reference-only. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS` and `THIRD-PARTY-NOTICES` files plus a Glama listing. Evidence read in this pass: repository metadata, both READMEs, README.zh-CN.md, the root tree listing, the `docs/` and `spec/` listings and `LICENSE`. Nothing was installed and no index was built.",
      "repository": "aoci-spec/aoci-code",
      "stars": 1897
    },
    {
      "archived": false,
      "category": "mcp-ecosystem",
      "checked_at": "2026-11-12",
      "description": "Answer code questions from a local CPU-only repository index that returns ranked snippets instead of making the agent grep and read whole files, over an MCP server, a CLI, an agent skill or a sub-agent.",
      "evidence": [
        "https://api.github.com/repos/MinishLab/semble",
        "https://github.com/MinishLab/semble/blob/main/README.md",
        "https://github.com/MinishLab/semble/blob/main/docs/installation.md",
        "https://github.com/MinishLab/semble/blob/main/pyproject.toml",
        "https://github.com/MinishLab/semble/blob/main/src/semble/mcp.py",
        "https://pypi.org/project/semble/0.7.3/",
        "https://github.com/MinishLab/semble/blob/main/LICENSE"
      ],
      "homepage": "https://minish.ai/packages/semble/introduction/",
      "id": "semble",
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--from",
          "semble[mcp]==0.7.3",
          "semble"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.7.3",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); the `mcp` extra requires mcp>=2.0,<3.0; the server indexes the directory it is started in, and the first run downloads the embedding model and the tree-sitter grammars"
      },
      "kind": "mcp",
      "last_pushed_at": "2026-11-08T08:23:11Z",
      "license": "MIT",
      "name": "Semble",
      "notes": "Installable because the distribution ships a stdio MCP server behind a documented extra: upstream configures clients as `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble` (the `mcp` extra caps `mcp<3.0`), and in this pass that exact command passed `initialize` and `tools/list` through the Python MCP SDK before any tool was called. Recorded in `mcp-ecosystem` next to `chunkhound`, `codebase-memory-mcp`, `repomix`, `aoci-code` and `code-review-graph` as a different retrieval mechanism for the same problem — a repository an agent should not re-read per task: static embeddings and reranking on CPU, no GPU, no API key and no external service, so the index is cheap enough to rebuild instead of cached in the project. The package offers four delivery modes from one installer (`semble install` writes MCP configuration, AGENTS.md/CLAUDE.md instructions, a `semble-search` sub-agent, or a `semble` skill plus a one-line pointer); this recipe records only the MCP launch, and no instruction file, sub-agent or skill is written by this catalog. Retrieval-quality, index-speed and token-count figures in the README (`#benchmarks`, `assets/images/*.png`) are upstream's own measurements and were not reproduced here. Evidence read in this pass: repository metadata, README, `docs/installation.md`, `pyproject.toml`, `src/semble/` layout (`mcp.py`, `search.py`, `agents/`), PyPI 0.7.3 metadata and `LICENSE` (MIT). No query was run beyond the smoke check and no index outside the working directory was built.",
      "repository": "MinishLab/semble",
      "stars": 6403
    },
    {
      "archived": false,
      "category": "python-toolchain",
      "checked_at": "2026-11-12",
      "description": "Turn a Python import graph into assertions an agent and CI can both fail on: what an edit reaches, which tests it affects, where the cycles are, and whether the graph still agrees with the layers the project declared.",
      "evidence": [
        "https://api.github.com/repos/hslee16/Archy",
        "https://github.com/hslee16/Archy/blob/main/README.md",
        "https://github.com/hslee16/Archy/blob/main/server.json",
        "https://github.com/hslee16/Archy/blob/main/docs/WHAT_DIDNT_WORK.md",
        "https://github.com/hslee16/Archy/blob/main/skills/archy/SKILL.md",
        "https://github.com/hslee16/Archy/blob/main/src/archy/mcp.py",
        "https://github.com/hslee16/Archy/blob/main/pyproject.toml",
        "https://pypi.org/project/archy/0.55.1/",
        "https://github.com/hslee16/Archy/blob/main/LICENSE"
      ],
      "homepage": "https://github.com/hslee16/Archy",
      "id": "archy",
      "install": {
        "type": "mcp",
        "command": "uvx",
        "args": [
          "--python",
          "3.12",
          "--from",
          "archy==0.55.1",
          "archy",
          "mcp"
        ],
        "requirements": [
          "uvx"
        ],
        "version": "0.55.1",
        "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); `mcp>=1.28.1,<3` is a base dependency; the server analyses the import graph of the directory it is started in and writes no state there"
      },
      "kind": "mcp",
      "last_pushed_at": "2026-11-12T15:30:46Z",
      "license": "MIT",
      "name": "Archy",
      "notes": "Installable because the same graph is exposed twice, and the second surface is a documented stdio MCP server: upstream records `mcp` as the package argument in `server.json` and in the README's install section, and in this pass `uvx --python 3.12 --from archy==0.55.1 archy mcp` passed `initialize` and `tools/list` through the Python MCP SDK. Python-only and static: it parses imports, so it needs no interpreter run, no database and no test execution to answer blast radius, affected tests, cycles, coupling and layer agreement, and `check` exits non-zero on a violation, which is what makes it usable both in a session and in CI. It fills a lane this catalog was missing: `ruff`, `ty` and `pyright` cover style, types and imports at file scope, while this answers transitive reach and direction against layers the project declares. Upstream is unusually explicit about what it is not — a code-navigation tool; that lane stays with `serena`, `lsp-mcp-server` and the descriptive graph tools — and it publishes its negative results (0 of 25 unaided agent runs on the riskiest SWE-bench tasks introduced a cycle or a declared-layer violation, upper bound 12%; 0.5% of 1,072 human commits did), which is why its own README retracts the 'agents will rot your import graph' premise in `docs/WHAT_DIDNT_WORK.md`. Recorded from a young repository (8 stars on 2026-11-12) whose CI, e2e install workflow, scoring documents, Claude Code marketplace manifest, bundled `skills/archy` skill and GitHub Action were read rather than audited. Evidence read in this pass: repository metadata, README, `server.json`, `docs/SCORING.md`, `docs/WHAT_DIDNT_WORK.md`, the `src/archy/` module list, PyPI 0.55.1 metadata and `LICENSE` (MIT). No project beyond the smoke check was analysed, no layer configuration was written and the `contracts` extra (import-linter) was not installed.",
      "repository": "hslee16/Archy",
      "stars": 8
    },
    {
      "archived": false,
      "category": "skill-ecosystem",
      "checked_at": "2026-11-12",
      "description": "Build, benchmark and optimise an agentic skill for a Python package by running coding agents against training tasks, rewriting the skill from the errors they make, and scoring each version on held-out validation tasks.",
      "evidence": [
        "https://api.github.com/repos/scverse/acumen",
        "https://github.com/scverse/acumen/blob/main/README.md",
        "https://github.com/scverse/acumen/blob/main/docs/getting_started.md",
        "https://github.com/scverse/acumen/blob/main/docs/index.md",
        "https://github.com/scverse/acumen/tree/main/src/acumen",
        "https://github.com/scverse/acumen/blob/main/pyproject.toml",
        "https://pypi.org/project/acumen/0.0.2/",
        "https://github.com/scverse/acumen/blob/main/LICENSE"
      ],
      "homepage": "https://acumen-skills.readthedocs.io/",
      "id": "acumen",
      "install": null,
      "kind": "reference",
      "last_pushed_at": "2026-11-12T15:30:12Z",
      "license": "MIT",
      "name": "Acumen",
      "notes": "Reference only because the delivered unit is a project harness rather than a skill, rule pack, MCP server or bridge: `acumen init` scaffolds a configuration and a task set for one target package, the run executes coding agents against the training split, the rewrite step edits the package's `SKILL.md` from the measured failures, and the score step evaluates the new version on held-out validation tasks — so using it means owning a driver model, an agent CLI, task data and throwaway environments for the target project. It is recorded in `skill-ecosystem` next to `skillevaluator` and `agent-skills` as the generating counterpart of the auditing tools this catalog already had: those measure or review a skill that exists, this one produces and optimises it and reports the score per version. Same upstream as the Python scientific tooling already recorded (`pytest`, `hypothesis`); the package is young (PyPI 0.0.2, Python >=3.12) and documents its own method, configuration and validation split on Read the Docs. Evidence read in this pass: repository metadata, README, `docs/` (index and getting-started), the `src/acumen/` layout, `pyproject.toml`, PyPI metadata and `LICENSE` (MIT). Nothing was installed, no agent was run and no skill was rewritten.",
      "repository": "scverse/acumen",
      "stars": 20
    }
  ],
  "profiles": {
    "starter": [
      "systematic-debugging",
      "test-driven-development",
      "verification-before-completion",
      "context7",
      "ecc-common-rules"
    ],
    "python": [
      "systematic-debugging",
      "test-driven-development",
      "verification-before-completion",
      "context7",
      "python-testing-patterns",
      "python-packaging",
      "fetch",
      "ecc-python-rules",
      "python-patterns"
    ],
    "web": [
      "systematic-debugging",
      "test-driven-development",
      "verification-before-completion",
      "context7",
      "playwright",
      "ecc-typescript-rules",
      "frontend-patterns"
    ],
    "engineering": [
      "ecc-common-rules",
      "coding-standards",
      "api-design",
      "database-migrations",
      "deployment-patterns",
      "systematic-debugging",
      "test-driven-development",
      "verification-before-completion"
    ],
    "security": [
      "ecc-common-rules",
      "security-review"
    ],
    "django": [
      "ecc-python-rules",
      "python-patterns",
      "django-patterns",
      "django-security",
      "python-testing-patterns",
      "context7"
    ],
    "fastapi": [
      "ecc-fastapi-rules",
      "python-patterns",
      "fastapi-patterns",
      "api-design",
      "security-review",
      "python-testing-patterns",
      "context7"
    ],
    "springboot": [
      "ecc-java-rules",
      "springboot-patterns",
      "springboot-security",
      "api-design",
      "database-migrations",
      "context7"
    ],
    "typescript": [
      "ecc-typescript-rules",
      "coding-standards",
      "frontend-patterns",
      "backend-patterns",
      "nextjs-turbopack",
      "security-review",
      "context7"
    ],
    "golang": [
      "ecc-golang-rules",
      "golang-patterns",
      "api-design",
      "security-review",
      "context7"
    ],
    "lsp": [
      "serena"
    ]
  }
}