From 3de5e29297f2594171e8318d3892e15c0d1c483c Mon Sep 17 00:00:00 2001 From: Shaowei Pu Date: Sun, 8 Nov 2026 08:27:57 +0800 Subject: [PATCH] =?UTF-8?q?feat(catalog):=20add=20mustel,=20skillsaw,=20py?= =?UTF-8?q?thon-dev-skills,=20agents-cli=20(=E6=9D=A5=E8=87=AA=E6=AF=8F?= =?UTF-8?q?=E6=97=A5=E5=80=99=E9=80=89=E6=89=AB=E6=8F=8F)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 每日候选扫描新增 4 条（去重后，基于上一版 95 条）： - mustel（mustel-py/mustel，mcp / python-toolchain，19★，MIT）：经 scripts/smoke_mcp.py 实跑通过（pinned `uvx --python 3.12 --with mcp<2 --from mustel==0.3.4 mustel serve`， initialize + tools/list，protocol 2025-11-25，server mustel 1.30.0， 发现 5 个工具 review/review_file/get_code_map/env/bootstrap）。Ruff、 Bandit、Oxlint、pip-audit 统一到一个 stdio MCP server，dev/audit 双模式， 并提供压缩 AST 代码地图。 - skillsaw（stbenjam/skillsaw，reference / skill-ecosystem，71★， Apache-2.0）：PyPI 上的 agent 文件 linter（SKILL.md、插件与 marketplace 清单、hooks、MCP 配置与 registry 元数据、CLAUDE.md/AGENTS.md），带 content/token-economy 与供应链规则、autofix、baseline 与 pre-commit 钩子。 - python-dev-skills（wdm0006/python-skills，reference / python-skills， 111★，MIT）：Claude Code 插件市场，Python 库全生命周期 skills （packaging/testing/api-design/security-audit/mcp-servers 等）+ 20 个共享 skills；因 bundle 共享 skills/common/* 且仓库计划改名，仅作参考条目。 - agents-cli（google/agents-cli，reference / skill-ecosystem，6315★， Apache-2.0）：Google ADK 的 7 个 Agent Skills + google-agents-cli CLI （PyPI 1.13.0，Python >=3.11）；deploy/publish 需自备 Google Cloud 项目。 同批核查后拒绝：00200200/usagetrim（输出压缩，与已收录 headroom 同通道， 且只有 mcpb 包）、fallow-rs/fallow-skills（已收录 fallow 的配套 skills）、 Goldziher/poly（polylint 为安装器包装，范围与 ruff/fallow 重叠）、 semgrep/mcp（上游已归档，最近 push 2025-10-28）。 文档同步：docs/CATALOG.md（Reviewed 2026-11-08，95→99 条、45→46 可安装、 50→53 参考、15→16 MCP）、docs/RESEARCH.md（Research date、候选复核章节、 安装证据表、MCP smoke 记录）、CHANGELOG.md 与两个 README 的计数行。 校验：catalog.json 通过 schema 校验（duplicate_ids=none， profile_dangling=none），`uv run pytest -q` 100 passed / 1 skipped， 站点构建与 check_site 通过。 --- CHANGELOG.md | 22 +++++ README.md | 2 +- README.zh-CN.md | 2 +- docs/CATALOG.md | 11 ++- docs/RESEARCH.md | 23 ++++- src/awesome_python_dev/data/catalog.json | 113 ++++++++++++++++++++++- 6 files changed, 168 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0f2786f..9988f21 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -200,6 +200,28 @@ Catalogue additions from the 2026-11-07 candidate review. - `docs/CATALOG.md`, `docs/RESEARCH.md`, and both READMEs were updated in the same change. +Catalogue additions from the 2026-11-08 candidate review. + +- One installable MCP server, smoke-checked through `scripts/smoke_mcp.py`: + `mustel-py/mustel` (pinned + `uvx --python 3.12 --with mcp<2 --from mustel==0.3.4 mustel serve`, 5 tools + discovered; Ruff, Bandit, Oxlint and pip-audit in one stdio server with a + compressed AST code map and an audit mode that also runs dependency + vulnerability checks). +- Three reference-only entries: `stbenjam/skillsaw`, a PyPI linter for the + skills, plugin manifests, hooks, instruction files and MCP metadata a coding + agent loads, recorded next to `agnix` for its different delivery shape; + `wdm0006/python-skills`, a Claude Code plugin marketplace whose Python bundles + cover the library lifecycle but whose members share `skills/common/*` files and + whose repository is scheduled to be renamed; and `google/agents-cli`, Google's + seven-skill ADK lifecycle bundle plus the `google-agents-cli` CLI, which stays + a reference because the bundle is not one pinnable subtree and its deploy, + publish and hosted-eval paths need the user's own Google Cloud project. +- The catalog now has 99 entries: 46 installable resources (22 skills, 6 rule + packs, 16 MCP servers, and 2 LSP bridges) and 53 references. +- `docs/CATALOG.md`, `docs/RESEARCH.md`, and both READMEs were updated in the + same change. + ## npm shell 0.1.1 — 2026-10-28 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads, diff --git a/README.md b/README.md index ab2b357..38c712b 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**. -The repository catalog includes **95 entries**: **45 installable resources** (22 skills, 6 rule packs, 15 MCP servers, and 2 LSP bridges) and **50 references** (agent-lsp, mcpls, 11 native language servers, and 37 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. +The repository catalog includes **99 entries**: **46 installable resources** (22 skills, 6 rule packs, 16 MCP servers, and 2 LSP bridges) and **53 references** (agent-lsp, mcpls, 11 native language servers, and 40 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. ## Contents diff --git a/README.zh-CN.md b/README.zh-CN.md index bc0f405..c6c2ab7 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -17,7 +17,7 @@ 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。 -仓库目录收录 **95 个条目**：**45 个可安装资源**（22 个 skills、6 套规则、15 个 MCP servers、2 个 LSP 桥接），以及 **50 个参考条目**（agent-lsp、mcpls、11 个原生语言服务、37 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 +仓库目录收录 **99 个条目**：**46 个可安装资源**（22 个 skills、6 套规则、16 个 MCP servers、2 个 LSP 桥接），以及 **53 个参考条目**（agent-lsp、mcpls、11 个原生语言服务、40 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 ## 目录 diff --git a/docs/CATALOG.md b/docs/CATALOG.md index 67fe613..c7d6516 100644 --- a/docs/CATALOG.md +++ b/docs/CATALOG.md @@ -1,6 +1,6 @@ # Curated catalog / 精选目录 -Reviewed **2026-11-07**, catalog schema **2**. **95 entries**, with **45 installable/configurable integrations** and **50 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 15 MCP servers, and 2 MCP-to-LSP bridges. The 15 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the two reference-only bridges (agent-lsp, mcpls), and 11 standalone language-server references. +Reviewed **2026-11-08**, catalog schema **2**. **99 entries**, with **46 installable/configurable integrations** and **53 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 16 MCP servers, and 2 MCP-to-LSP bridges. The 15 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the two reference-only bridges (agent-lsp, mcpls), and 11 standalone language-server references. Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status. @@ -58,6 +58,7 @@ Profiles select relevant tools instead of loading every available rule and frame | --- | --- | --- | ---: | --- | | [`python-testing-patterns`](https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-testing-patterns) | Practical pytest fixtures, parametrization, mocking, async testing, and coverage guidance. | Install skill | 41,868 | MIT | | [`python-packaging`](https://github.com/wshobson/agents/tree/0874a27b17a22e2b7c2e2bcd725768e0803cad06/plugins/python-development/skills/python-packaging) | Build Python libraries and CLIs with package metadata, wheels, and release workflows. | Install skill | 41,868 | MIT | +| [`python-dev-skills`](https://github.com/wdm0006/python-skills) | Claude Code skills for the Python library lifecycle — packaging, testing, API design, security audit, performance, release management, MCP servers, FastAPI/Postgres web apps — plus shared and other-language bundles. | Reference only | 111 | MIT | | [`python-patterns`](https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/python-patterns) | Python idioms, type hints, error handling, resource management, and maintainable code structure. | Install skill | 290,505 | MIT | | [`fastapi-patterns`](https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/fastapi-patterns) | FastAPI application structure, Pydantic v2, async dependencies, service layers, and HTTP testing. | Install skill | 290,505 | MIT | | [`django-patterns`](https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b/skills/django-patterns) | Django and DRF architecture, ORM access, caching, middleware, and service organization. | Install skill | 290,505 | MIT | @@ -159,6 +160,8 @@ Profiles select relevant tools instead of loading every available rule and frame | [`skillevaluator`](https://github.com/NVIDIA/SkillEvaluator) | Score agent skill quality, detect overlap between skills, and measure a skill's effect on live agent runs. | Reference only | 612 | Apache-2.0 | | [`ai-rulez`](https://github.com/Goldziher/ai-rulez) | Compile one rules, skills, and MCP source into native instruction files for dozens of coding agents, with lock files, signing, approvals, and policy checks. | Reference only | 166 | MIT | | [`cross-code-organizer`](https://github.com/mcpware/cross-code-organizer) | Inventory what each coding agent will actually load — configuration, memories, skills, and MCP servers — edit those files in place, and scan MCP tool descriptions for poisoning. | Reference only | 386 | MIT | +| [`skillsaw`](https://github.com/stbenjam/skillsaw) | Lint, autofix and baseline the skills, plugin manifests, hooks and instruction files a coding agent loads across the major agent ecosystems. | Reference only | 71 | Apache-2.0 | +| [`agents-cli`](https://github.com/google/agents-cli) | Seven Agent Skills plus a CLI for building, evaluating, deploying, observing and publishing ADK agents on Google Cloud. | Reference only | 6,315 | Apache-2.0 | ## Python project toolchain @@ -171,6 +174,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`deptry`](https://github.com/osprey-oss/deptry) | Detect missing, unused, and misplaced dependencies in a Python project. | Reference only | 1,498 | MIT | | [`orm-lens`](https://github.com/FROWNINGdev/orm-lens) | Answer Django model questions over MCP from static parsing — relations, ER diagrams, migration risk, N+1 candidates, and schema drift — with SQLAlchemy preview support. | Configure MCP | 96 | MIT | | [`misata`](https://github.com/rasinmuhammed/misata) | Declare the facts a dataset must hold and get multi-table synthetic test rows over MCP, with a certificate a DuckDB run re-checks, next to a CLI and a pytest plugin. | Configure MCP | 75 | MIT | +| [`mustel`](https://github.com/mustel-py/mustel) | Run Ruff, Bandit, Oxlint and pip-audit over MCP for the project it is launched in, with a compressed AST code map and an audit mode for dependency vulnerabilities. | Configure MCP | 19 | MIT | ## Building MCP integrations @@ -210,6 +214,7 @@ Skill and rule archives are pinned to full commits and verified against a record | `misata` | `uvx --python 3.12 --from 'misata[mcp]==0.9.8.1' misata-mcp` | uv/uvx; Python 3.12 pinned; only the MCP server is configured, not the CLI, pytest plugin, or studio | | `seleniumbase` | `uvx --python 3.13 --from 'seleniumbase[mcp]==4.57.1' seleniumbase-mcp` | uv/uvx; Python 3.13 pinned (the `mcp` extra needs >=3.10); a Chrome/Chromium installation is a prerequisite for the browser tools | | `dbhub` | `npx -y @bytebase/dbhub@1.5.1 --transport stdio --demo` | Node.js >=22.5 for the built-in `node:sqlite`; `--demo` serves the bundled sample SQLite database and is replaced by `--dsn` for a real database | +| `mustel` | `uvx --python 3.12 --with mcp<2 --from mustel==0.3.4 mustel serve` | uv/uvx; Python 3.12 pinned (the package needs >=3.10 while this host's system Python is 3.9); published `0.3.4` leaves `mcp` uncapped, so the recipe adds `--with mcp<2`; the server analyses the directory it starts in, and its `bootstrap` tool is never called | - **Context7:** API keys are optional in the pinned stdio package guidance for higher limits/private repositories. Service access and policy can change independently of the package version. Configure credentials through the chosen agent; do not commit secrets. - **Playwright:** A supported browser is needed for browser operations. Configuring the server does not install browser binaries. @@ -221,6 +226,7 @@ Skill and rule archives are pinned to full commits and verified against a record - **mcpls:** The other reference-only bridge. It is distributed as a Rust binary through `cargo install mcpls`, an upstream install script, release archives, or a container image, and needs at least one language server (for example pyright) installed separately. Enabling it next to Serena or lsp-mcp-server would give the same project two bridges over the same servers. - **code-review-graph:** The project path is resolved into the MCP configuration and the server indexes it with Tree-sitter; graph data stays in a `.code-review-graph` directory inside the project. Building or refreshing the graph is an explicit CLI or tool step, and upstream `install` also writes hooks, skills, and rules files that this recipe does not touch. - **mcp-tools-py:** A Python-only companion to the reference-only pytest, Ruff, and Bandit entries. Its `--with mcp<2` pin is deliberate: published `0.1.10` imports `mcp.server.fastmcp` without capping `mcp`, so the default mcp 2.x resolution fails at startup. The checks run through the server's own interpreter unless `--python-executable`/`--venv-path` is configured, so pylint, pytest, and mypy must exist in that environment. +- **mustel:** Python static-analysis orchestration over MCP with a dependency-audit lane: Ruff, Oxlint and local YAML patterns run locally in dev mode with a stat-based (`mtime` + `size`) cache, `CI`/`GITHUB_ACTIONS`/`PRE_COMMIT` switch on the Bandit and pip-audit passes, and `get_code_map` returns a compressed AST/regex skeleton of classes, functions and docstrings (upstream describes a 1,500-token budget) with `.ipynb` code cells parsed natively. The recipe pins `--python 3.12` because the package requires Python >=3.10 while this host's system Python is 3.9, and adds `--with mcp<2` because published `0.3.4` imports `mcp.server.fastmcp` without capping `mcp` — the same failure mode recorded for `mcp-tools-py`; the pinned release matches the version in `main`'s `pyproject.toml` but predates the repository's October commits. It overlaps `mcp-tools-py` (pylint, pytest, mypy, Ruff, symbol renames) as a Python checker behind MCP, so pick per tool set: neither exposes the other's checks, and only this one carries dependency auditing. Its `bootstrap` tool and `mustel bootstrap` command rewrite `~/.cursor/mcp.json`, `~/.claude.json`, Claude Desktop configuration, project `.cursorrules`/`.windsurfrules` and git pre-commit hooks machine-wide; this catalog writes only the stdio launch configuration and never calls it. Ruff, Bandit, pip-audit, Semgrep and OSV-Scanner stay reference-only, so no scanner is installed by this recipe. The smoke check completed `initialize` (server `mustel`, reported version `1.30.0`, protocol `2025-11-25`) and listed 5 tools; no tool was called, so no project was analysed, no code map was generated and no guardrail fired. - **fallow:** TypeScript and JavaScript health analysis over MCP — complexity, duplication, architecture boundaries, styling drift, and dead code. The server analyses the directory it is launched in and takes no project argument. Upstream `fallow agent install` additionally writes an `AGENTS.md` task map, installs skills, registers itself, and adds git commit and push gates; this recipe writes only the launch configuration. The npm package pins a per-platform binary and needs Node.js 22 or newer. - **repomix:** Packs a repository into a single AI-oriented file and exposes the pack plus read/grep tools over MCP. The npm package pins a per-platform payload and needs Node.js 22 or newer. Upstream documents `repomix --mcp` and the npx form used here; the smoke check completed `initialize` and listed six tools. Without `--sandbox` the server can read any path the host user can and trusts `repomix.config.*` in whatever directory it packs, which upstream describes as code execution; `--mcp --sandbox path/to/project` confines the file tools to one workspace and drops config loading, remote packing, and skill generation, at the cost of remote targets. - **roam-code:** Local codebase intelligence over MCP — symbol search, dependency and coupling maps, dead code, taint paths, file metrics, and change-impact answers for the directory the server starts in. The launcher pins `--python 3.12` because the package requires Python >=3.10 while an unpinned `uvx` resolution on the smoke host picked Python 3.9 and exited before the handshake. The index and its lock/state sidecars live in `.roam/` (`ROAM_DB_DIR` relocates the store, `ROAM_NO_AUTO_INDEX=1` refuses implicit builds); upstream documents `roam init` and `roam index` as explicit steps. The CLI and MCP server are Apache-2.0 and need no account or API key for local analysis, and upstream states local analysis does not upload source, indexes, findings, or telemetry; separate review and cloud services exist and are not configured here. The smoke check completed `initialize` and listed 17 tools, and no tool was called, so analysis quality is unverified. @@ -244,10 +250,13 @@ Skill and rule archives are pinned to full commits and verified against a record - **pyrefly:** A third Rust-based Python type checker and language server next to `pyright` and `ty`. Only the `pyrefly lsp` subcommand is documented as LSP entry (as registered by nvim-lspconfig); there is no MCP or agent-config recipe to pin. Upstream ships monthly minor releases that may report new errors, so a project-wide first run should be expected to fail until errors are triaged with `pyrefly suppress`. - **tombi:** The only configuration-file language server recorded here: schema-driven TOML formatting, linting, and diagnostics for `pyproject.toml`, uv, Ruff, and pytest settings, which is the part of a Python project an agent edits as eagerly as the source. It is reference-only like the other standalone servers because it is a raw LSP binary (`tombi lsp`) that an editor or agent client launches rather than an MCP service, and because the useful launch command depends on the client a project already has: one Rust binary is behind the curl installer, Homebrew, winget, `uvx`/`uv tool install`, npm, and the VS Code, Open VSX, Zed, JetBrains, Helix, Neovim, and Emacs integrations. Completion and validation come from the JSON Schema Store; nvim-lspconfig registers it for `toml` files and roots it at `pyproject.toml`. - **agnix:** The second configuration-facing server recorded here, after `tombi`, but it targets the agent's own files rather than the project's. 758 rules validate `CLAUDE.md`, `AGENTS.md`, `SKILL.md`, `.claude/rules/*.md`, hooks, plugin manifests, and MCP configuration, with several hundred of them scoped per client (Claude Code 170, Codex CLI 89, Cursor 40), and `agnix --fix` applies the safe subset of the findings. It is reference-only for the same reason as the other standalone servers — a raw LSP binary (`agnix-lsp`) that a client launches rather than an MCP service — and because the useful command depends on the client a project already has: one Rust toolchain is behind npm, Homebrew, PyPI, cargo, and the VS Code, JetBrains, Neovim, and Zed integrations. The same binary also ships a CLI and an optional `agnix-mcp` server; neither is configured by this catalog, and no lint run, `--fix`, or language-server session was performed for this entry. +- **skillsaw:** The second entry whose subject is the agent's own files, after `agnix`, recorded because the delivery shape differs: a Python package on PyPI (`uvx skillsaw tree`, `uvx skillsaw`, `uvx skillsaw fix`, `uvx skillsaw baseline`, plus a `.pre-commit-hooks.yaml` gate) rather than a Rust LSP binary. It validates structure across Agent Skills, Agent Plugins v1, Claude Code and OpenAI Codex plugins and marketplaces, Cursor, Grok Build, Z.ai ZCode, Google Antigravity, GitHub Copilot / VS Code custom agents, OpenCode, Pi, native OpenClaw plugins, APM packages, MCP server maps, MCP Registry `server.json`, Vercel skills lockfiles, `CLAUDE.md`/`AGENTS.md`/`GEMINI.md`/`QWEN.md`, hooks and eval formats; applies content and token-economy rules (instruction drift across duplicate files, instruction budget, section length, weak language, contradictions), discovery-integrity checks and supply-chain rules (`hooks.json` remote execution, `curl | sh`, `eval` obfuscation, strict MCP allowlists, invisible unicode, prompt-injection payloads, embedded credentials); and separates deterministic autofixes from guidance. It stays reference-only as a CLI linter rather than one of the four install types — its own `npx skills add stbenjam/skillsaw` path installs only the `skillsaw-onboard` skill, which drives the same `uvx` CLI. It is adjacent to `cross-code-organizer`, `skillevaluator` and `SkillSpector` rather than a duplicate of any of them. Nothing was installed and no repository was linted. - **deptry:** Reference only. It is a CLI run inside a project environment, because it inspects the declared dependencies and compares them against the imports actually used; running it in the wrong interpreter reports misleading results. It is not part of the catalog's checks, and recording it neither installs nor runs it. - **Conflict to resolve yourself:** `pyright`, `pyrefly`, and `ty` are alternative Python type-checking servers, and `ruff server` covers lint/format diagnostics. Pick the servers your editor should run instead of enabling all of them. - **Test dependencies:** `hypothesis` is a project dependency next to `pytest`, not an MCP server or agent skill. Recording it neither adds nor runs tests and does not configure CI. - **agent-skills collection:** The two selected skills come from a larger, mostly single-file skill collection with its own plugin manifests and hooks. Only the pinned skill directories are copied; hooks, commands, and agent definitions stay upstream. +- **python-dev-skills:** A Claude Code plugin marketplace (`/plugin marketplace add wdm0006/python-skills`, then `/plugin install python-library-complete@dev-skills` or a narrower bundle such as `python-library-foundations`, `python-library-quality`, `python-web-app` or `python-mcp-servers`) whose Python skills cover the library lifecycle — `project-setup`, `packaging`, `testing-strategy`, `code-quality`, `api-design`, `documentation`, `release-management`, `security-audit`, `performance`, `lazy-dependencies`, `library-review`, `llm-features`, `mcp-servers`, `cli-development`, `web-app-architecture` — with twenty shared `skills/common/` skills (git hygiene, GitHub Actions, CI permissions, rendering untrusted content, destructive operations, UI design) and smaller Go, Rust, Scala, Swift and browser-extension sets. Its README states a repository rename is planned now that the collection is polyglot. It is reference-only because a bundle's members share `skills/common/*` files, which this catalog's recipe (one pinned subtree with a `SKILL.md` at its root and an archive SHA-256) cannot install without dangling references, and because the marketplace path itself is scheduled to change. Nothing was installed and no bundle was activated. +- **agents-cli:** The first entry here about building the agent rather than tooling a project, and the ADK counterpart to the skill collections above: seven Agent Skills (`google-agents-cli-workflow`, `google-agents-cli-adk-code`, `google-agents-cli-scaffold`, `google-agents-cli-eval`, `google-agents-cli-deploy`, `google-agents-cli-publish`, `google-agents-cli-observability`) cover the ADK Python API, scaffolding, evaluation, deployment to Agent Runtime / Cloud Run / GKE, Gemini publishing, and Cloud Trace and Cloud Logging observability, next to the `google-agents-cli` PyPI package (`1.13.0`, Python >=3.11) whose `agents-cli` commands also work standalone. The skills install through the same `npx skills add google/agents-cli` CLI recorded as `skills-cli`, with plugin manifests for Claude Code and Gemini extensions. It stays reference-only because the delivered unit is a seven-skill bundle plus a generator CLI rather than one pinnable subtree or MCP launch command, and because deployment, publishing and hosted evaluation need the user's own Google Cloud project and credentials while only local `create`/`run`/`eval` works with an AI Studio API key; upstream also states that its usage telemetry logs a structured entry into the user's own Google Cloud project. Recorded as a discovery source: nothing was installed, no project was scaffolded and no agent was deployed. - **brooks-lint:** Six portable review modes — architecture audit, technical debt, health scoring, review, sweep, and test weakness — that report book-derived risk codes and a 0-100 score, packaged for fourteen coding agents. It is reference-only as a delivery boundary rather than a scope one: the documented installers (`npx brooks-lint install `, the shell installer, a plugin marketplace, or a manual `cp -r skills/*`) copy the six skill directories flat into the client's skills directory, and those skills load a shared `skills/_shared/` directory. This catalog's skill recipe pins exactly one subtree and requires a `SKILL.md` at that subtree's root, so pinning `skills/` is impossible and pinning a single mode would install a directory whose `../_shared/*.md` references dangle. Upstream states its automated checks verify file layouts and resources rather than runtime behaviour on every host. It overlaps `code-review-and-quality`, `open-code-review`, and `graphify` in intent and is recorded for the dependency-aware review shape, not as another generic reviewer; nothing was installed and no review mode was run here. - **Security tooling:** Semgrep, Bandit, pip-audit, OSV-Scanner, Gitleaks, and SkillSpector remain reference-only. Installing security skills/rules does not install or run scanners, configure CI, or establish an audit result. OSV-Scanner overlaps pip-audit for Python dependencies while also covering other ecosystems and containers, so a project needs one of them, not both by default. SkillSpector is the one entry here that scans the agent tooling instead of the project — a skill directory, an MCP server, a Git URL, an archive, or an MCP registry snapshot — with static pattern checks that run offline and LLM stages that need a provider key and network access. - **Rule scope:** Choose the language/framework in the project. FastAPI rules are separate from general Python rules. Embedded instruction blocks have a size guard; the full set of rule packs is larger than 32 KiB. diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index 59ef8fb..fd8376f 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -1,6 +1,6 @@ # Research and provenance -Research date: **2026-11-07**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 22 skill entries come from four upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. +Research date: **2026-11-08**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 22 skill entries come from four upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. ## Patterns adopted @@ -123,6 +123,18 @@ Rejected candidates in this pass were duplicative or out of scope: further datab Two entries were executed in this pass: the pinned `seleniumbase` and `dbhub` commands ran from a temporary project through the repository's smoke script, so no browser was launched, no page was visited, no database was queried, and no MCP tool was called. The two references were recorded from repository metadata, upstream documentation, package metadata, and license files only: nothing was installed, no configuration was audited, and no specification was created. +## Candidate review on 2026-11-08 + +A daily search pass over recently active coding-agent skills, MCP servers, and Python development tooling added four entries after de-duplication against the previous 95: one installable MCP server (`mustel-py/mustel`) and three reference-only entries (`stbenjam/skillsaw`, `wdm0006/python-skills`, `google/agents-cli`). + +`mustel` is the Python static-analysis orchestrator this catalog was missing next to `mcp-tools-py`: the same MCP surface for a checker, with a second lane. Ruff, Oxlint and local YAML patterns run locally with a stat-based (`mtime` + `size`) cache in dev mode, while `CI`, `GITHUB_ACTIONS` or `PRE_COMMIT` switches on Bandit and pip-audit for dependency vulnerabilities, and `get_code_map` returns a compressed AST/regex skeleton of classes, functions and docstrings instead of whole files. It publishes a pinnable PyPI release with the documented `mustel serve` stdio entry point, so it was executed through this repository's smoke script before admission; because published `0.3.4` imports `mcp.server.fastmcp` without capping `mcp` and the package requires Python 3.10 or newer on a host whose system Python is 3.9, the recipe pins both `--python 3.12` and `--with mcp<2`. Its `bootstrap` tool rewrites IDE and hook configuration machine-wide, which is exactly the part this catalog does not perform. + +`skillsaw` is the second entry whose subject is the agent's own files, next to `agnix`, and the reason both are recorded is the different delivery shape: agnix is a Rust LSP binary with per-client rule packs, while skillsaw is a Python linter on PyPI that runs from `uvx`, validates skills, plugin manifests, hooks, instruction files, MCP server maps and registry metadata across ecosystems, applies content and token-economy rules plus supply-chain checks, and offers deterministic autofixes, a baseline mode and a pre-commit hook. `wdm0006/python-skills` is a Claude Code plugin marketplace whose Python bundles are the most complete Python lifecycle set found in this pass (packaging, testing, API design, security audit, performance, release management, MCP servers, FastAPI/Postgres web apps, plus twenty shared skills), recorded as a reference because bundles share `skills/common/*` files rather than one pinnable subtree and the repository is scheduled to be renamed. `agents-cli` is Google's seven-skill ADK lifecycle bundle plus the `google-agents-cli` CLI; it is reference-only because the delivered unit is a skill bundle and a generator CLI rather than one subtree or launch command, and because deployment, publishing and hosted evaluation need the user's own Google Cloud project. + +Rejected candidates in this pass were duplicative, stale, or uninstallable: `00200200/usagetrim`, a test and build output compactor whose distribution is an `mcpb` bundle with no PyPI or npm package and whose channel the recorded `headroom` entry already covers; `fallow-rs/fallow-skills`, agent skills for the `fallow` server already recorded here; `Goldziher/poly`, a polyglot linter whose `polylint` package installs a prebuilt native binary and whose scope the `ruff` and `fallow` entries already cover; `semgrep/mcp`, archived upstream since 2025-10-28 while the Semgrep CLI is already a reference entry; and further skill collections, MCP gateways and code-context servers of the same shape as entries already recorded. + +One entry was executed in this pass: the pinned `mustel` command ran from a temporary project through the repository's smoke script, so no project was analysed, no code map was generated, no IDE or hook configuration was written, and no MCP tool was called. The three references were recorded from repository metadata, upstream documentation, package metadata and license files only: nothing was installed, no repository was linted, no skill bundle was activated, and no agent was scaffolded or deployed. + ## Installable upstream evidence | Item | Evidence checked | Result | @@ -146,6 +158,7 @@ Two entries were executed in this pass: the pinned `seleniumbase` and `dbhub` co | SeleniumBase MCP | [MCP server documentation](https://github.com/SeleniumBase/SeleniumBase/blob/master/mcp_servers/README.md), [CDP Mode documentation](https://github.com/SeleniumBase/SeleniumBase/blob/master/help_docs/cdp_mode_methods.md), [PyPI version metadata](https://pypi.org/project/seleniumbase/4.57.1/), [license](https://github.com/SeleniumBase/SeleniumBase/blob/master/LICENSE) | Published `4.57.1`; the `mcp` extra requires Python `>=3.10` and caps `mcp[cli]<3`, so the launcher pins `--python 3.13`. The server (`seleniumbase-mcp`) is part of the same distribution as the test framework, and upstream's `mcp_servers/` directory documents pure CDP Mode driving Chrome with no WebDriver and no chromedriver. `solve_captcha` interacts with several challenge types over CDP (Cloudflare Turnstile, reCAPTCHA, hCaptcha, DataDome Slider, FriendlyCaptcha) and upstream does not claim it always succeeds. | | DBHub MCP | [Repository README](https://github.com/bytebase/dbhub/blob/main/README.md), [installation guide](https://dbhub.ai/installation), [npm version metadata](https://registry.npmjs.org/@bytebase%2fdbhub/1.5.1), [license](https://github.com/bytebase/dbhub/blob/main/LICENSE) | Published `1.5.1`; Node.js `>=22.5.0` because the SQLite path uses the built-in `node:sqlite` module. Upstream documents `npx @bytebase/dbhub` with `--transport stdio`, `--dsn`, `--readonly`, `--max-rows`, `--query-timeout`, and `--demo` (a bundled sample SQLite database), plus a TOML configuration for several databases and a launch example in the Claude Code documentation. The README is the source for the supported engines: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, and SQLite. | | Reticle MCP | [Client configuration](https://github.com/reticlehq/reticle/blob/main/README.md), [installer](https://github.com/reticlehq/reticle/blob/main/install/install.sh), [framework guides](https://github.com/reticlehq/reticle/blob/main/docs/frameworks.mdx), [npm version metadata](https://registry.npmjs.org/@reticlehq%2fserver/3.9.0), [license](https://github.com/reticlehq/reticle/blob/main/LICENSE) | Published `3.9.0`; npm declares Node.js `>=20.11`, the `reticle` binary, and an optional Playwright peer. Upstream documents `npx @reticlehq/server@ mcp` for a client that already exists, and a one-line installer or `reticle setup mcp` for a machine-level setup that also appends instruction blocks and a prompt hook. Verdicts are computed locally; anonymous usage counts are on by default, and prompt upload requires linking the project. | +| Mustel MCP | [Repository README](https://github.com/mustel-py/mustel/blob/main/README.md), [package metadata](https://github.com/mustel-py/mustel/blob/main/pyproject.toml), [PyPI version metadata](https://pypi.org/project/mustel/0.3.4/), [license](https://github.com/mustel-py/mustel/blob/main/LICENSE) | Published `0.3.4`; `pyproject.toml` declares Python `>=3.10` and leaves `mcp` uncapped (`mcp>=1.0.0`), so the launcher pins `--python 3.12` and `--with mcp<2`. Upstream documents `mustel serve` as the stdio server and lists five MCP tools (`review`, `review_file`, `get_code_map`, `env`, `bootstrap`), which matches what the smoke check discovered. The README is the source for the dual dev/audit mode switch (`CI`, `GITHUB_ACTIONS`, `PRE_COMMIT`), the stat-based cache, the 1,500-token `get_code_map` claim, Jupyter `.ipynb` parsing, and the `bootstrap` behaviour that rewrites IDE configuration, `.cursorrules`/`.windsurfrules` and git pre-commit hooks - none of which this recipe performs. | The three skill/rule source archives were downloaded from `codeload.github.com` at full 40-character commits. Their SHA-256 values in the manifest were computed from the downloaded bytes. Serena instead uses an explicit Git source revision through uvx. Skill and original rule contents are upstream third-party material; catalog descriptions, selection notes, and disclosed rule adaptations are authored for this project. No upstream archive is vendored into this repository. @@ -262,6 +275,14 @@ On **2026-11-07**, the same script checked the two MCP servers added that day (P The `seleniumbase` launcher pins `--python 3.13` because its `mcp` extra requires Python 3.10 or newer while the system Python on this host is 3.9; the server reports no version string of its own. It discovered `start_browser`, `close_browser`, `get_page_info`, `open_url`, `manage_history`, `find_elements`, `get_content`, `get_attributes`, `check_if_condition`, `click_element`, `hover_action`, `type_text`, `select_option`, `focus_element`, `wait_for_condition`, `assert_condition`, `manage_cookies`, `manage_storage`, `scroll_page`, `manage_window`, `manage_tabs`, `solve_captcha`, `save_page`, and `run_javascript`. `dbhub` reports `DBHub MCP Server` `1.5.1` and exposed `execute_sql` and `search_objects`. No MCP tool was invoked: no browser was launched, no page was visited, no SQL ran, and no CAPTCHA was attempted. The pinned `seleniumbase` launcher was resolved and cached by `uvx` during this pass, so the recorded result includes that download. +On **2026-11-08**, the same script checked the MCP server added that day with the same command line, Python and SDK versions, and Node.js on the same host. It negotiated protocol **2025-11-25** as well. + +| Package pin | Reported server version | Tools discovered | Result | +| --- | --- | ---: | --- | +| `mustel==0.3.4` with `mcp<2` | `1.30.0` | 5 | Passed | + +The `mustel` launcher pins `--python 3.12` because the package requires Python >=3.10 while an unpinned `uvx` resolution on this host picks Python 3.9, and carries `--with mcp<2` for the same reason as `mcp-tools-py`: published `0.3.4` imports `mcp.server.fastmcp` without capping `mcp`. Its reported version is the FastMCP service version inside the package. No MCP tool was invoked, so no project was analysed, no code map was generated, no vulnerability lookup ran and no IDE or hook configuration was written. + Reproduce with `uv run --no-project --python 3.12 --with mcp==2.3.0 python scripts/smoke_mcp.py`. The optional script uses a 90-second timeout per server and a temporary npm cache. It forwards only network proxy/CA settings in addition to the SDK's default subprocess environment. Initial attempts on this host exposed missing proxy forwarding and SDK 2.x field-name changes in the smoke helper; the recorded results are from clean reruns after fixing both. ### Serena bridge smoke result diff --git a/src/awesome_python_dev/data/catalog.json b/src/awesome_python_dev/data/catalog.json index 3b9d3f6..56744a7 100644 --- a/src/awesome_python_dev/data/catalog.json +++ b/src/awesome_python_dev/data/catalog.json @@ -1,6 +1,6 @@ { "schema_version": 2, - "reviewed_at": "2026-11-07", + "reviewed_at": "2026-11-08", "tools": [ { "id": "systematic-debugging", @@ -2579,6 +2579,117 @@ "https://registry.npmjs.org/@mcpware%2fcross-code-organizer/0.19.3", "https://github.com/mcpware/cross-code-organizer/blob/main/LICENSE" ] + }, + { + "archived": false, + "category": "python-toolchain", + "checked_at": "2026-11-08", + "description": "Orchestrate Ruff, Bandit, Oxlint and pip-audit behind one stdio MCP server and return a compressed repository map instead of raw files.", + "evidence": [ + "https://api.github.com/repos/mustel-py/mustel", + "https://github.com/mustel-py/mustel/blob/main/README.md", + "https://github.com/mustel-py/mustel/blob/main/pyproject.toml", + "https://pypi.org/project/mustel/0.3.4/", + "https://github.com/mustel-py/mustel/blob/main/LICENSE" + ], + "homepage": "https://mustel.vercel.app/", + "id": "mustel", + "install": { + "type": "mcp", + "command": "uvx", + "args": [ + "--python", + "3.12", + "--with", + "mcp<2", + "--from", + "mustel==0.3.4", + "mustel", + "serve" + ], + "requirements": [ + "uvx" + ], + "version": "0.3.4", + "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); published 0.3.4 imports `mcp.server.fastmcp` without capping `mcp`, so the recipe adds `--with mcp<2`" + }, + "kind": "mcp", + "last_pushed_at": "2026-10-24T20:06:44Z", + "license": "MIT", + "name": "Mustel", + "notes": "Python static-analysis orchestrator exposed over stdio MCP; the five tools `review`, `review_file`, `get_code_map`, `env` and `bootstrap` were discovered in a fresh temporary project in this pass (`initialize` + `tools/list`, protocol 2025-11-25, the server reporting FastMCP `1.30.0`). It coordinates Ruff, Bandit, Oxlint, pip-audit and local YAML pattern files in parallel and switches profile by environment: dev mode (default) runs only local, non-networked checks with a stat-based (`mtime` + `size`) cache, while audit mode adds the deeper Bandit and pip-audit passes when `CI`, `GITHUB_ACTIONS` or `PRE_COMMIT` is set. Its difference from the other Python checker recipe here (`mcp-tools-py`: pylint, pytest, mypy, Ruff and symbol renames) is the dependency-vulnerability lane plus the compressed repository map: `get_code_map` returns an AST/regex skeleton of paths, classes, functions and docstrings that upstream describes as a 1,500-token budget, and `.ipynb` code cells are parsed natively so an agent reads structure instead of whole files. Ruff, Bandit, pip-audit, Semgrep and OSV-Scanner remain reference-only entries; this recipe is the wiring that puts two of those scanners behind MCP in one server, and upstream records a guardrail that injects compile/syntax failures into the agent's tool output on save. Caveats: the `bootstrap` tool and `mustel bootstrap` rewrite machine-level configuration (`~/.cursor/mcp.json`, `~/.claude.json`, Claude Desktop configs, project `.cursorrules`/`.windsurfrules` and git pre-commit hooks), so this catalog registers only the stdio server and never calls it; audit mode needs network access for vulnerability data; the pinned `0.3.4` matches the version in `main`'s `pyproject.toml`, but that PyPI release predates the repository's October commits. The smoke check started the launcher and listed the tools; no tool was called, no project was analysed, no code map was generated and no IDE or hook configuration was written.", + "repository": "mustel-py/mustel", + "stars": 19 + }, + { + "archived": false, + "category": "skill-ecosystem", + "checked_at": "2026-11-08", + "description": "Lint, autofix and baseline the skills, plugins, hooks and instruction files a coding agent loads across the major agent ecosystems.", + "evidence": [ + "https://api.github.com/repos/stbenjam/skillsaw", + "https://github.com/stbenjam/skillsaw/blob/main/README.md", + "https://skillsaw.org/rules/", + "https://pypi.org/project/skillsaw/0.23.0/", + "https://github.com/stbenjam/skillsaw/blob/main/LICENSE", + "https://github.com/stbenjam/skillsaw/blob/main/.pre-commit-hooks.yaml" + ], + "homepage": "https://skillsaw.org/", + "id": "skillsaw", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-07T23:40:46Z", + "license": "Apache-2.0", + "name": "Skillsaw", + "notes": "A linter for the files that steer a coding agent, recorded next to `agnix` with a different delivery shape: agnix is a Rust LSP binary with 758 per-client rules, skillsaw is a Python package on PyPI that runs as `uvx skillsaw tree` (report what it detects), `uvx skillsaw` (lint), `uvx skillsaw fix` (deterministic autofixes) and `uvx skillsaw baseline` (accept existing findings, fail only on new ones), with `.pre-commit-hooks.yaml` for a commit-time gate. It validates structure across ecosystems: Agent Skills (`SKILL.md`), Agent Plugins v1 (`plugin.json`, `mcp.json`), Claude Code and OpenAI Codex plugins and marketplaces, Cursor, Grok Build, Z.ai ZCode, Google Antigravity, GitHub Copilot / VS Code custom agents, OpenCode, Pi, native OpenClaw plugins, APM packages, MCP server maps and MCP Registry `server.json`, Vercel skills CLI lockfiles, `CLAUDE.md`/`AGENTS.md`/`GEMINI.md`/`QWEN.md`, hooks and eval formats. On top of schema and frontmatter checks it applies content and token-economy rules (instruction drift across duplicate files, instruction budget, section length, weak language, contradictions, repetitive inline tool-call examples), discovery integrity checks (unreferenced bundled files, broken internal references, inconsistent terminology, missing stop conditions, stale baselines) and supply-chain rules (dangerous `hooks.json` lifecycle hooks, `curl | sh` download-and-execute, `eval` obfuscation, strict MCP allowlists, invisible-unicode and prompt-injection payloads, embedded credentials). It stays reference-only because it is a CLI linter rather than one of the catalog's four install types; its own `npx skills add stbenjam/skillsaw` path installs only the `skillsaw-onboard` skill, which then drives the same `uvx` CLI. Adjacent to `cross-code-organizer` (harness inventory), `skillevaluator` (skill quality scoring) and `SkillSpector` (skill security scanning) rather than a duplicate of any of them. Nothing was installed and no repository was linted in this pass.", + "repository": "stbenjam/skillsaw", + "stars": 71 + }, + { + "archived": false, + "category": "python-skills", + "checked_at": "2026-11-08", + "description": "Checklist-driven Claude Code skills for the Python library lifecycle, with shared and other-language bundles from the same collection.", + "evidence": [ + "https://api.github.com/repos/wdm0006/python-skills", + "https://github.com/wdm0006/python-skills/blob/main/README.md", + "https://github.com/wdm0006/python-skills/blob/main/.claude-plugin/marketplace.json", + "https://github.com/wdm0006/python-skills/tree/main/skills/python", + "https://github.com/wdm0006/python-skills/blob/main/LICENSE" + ], + "homepage": "https://github.com/wdm0006/python-skills", + "id": "python-dev-skills", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-07T22:44:31Z", + "license": "MIT", + "name": "Python Dev Skills", + "notes": "A multi-language Claude Code skill collection whose Python half is the largest and most directly useful here: checklist-driven `SKILL.md` files for `api-design`, `cli-development`, `code-quality`, `documentation`, `lazy-dependencies`, `library-review`, `llm-features`, `mcp-servers`, `packaging`, `performance`, `project-setup`, `release-management`, `security-audit`, `testing-strategy`, `web-app-architecture` and `community`, plus twenty shared `skills/common/` skills (git hygiene, GitHub Actions, CI permissions, rendering untrusted content, destructive operations, UI design, defect reports and more) and smaller Go, Rust, Scala, Swift and browser-extension sets. Delivery is a Claude Code plugin marketplace: `/plugin marketplace add wdm0006/python-skills` then `/plugin install python-library-complete@dev-skills` or a narrower bundle (`python-library-foundations`, `python-library-quality`, `python-web-app`, `python-mcp-servers`, `swift-apps`, `browser-extensions`), whose exact membership is declared in `.claude-plugin/marketplace.json`; the collection grew out of a Python library-development guide and its README states a repository rename is planned now that it covers several languages. It is reference-only for two reasons: the delivered unit is a plugin bundle whose members share `skills/common/*` rather than one self-contained subtree this catalog can pin with a full commit and archive SHA-256, and the repository path the marketplace command depends on is scheduled to change, so a pin now would need re-verification on rename. It sits next to the ECC and `wshobson/agents` Python skills this catalog installs and to `awesome-copilot` as discovery sources for the same idea. Nothing was installed and no bundle was activated.", + "repository": "wdm0006/python-skills", + "stars": 111 + }, + { + "archived": false, + "category": "skill-ecosystem", + "checked_at": "2026-11-08", + "description": "Google's seven Agent Skills plus a CLI for building, evaluating, deploying, observing and publishing agents on Google ADK.", + "evidence": [ + "https://api.github.com/repos/google/agents-cli", + "https://github.com/google/agents-cli/blob/main/README.md", + "https://github.com/google/agents-cli/blob/main/skills/README.md", + "https://pypi.org/project/google-agents-cli/1.13.0/", + "https://github.com/google/agents-cli/blob/main/LICENSE" + ], + "homepage": "https://google.github.io/agents-cli/", + "id": "agents-cli", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-04T17:44:57Z", + "license": "Apache-2.0", + "name": "Agents CLI (Google ADK)", + "notes": "The first entry here whose subject is building the agent rather than tooling a Python or Web project: Agents CLI gives a coding agent seven Agent Skills that cover the ADK development lifecycle — `google-agents-cli-workflow` (lifecycle, code preservation, model selection), `google-agents-cli-adk-code` (ADK Python API: agents, tools, orchestration, callbacks, state, graph Workflow API), `google-agents-cli-scaffold`, `google-agents-cli-eval` (datasets, metrics, generate/grade, compare, analyze, optimize, LLM-as-judge), `google-agents-cli-deploy` (Agent Runtime on the Gemini enterprise platform, Cloud Run, GKE, CI/CD, secrets), `google-agents-cli-publish` (Gemini registration) and `google-agents-cli-observability` (Cloud Trace, Cloud Logging) — shipped in the same repository as a PyPI CLI (`uvx google-agents-cli setup`, package `google-agents-cli` `1.13.0`, Python >=3.11) whose commands stay usable standalone (`agents-cli create`, `scaffold enhance`, `eval`, `deploy`). The documented skill path is the same `npx skills add google/agents-cli` CLI this catalog records as `skills-cli`, with `.claude-plugin`, `plugin.json` and `gemini-extension.json` manifests for the plugin marketplaces. It is reference-only because the delivered unit is a seven-skill bundle plus a generator CLI rather than one pinnable subtree or MCP launch command, and because the parts that matter most (deployment, publishing, hosted evaluation) require the user's own Google Cloud project and credentials while only local `create`/`run`/`eval` works with an AI Studio API key. Upstream also states that its usage telemetry writes a structured log entry into the user's own Google Cloud project (command name, exit code, error class, duration). Recorded next to the other skill collections as a discovery source; nothing was installed, no project was scaffolded and no agent was deployed.", + "repository": "google/agents-cli", + "stars": 6315 } ], "profiles": {