m9rco · Nov 9, 2026 · Nov 9, 2026
diff --git a/docs/LSP.md b/docs/LSP.md
@@ -130,7 +130,7 @@ Select the intended scan scope and reviewed rule sets, pin dependencies in the p
 
 ## Verification recorded for this recipe
 
-On 2026-11-06, the `misata` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no dataset was generated, no certificate was re-verified, and no database was seeded. The `agnix`, `skillspector`, and `brooks-lint` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no lint run or `--fix`, no scan, no installer, and no editor or MCP session was started. On 2026-11-02, the `roam-code`, `orm-lens`, and `lsp-mcp-server` entries added that day were launched through their pinned commands from a temporary project and completed MCP `initialize` and `tools/list` with 17, 13, and 29 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no codebase was indexed, no Django or SQLAlchemy project was analysed, and no language server was driven. The `ai-rulez` entry added the same day stays a reference: its npm and PyPI packages are installers for a native binary, and the wrapper's own download did not finish in the smoke window, so no MCP session was started. On 2026-11-01, the `repomix` MCP entry added that day passed the same launch check with six tools discovered, while `pyrefly`, `osv-scanner`, and `deptry` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, scan, or MCP session was run for those three references. On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-30, the `fallow` MCP entry added that day passed the same launch check with 43 tools discovered, while `chunkhound` was recorded as a reference after its pinned command failed to complete `initialize` in a fresh project within the smoke window. On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`.
+On 2026-11-09, the `squirrelscan` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no site was audited, no report was written, and no account was used. The `pipelock`, `elephant-goldfish`, and `lspyx` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no proxy was started and no policy was loaded, no traffic was intercepted, no plugin, agent, or skill was activated, and no language-server startup or MCP session was run for `lspyx`. On 2026-11-06, the `misata` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no dataset was generated, no certificate was re-verified, and no database was seeded. The `agnix`, `skillspector`, and `brooks-lint` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no lint run or `--fix`, no scan, no installer, and no editor or MCP session was started. On 2026-11-02, the `roam-code`, `orm-lens`, and `lsp-mcp-server` entries added that day were launched through their pinned commands from a temporary project and completed MCP `initialize` and `tools/list` with 17, 13, and 29 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no codebase was indexed, no Django or SQLAlchemy project was analysed, and no language server was driven. The `ai-rulez` entry added the same day stays a reference: its npm and PyPI packages are installers for a native binary, and the wrapper's own download did not finish in the smoke window, so no MCP session was started. On 2026-11-01, the `repomix` MCP entry added that day passed the same launch check with six tools discovered, while `pyrefly`, `osv-scanner`, and `deptry` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, scan, or MCP session was run for those three references. On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-30, the `fallow` MCP entry added that day passed the same launch check with 43 tools discovered, while `chunkhound` was recorded as a reference after its pinned command failed to complete `initialize` in a fresh project within the smoke window. On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`.
 
 The check made no `tools/call` requests and ended before language-server initialization completed. It verifies the package launch and MCP discovery path, not symbol correctness, every programming language, every operating system, or integration inside all five agent applications.
 
@@ -140,4 +140,4 @@ The check made no `tools/call` requests and ended before language-server initial
 
 `apd list --kind lsp` 可查看 Serena、lsp-mcp-server 与独立语言服务。后者需按各自官方指南安装，再由编辑器或其他原生 LSP 客户端加载。OpenCode 原生 `lsp` 设置与 MCP 桥接是两条独立路径；本工具保留你的设置，不自动开启原生 LSP。
 
-已验证 Serena 的 MCP 握手和工具列表，尚未执行符号操作或逐一验证所有 agent 界面。项目移动后需核对生成配置中的绝对路径；Serena 自己创建的缓存和项目状态不由 `apd remove` 清理。lsp-mcp-server 不自带语言服务：需自行安装（Python 用 python-lsp-server 提供的 `pylsp`）并在项目内配置 `.lsp-mcp.json`，它只是把已有语言服务接到 agent。2026-11-02 新增的 roam-code、orm-lens、lsp-mcp-server 也通过了握手与工具列表检查（分别 17、13、29 个工具），但没有调用任何工具。2026-11-06 新增的 `misata`（Python 合成测试数据 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具；同期的 `agnix`（agent 配置 lint / LSP）、`skillspector`（技能与 MCP 安全扫描）、`brooks-lint`（六种代码审查模式）仅按仓库元数据、上游文档与许可证收录，未运行安装器、扫描或语言服务。
+已验证 Serena 的 MCP 握手和工具列表，尚未执行符号操作或逐一验证所有 agent 界面。项目移动后需核对生成配置中的绝对路径；Serena 自己创建的缓存和项目状态不由 `apd remove` 清理。lsp-mcp-server 不自带语言服务：需自行安装（Python 用 python-lsp-server 提供的 `pylsp`）并在项目内配置 `.lsp-mcp.json`，它只是把已有语言服务接到 agent。2026-11-02 新增的 roam-code、orm-lens、lsp-mcp-server 也通过了握手与工具列表检查（分别 17、13、29 个工具），但没有调用任何工具。2026-11-06 新增的 `misata`（Python 合成测试数据 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具；同期的 `agnix`（agent 配置 lint / LSP）、`skillspector`（技能与 MCP 安全扫描）、`brooks-lint`（六种代码审查模式）仅按仓库元数据、上游文档与许可证收录，未运行安装器、扫描或语言服务。 2026-11-09 新增的 `squirrelscan`（网站审计 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具、未审计任何站点；同期的 `pipelock`（出网与 MCP 策略网关）、`elephant-goldfish`（多 harness 设计评审插件）、`lspyx`（Python 专用 ty+Ruff 桥接）仅按仓库元数据、上游文档与许可证收录，未运行安装器、代理、插件或语言服务。