diff --git a/CHANGELOG.md b/CHANGELOG.md index ba70d48..fb17de5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -261,6 +261,20 @@ Catalogue additions from the 2026-11-10 candidate review. - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were updated in the same change. +Catalogue additions from the 2026-11-10 evening candidate review. + +- Four reference-only entries after de-duplication against the previous 107: + `trailofbits/skills`, the Trail of Bits Agent Skills marketplace (47 + plugins) recorded in `security`; `oceanbase/powercontext`, the server-side + memory, handoff and experience layer recorded in `mcp-ecosystem`; and two + standalone language servers, `DetachHead/basedpyright` and + `bellini666/pytest-language-server`, recorded next to `pyright`, `ty` and + `pyrefly`. +- The catalog now holds 111 entries: 48 installable resources (23 skills, 6 rule + packs, 17 MCP servers, and 2 LSP bridges) and 63 references. +- `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were + updated in the same change. + ## npm shell 0.1.1 — 2026-10-28 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads, diff --git a/README.md b/README.md index 9890f22..1a6f5dc 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**. -The repository catalog includes **107 entries**: **48 installable resources** (23 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **59 references** (agent-lsp, mcpls, lspyx, 11 native language servers, and 45 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. +The repository catalog includes **111 entries**: **48 installable resources** (23 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **63 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 47 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. ## Contents diff --git a/README.zh-CN.md b/README.zh-CN.md index 5847aa5..ee46013 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -17,7 +17,7 @@ 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。 -仓库目录收录 **107 个条目**：**48 个可安装资源**（23 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **59 个参考条目**（agent-lsp、mcpls、lspyx、11 个原生语言服务、45 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 +仓库目录收录 **111 个条目**：**48 个可安装资源**（23 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **63 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、47 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 ## 目录 diff --git a/docs/CATALOG.md b/docs/CATALOG.md index 0b86b72..4c47ad1 100644 --- a/docs/CATALOG.md +++ b/docs/CATALOG.md @@ -1,6 +1,6 @@ # Curated catalog / 精选目录 -Reviewed **2026-11-10**, catalog schema **2**. **107 entries**, with **48 installable/configurable integrations** and **59 reference-only tools**. The installable set contains 23 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 16 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 11 standalone language-server references. +Reviewed **2026-11-10**, catalog schema **2**. **111 entries**, with **48 installable/configurable integrations** and **63 reference-only tools**. The installable set contains 23 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references. Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status. @@ -84,6 +84,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`gitleaks`](https://github.com/gitleaks/gitleaks) | Detect committed or working-tree secrets using configurable rules and allowlists. | Reference only | 30,384 | MIT | | [`skillspector`](https://github.com/NVIDIA/SkillSpector) | Scan a skill directory, MCP server, Git URL, archive, or MCP registry snapshot for prompt injection, exfiltration, credential access, obfuscation, and supply-chain risk before installing it. | Reference only | 24,520 | Apache-2.0 | | [`pipelock`](https://github.com/pipelab-org/pipelock) | Mediate an agent's egress and MCP traffic against a policy file, scanning requests and responses and signing a receipt for every decision. | Reference only | 987 | Apache-2.0 | +| [`trailofbits-skills`](https://github.com/trailofbits/skills) | Trail of Bits plugin marketplace of 47 Agent Skills for security review — audit context building, differential and variant analysis, Semgrep rule authoring, patch validation, supply-chain auditing — plus development workflows including `modern-python`, property-based testing and static analysis. | Reference only | 8,109 | CC-BY-SA-4.0 | ## Portable agent rules @@ -124,6 +125,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`ripwire`](https://github.com/redhat-et/ripwire) | Ranked, deterministic call graph that maps a repository before an agent reads it and checks an edit's blast radius, reachable tests, and quality regressions. | Reference only | 2,513 | Apache-2.0 | | [`codeboarding`](https://github.com/CodeBoarding/CodeBoarding) | Render a codebase as interactive architecture maps plus Markdown, HTML, MDX or reStructuredText documentation for review and a coding agent's next prompt. | Reference only | 2,663 | MIT | | [`mcp-context-forge`](https://github.com/IBM/mcp-context-forge) | Federate MCP, A2A and REST/gRPC servers behind one governed endpoint with a registry, virtual servers, auth, rate limiting, and an admin UI. | Reference only | 4,752 | Apache-2.0 | +| [`powercontext`](https://github.com/oceanbase/powercontext) | Server-side memory, handoff and experience layer for coding agents, exposed as an HTTP contract with a Python client, CLI, dashboard and a curated MCP projection over revisioned artifacts. | Reference only | 1,575 | Apache-2.0 | ## Language intelligence and LSP @@ -145,6 +147,8 @@ Profiles select relevant tools instead of loading every available rule and frame | [`clangd`](https://clangd.llvm.org/) | C/C++ language server with completion, cross-references, diagnostics, and refactoring support. | Reference only | 2,315 | Apache-2.0 WITH LLVM-exception | | [`tombi`](https://github.com/tombi-toml/tombi) | Schema-driven TOML formatter, linter, and language server for project configuration such as `pyproject.toml`. | Reference only | 1,192 | MIT | | [`agnix`](https://github.com/agent-sh/agnix) | Lint and auto-fix agent configuration — `CLAUDE.md`, `AGENTS.md`, `SKILL.md`, hooks, plugin and MCP files — with 758 per-client rules, shipped as a CLI with an `agnix-lsp` language server and an `agnix-mcp` server. | Reference only | 471 | MIT OR Apache-2.0 | +| [`basedpyright`](https://docs.basedpyright.com) | Pyright fork with Pylance features, configurable checking modes, a baseline file and an `--outputjson` report, shipping the `basedpyright-langserver` server. | Reference only | 3,647 | MIT | +| [`pytest-language-server`](https://github.com/bellini666/pytest-language-server) | Rust language server for pytest: fixture definitions across `conftest.py` and plugins, `yield` navigation, fixture call hierarchy, completion, references and diagnostics. | Reference only | 124 | MIT | ## Specification-driven development @@ -231,7 +235,7 @@ Skill and rule archives are pinned to full commits and verified against a record - **Fetch:** Requires uv/uvx and a compatible Python. No private-IP bypass is enabled by this recipe. - **Serena:** The project path is resolved into the MCP configuration. First startup may download language-server dependencies and create Serena-owned state. The installer does not manage or uninstall those upstream caches. See [language intelligence and setup](LSP.md). - **lsp-mcp-server:** The second installable bridge and the only TypeScript one here: it drives whichever language server a project configures, so Python coverage depends on pyright, Python LSP Server, or another LSP binary installed separately. It pins npm release `1.1.27` (upstream tag `v1.1.27`, commit `2b9005387fbf5ebd101ec84cfc34a8196bf9d347`), reads per-project server settings from `.lsp-mcp.json`, and upstream recommends a longer client tool timeout because the first call starts a language server and its initial analysis. The npm package also ships a `SKILL.md` that teaches tool selection and says it should be re-copied when the server version changes; only the MCP launch configuration is written here. The smoke check completed `initialize` and listed 29 tools, but no language server was started through it and no project file was read by a tool call, so the LSP round trip itself is unverified. -- **Native language servers:** Pyright, Pyrefly, Python LSP Server, Ruff, ty, TypeScript Language Server, gopls, rust-analyzer, clangd, and Tombi remain reference-only. Their native LSP commands need an LSP client; they are not interchangeable with MCP servers. +- **Native language servers:** Pyright, basedpyright, Pyrefly, Python LSP Server, Ruff, ty, pytest-language-server, TypeScript Language Server, gopls, rust-analyzer, clangd, and Tombi remain reference-only. Their native LSP commands need an LSP client; they are not interchangeable with MCP servers. - **agent-lsp:** One of the two reference-only LSP bridges next to the installable Serena and lsp-mcp-server recipes. It ships as a Go binary from an upstream install script, release archive, or container image, and requires the underlying language servers separately; there is no registry package or dependency version for this catalog to pin, so `apd` writes only the Serena and lsp-mcp-server recipes. - **mcpls:** The other reference-only bridge. It is distributed as a Rust binary through `cargo install mcpls`, an upstream install script, release archives, or a container image, and needs at least one language server (for example pyright) installed separately. Enabling it next to Serena or lsp-mcp-server would give the same project two bridges over the same servers. - **code-review-graph:** The project path is resolved into the MCP configuration and the server indexes it with Tree-sitter; graph data stays in a `.code-review-graph` directory inside the project. Building or refreshing the graph is an explicit CLI or tool step, and upstream `install` also writes hooks, skills, and rules files that this recipe does not touch. diff --git a/docs/LSP.md b/docs/LSP.md index 8f91658..6557eff 100644 --- a/docs/LSP.md +++ b/docs/LSP.md @@ -67,6 +67,8 @@ These catalog entries are references (`install: null`). An LSP client must start | [clangd](https://github.com/clangd/clangd) | C/C++ navigation, completion, diagnostics | `clangd` | [Install and describe the build](https://clangd.llvm.org/installation) | | [Tombi](https://github.com/tombi-toml/tombi) | TOML formatting, linting, and schema-aware diagnostics for `pyproject.toml` and other project configuration | `tombi lsp` | [Installation](https://tombi-toml.github.io/tombi/docs/installation) | | [agnix](https://github.com/agent-sh/agnix) | Linting, validation, and optional auto-fix for agent configuration — `CLAUDE.md`, `AGENTS.md`, `SKILL.md`, hooks, plugin and MCP files — across Claude Code, Codex CLI, Cursor, Copilot, and OpenCode | `agnix-lsp` | [Documentation](https://agent-sh.github.io/agnix/) | +| [basedpyright](https://docs.basedpyright.com) | Python types, navigation, diagnostics, inlay hints, semantic highlighting, and import organization from a maintained Pyright fork with `recommended`/`all` checking modes and a baseline file | `basedpyright-langserver --stdio` | [Command line and language server](https://github.com/DetachHead/basedpyright/blob/main/docs/installation/command-line-and-language-server.md) | +| [pytest-language-server](https://github.com/bellini666/pytest-language-server) | pytest fixture navigation across `conftest.py` and plugin fixtures, `yield` and teardown jumps, fixture call hierarchy, completion, references, rename, and diagnostics for test code | `pytest-language-server` | [Installation](https://github.com/bellini666/pytest-language-server#installation) | For example, upstream documents `python -m pip install python-lsp-server` inside the environment you want to use, followed by configuring `pylsp` in your editor. Rust's toolchain method is `rustup component add rust-analyzer`, followed by client configuration. Choose versions and environment scope appropriate to your project; these commands are not run by `apd`. @@ -76,6 +78,10 @@ Pyrefly is a third Rust-based Python type checker with an editor-facing server, Tombi is the one server in this table that targets configuration rather than source code: Python projects describe themselves in TOML (`pyproject.toml`, uv, Ruff, and pytest settings), and Tombi formats, lints, and validates those files against schemas from the JSON Schema Store. It is a single Rust binary distributed through the curl installer, Homebrew, winget, `uvx`/`uv tool install`, npm, and the VS Code, Open VSX, Zed, JetBrains, Helix, Neovim, and Emacs integrations, so which command a client needs depends on that client; Neovim's own configuration registers `tombi lsp` for `toml` files and roots the workspace at `pyproject.toml`. Pair it with a navigation/type server rather than instead of one. agnix is the second configuration-facing server recorded here and, like Tombi, it is a single binary rather than an MCP service; unlike Tombi it validates the agent's own files instead of the project's. Its 758 rules cover `CLAUDE.md`, `AGENTS.md`, `SKILL.md`, `.claude/rules/*.md`, hooks, plugin manifests, and MCP configuration, with several hundred rules scoped per client (Claude Code 170, Codex CLI 89, Cursor 40), and the CLI's `--fix`, `--fix-safe`, and `--fix-unsafe` modes apply the findings. It ships the `agnix` CLI, an `agnix-lsp` language server, and an optional `agnix-mcp` server, and reaches clients through npm, Homebrew, PyPI, cargo, a GitHub Action, and the VS Code, JetBrains, Neovim, and Zed integrations, so which command a client needs depends on that client. Nothing here runs it: no lint pass, no fix, and no language-server session was performed for this entry. +basedpyright is a maintained fork of Pyright, so it is recorded as a third Python type checker next to Pyright, ty and Pyrefly rather than as a replacement for any of them. Upstream's reason for the fork is the feature set Pyright does not open-source: Pylance-style inlay hints, semantic highlighting and import organization, the `recommended` and `all` checking modes, and a baseline file that lets a project adopt stricter checking incrementally instead of fixing every existing error before it can be enabled. It is distributed as the PyPI package `basedpyright`, a Homebrew formula, and VS Code, Open VSX and Sublime Text integrations, and it pairs with a formatter/linter such as Ruff. The launch command above is the one the project's own Zed configuration uses. Its `LICENSE.txt` carries the MIT text inherited from Pyright while the GitHub API reports `NOASSERTION` for the modified header. Nothing here installs or starts it. + +pytest-language-server is the one server in this table that targets tests instead of source: it resolves fixture definitions in the same file, in `conftest.py` and in plugin-provided fixtures while respecting pytest's shadowing rules, jumps to the `yield` that produces a generator fixture, exposes fixture call hierarchy in both directions, completes fixture names inside test and fixture functions, and reports diagnostics for scope and circular-dependency problems. It is a Rust binary launched as `pytest-language-server`, distributed through PyPI (`uv tool install`, `pip`, `pipx`), a Homebrew tap, crates.io, release binaries and a source build, with root markers `pytest.ini`, `pyproject.toml`, `setup.py`, `setup.cfg` and `.git`. It is young and single-maintainer (first release November 2025, 124 stars) and its README states it was built with AI coding agents and reviewed afterwards, so it belongs next to a navigation and type server rather than in place of one. Nothing here installs or starts it either. + ## Another installable bridge: lsp-mcp-server [`lsp-mcp-server`](https://github.com/ProfessioneIT/lsp-mcp-server) is the second bridge the catalog can write. `apd init --agents codex --tools lsp-mcp-server` configures the npm release `lsp-mcp-server@1.1.27` (tag `v1.1.27`, commit `2b9005387fbf5ebd101ec84cfc34a8196bf9d347`) with `npx`: @@ -134,6 +140,8 @@ On 2026-11-10, no MCP or language-server entry was added or changed: the `planni The check made no `tools/call` requests and ended before language-server initialization completed. It verifies the package launch and MCP discovery path, not symbol correctness, every programming language, every operating system, or integration inside all five agent applications. +On **2026-11-10**, a second pass on the same date added the two language-server references in the table above, `basedpyright` and `pytest-language-server`, plus two reference-only entries in the catalog (`trailofbits/skills` in `security`, `oceanbase/powercontext` in `mcp-ecosystem`). Their rows come from repository metadata, upstream documentation, package metadata and license files; no binary was installed, no language-server session was started, no hook or plugin was activated, and no MCP server was launched. The recorded launch commands were not executed, so this pass adds no protocol evidence. + ## 中文速览 `apd init --agents codex --profile lsp` 会配置 Serena，通过 MCP 将 LSP 的符号导航、引用和诊断能力提供给 agent。配置固定上游版本，使用 Python 3.13；首次启动可能下载解释器或语言服务依赖。安装器不替你配置编辑器原生 LSP，也不自动运行安全扫描。 @@ -141,3 +149,5 @@ The check made no `tools/call` requests and ended before language-server initial `apd list --kind lsp` 可查看 Serena、lsp-mcp-server 与独立语言服务。后者需按各自官方指南安装，再由编辑器或其他原生 LSP 客户端加载。OpenCode 原生 `lsp` 设置与 MCP 桥接是两条独立路径；本工具保留你的设置，不自动开启原生 LSP。 已验证 Serena 的 MCP 握手和工具列表，尚未执行符号操作或逐一验证所有 agent 界面。项目移动后需核对生成配置中的绝对路径；Serena 自己创建的缓存和项目状态不由 `apd remove` 清理。lsp-mcp-server 不自带语言服务：需自行安装（Python 用 python-lsp-server 提供的 `pylsp`）并在项目内配置 `.lsp-mcp.json`，它只是把已有语言服务接到 agent。2026-11-02 新增的 roam-code、orm-lens、lsp-mcp-server 也通过了握手与工具列表检查（分别 17、13、29 个工具），但没有调用任何工具。2026-11-06 新增的 `misata`（Python 合成测试数据 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具；同期的 `agnix`（agent 配置 lint / LSP）、`skillspector`（技能与 MCP 安全扫描）、`brooks-lint`（六种代码审查模式）仅按仓库元数据、上游文档与许可证收录，未运行安装器、扫描或语言服务。 2026-11-09 新增的 `squirrelscan`（网站审计 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具、未审计任何站点；同期的 `pipelock`（出网与 MCP 策略网关）、`elephant-goldfish`（多 harness 设计评审插件）、`lspyx`（Python 专用 ty+Ruff 桥接）仅按仓库元数据、上游文档与许可证收录，未运行安装器、代理、插件或语言服务。 2026-11-10 新增的 `planning-with-files`（把计划、进度与发现写进 `.planning/` 文件的 skill）只下载并校验了固定归档的 SHA-256，未安装、未启动 agent 会话；同期的 `ui-ux-pro-max`（本地设计数据 skill，经生成器 CLI 交付）、`agent-skills-spec`（Agent Skills 规范与 `skills-ref` 校验器）、`arcade-mcp`（Python MCP 框架）仅按仓库元数据、上游文档与许可证收录，未生成客户端文件、未运行校验、未启动 MCP 会话。 + +2026-11-10 晚间追加的两个独立语言服务参考（`basedpyright`、`pytest-language-server`）仅按仓库元数据、上游文档、包元数据与许可证收录：未安装、未启动语言服务、未开启编辑器会话；同批的 `trailofbits-skills`（CC-BY-SA-4.0 插件市场）与 `powercontext`（需自建服务并信任 hooks 的记忆层）同样未安装或运行。 diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index a6aa62e..78b1aed 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -166,6 +166,20 @@ Rejected candidates in this pass were unpublished, unlicensed, or below the adop No entry was executed in this pass. The one installable addition was verified by downloading and hashing its pinned archive, and the three references were recorded from repository metadata, upstream documentation, package metadata and license files only: nothing was installed, no skill was validated, no client files were generated, and no MCP server was started. +## Candidate review on 2026-11-10 (evening pass) + +A second pass on the same date, run after the third daily review had already been merged, added four reference-only entries after de-duplication against the previous 107: two cross-cutting references (`trailofbits/skills` and `oceanbase/powercontext`) and two standalone language servers (`DetachHead/basedpyright` and `bellini666/pytest-language-server`). No installable recipe was added, so this pass needed no package smoke check and none was run. + +`trailofbits-skills` is the most complete security-workflow skill collection found here, from an upstream that publishes security research and audits: 47 plugins in `.claude-plugin/marketplace.json`, covering audit-context-building, differential-review, variant-analysis, patching-bugs, post-patch-validation, semgrep-rule-creator and semgrep-rule-variant-creator, cvss-scoring, sharp-edges, insecure-defaults and supply-chain-risk-auditor, plus adjacent domains this catalog does not cover (smart contracts, malware/YARA, proofs) and a development group that does serve Python and Web work (`modern-python`, `code-improver`, `review-walkthrough`, `second-opinion`, `regression-hunt`, `property-based-testing`, `mutation-testing`, `static-analysis`, `gh-cli`, `devcontainer-setup`). It does not duplicate `security-review`, `open-code-review`, or the scanner references: this is the workflow layer that decides what to audit, how to reproduce a finding and how to verify a patch, and upstream keeps a public trophy case of bugs found with it. It stays reference-only because upstream delivers it as a plugin marketplace (`/plugin marketplace add trailofbits/skills`) and as per-plugin skill directories whose scripts and references differ, so there is no single subtree this catalog can pin and verify - the same reason recorded for `anthropics/skills` and `vercel-labs/agent-skills`. Its content is CC-BY-SA-4.0 with a share-alike term rather than a plain permissive license, which is a second reason not to copy text into this repository. + +`basedpyright` and `pytest-language-server` extend the standalone language-server group in different directions. `basedpyright` is a maintained fork of Pyright, recorded as a third Python type checker next to `pyright`, `ty` and `pyrefly` because it ships the parts upstream Pyright does not open-source: Pylance-style inlay hints, semantic highlighting and import organization, the `recommended` and `all` checking modes, a baseline file that lets a project adopt strict typing incrementally, and an `--outputjson` CLI report; it launches as `basedpyright-langserver --stdio` (the command in the project's own Zed configuration), is published on PyPI as `basedpyright` 1.40.2 (Python >=3.10, bundling a Node.js runtime) with Homebrew and editor integrations, and its `LICENSE.txt` carries the MIT text inherited from Pyright while the GitHub API reports `NOASSERTION` for the modified header. `pytest-language-server` is the one server here whose subject is tests: fixture definitions across `conftest.py` and plugin fixtures with pytest's shadowing rules, `yield` and teardown navigation, incoming and outgoing fixture call hierarchy, hierarchy-aware completion, references, rename and diagnostics, launched as `pytest-language-server` and distributed through PyPI 0.26.0, a Homebrew tap, crates.io and release binaries. It is young and single-maintainer (first release November 2025, 124 stars) and states in its README that it was built with AI coding agents and reviewed afterwards, so it is recorded as a companion to a navigation and type server rather than a replacement. + +`powercontext` joins the memory lane that already holds `hippo-memory` and `codebase-memory-mcp` with a server-shaped delivery: memory, handoff, experience and skill are server-side artifacts behind an HTTP contract, and the Python client, CLI, dashboard, in-process Core SDK and MCP endpoint are views over that one server. Install is `uv tool install --force "powercontext[cli,server]==1.5.1"` (PyPI 1.5.1, Apache-2.0) followed by creating Scopes and binding the returned `scope_id`, and automatic capture needs the client-side integration enabled - in Codex that includes trusting the hooks, where the `UserPromptSubmit` hook is what makes prompt capture and recall run. Because every useful path is a long-running server plus per-host configuration and plugins rather than one launch entry, no install type in this catalog fits and nothing was executed. + +Rejected candidates in this pass were duplicative, archived, or unverifiable: `HoangNguyen0403/agent-skills-standard` (584 stars, MIT, pushed the same day), a cross-agent instruction and skill distribution CLI with an npm MCP companion in the same lane as the recorded `ruler` and `ai-rulez`; `e2b-dev/mcp-server` (archived, last push 2026-04-16) and `pydantic/mcp-run-python` (archived, last push 2026-01-30); `tox-dev/pyproject-fmt` (223 stars, MIT), which is a mirror repository for pre-commit whose real source is the `tox-dev/toml-fmt` monorepo and whose TOML lane the recorded `tombi` already serves; `getsentry/toolkit`, re-checked and rejected again for the reason recorded on 2026-11-06 (source-available toolkit whose hosted service needs an account); `Innei/ryugi` (399 stars) with no detectable license; and aggregator-only skill lists with no single revision or artifact to pin - `sickn33/antigravity-awesome-skills` (49,475 stars), `VoltAgent/awesome-agent-skills` (37,039 stars), `devohmycode/Skills-Atlas` (41 stars) and `travisvn/awesome-claude-skills` (15,762 stars, no license detected, last pushed 2026-04-28). + +No entry was executed in this pass. All four were recorded from repository metadata, upstream documentation, package metadata and license files: nothing was installed, no language-server or MCP session was started, no plugin was activated, no hook was trusted, and no server or scope was created. + ## Installable upstream evidence | Item | Evidence checked | Result | @@ -202,7 +216,7 @@ The five skill/rule source archives were downloaded from `codeload.github.com` a - [Sequential Thinking](https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking) currently publishes `2.0.0` with Node.js `>=24`, verified through [npm metadata](https://registry.npmjs.org/@modelcontextprotocol%2fserver-sequential-thinking/2.0.0). It is not part of the starter runtime. - [Anthropic Skills](https://github.com/anthropics/skills) and [Vercel Agent Skills](https://github.com/vercel-labs/agent-skills) are collections whose individual skills have different capabilities and license considerations. They are discovery sources, not bulk-install defaults. - [uv](https://github.com/astral-sh/uv), [pytest](https://github.com/pytest-dev/pytest), [hypothesis](https://github.com/HypothesisWorks/hypothesis), [deptry](https://github.com/osprey-oss/deptry), and [pre-commit](https://github.com/pre-commit/pre-commit) belong in a project's development toolchain. They are not ready-to-register MCP servers. `deptry` in particular has to run inside the project environment to compare declared dependencies with actual imports. -- The ten native LSP references — [Pyright](https://github.com/microsoft/pyright), [Pyrefly](https://github.com/meta/pyrefly), [Python LSP Server](https://github.com/python-lsp/python-lsp-server), [Ruff](https://docs.astral.sh/ruff/editors/), [ty](https://docs.astral.sh/ty/), [TypeScript Language Server](https://github.com/typescript-language-server/typescript-language-server), [gopls](https://go.dev/gopls/), [rust-analyzer](https://rust-analyzer.github.io/), [clangd](https://clangd.llvm.org/), and [Tombi](https://github.com/tombi-toml/tombi) — require compatible toolchains and an LSP client. Their raw launch commands do not speak MCP. Ruff also remains useful as a Python lint/format CLI, and `pyright`, `pyrefly`, and `ty` are mutually overlapping Python type checkers, so a project picks one. +- The twelve native LSP references — [Pyright](https://github.com/microsoft/pyright), [basedpyright](https://docs.basedpyright.com), [Pyrefly](https://github.com/meta/pyrefly), [Python LSP Server](https://github.com/python-lsp/python-lsp-server), [Ruff](https://docs.astral.sh/ruff/editors/), [ty](https://docs.astral.sh/ty/), [pytest-language-server](https://github.com/bellini666/pytest-language-server), [TypeScript Language Server](https://github.com/typescript-language-server/typescript-language-server), [gopls](https://go.dev/gopls/), [rust-analyzer](https://rust-analyzer.github.io/), [clangd](https://clangd.llvm.org/), and [Tombi](https://github.com/tombi-toml/tombi) — require compatible toolchains and an LSP client. Their raw launch commands do not speak MCP. Ruff also remains useful as a Python lint/format CLI, and `pyright`, `pyrefly`, and `ty` are mutually overlapping Python type checkers, so a project picks one. - [Tombi](https://github.com/tombi-toml/tombi) is the only configuration-file server in that list: a schema-driven TOML formatter, linter, and language server for `pyproject.toml`, uv, Ruff, and pytest settings. It speaks LSP, not MCP, and one Rust binary is distributed through the curl installer, Homebrew, winget, `uvx`/`uv tool install`, npm, and the VS Code, Open VSX, Zed, JetBrains, Helix, Neovim, and Emacs integrations, so the launch command depends on the client a project already has. Completion and validation come from the JSON Schema Store; nvim-lspconfig registers it for `toml` files and roots it at `pyproject.toml`. Nothing was installed and no editor session was run for this entry. - [agent-lsp](https://github.com/blackwell-systems/agent-lsp) does speak MCP, but it is distributed as a Go binary built by its own install script or release archive. There is no registry version or dependency revision to pin here, and it needs the individual language servers installed separately, so it stays a reference next to Serena rather than a configured bridge. - [chunkhound](https://github.com/chunkhound/chunkhound) is published on PyPI and documents a stdio MCP launch, but its server did not answer `initialize` in a fresh project within the smoke window on this host: uvx first resolved Python 3.10, whose scipy build does not load on arm64 macOS, and after pinning Python 3.12 it stalled on an outbound HTTPS request during startup. Indexing is also an explicit separate step, the database is created inside the project, and semantic search or deep research needs an embedding or LLM provider. It stays a reference until the launch check passes. @@ -227,6 +241,9 @@ The five skill/rule source archives were downloaded from `codeload.github.com` a - [Elephant Goldfish Model](https://github.com/google/elephant-goldfish-model) is a plugin rather than one skill: ten reviewer prompts in `agents/` (`bootstrap_orchestrator`, `comprehension`, `structural`, `style`, `design_critic`, `implementation_readiness`, `inventive_catalyst`, `synthesizer`, `zoom_out`, `codebase_details`) support the shipped `egm-*` skills, and upstream states the constraint directly: "Install the complete plugin so its skills can read the reviewer prompts and document standards." Because those skills read repository-level prompts and standards, a pinned skill subtree would be incomplete, so it is recorded for its adversarial design-review loop rather than as an installable recipe. Setup is per harness (`claude plugin marketplace add google/elephant-goldfish-model` then `claude plugin install egm@egm`, plus documented Codex, Cursor, Copilot and OpenCode routes in `docs/`) and the desktop listings are distribution channels this catalog does not model. Nothing was installed and no plugin, agent or skill was activated. - [Cross-Code Organizer](https://github.com/mcpware/cross-code-organizer) is a local dashboard over the harness inventory itself: it reports what Claude Code, Codex, OpenCode and DSH will actually load per project (the effective set, not only the files on disk), accounts for context budget, edits Memory/`CLAUDE.md`/`SKILL.md` markdown in place, repairs duplicates reversibly, copies skills between harnesses, and scans MCP tool descriptions for poisoning with findings that link back to the server entry. It stays reference-only because it is an interactive local application (`npx @mcpware/cross-code-organizer`, Node.js 20+, an HTTP server bound to `127.0.0.1:3847`) rather than a skill, rule pack, MCP server, or LSP bridge, and because its npm `latest` tag still points at `0.19.3` while its README documents `0.20.0` — the version skew to re-check before trusting an audit result. It reads `~/.claude/`, `$CODEX_HOME`, `~/.config/opencode/`, `$DSH_HOME`, and discovered project directories, uploads no configuration or content, and sends only an opt-in monthly activity signal (UTC month, a rotating pseudonymous ID, its version, and a harness ID). It is adjacent to `mcp-inspector` (protocol debugging) and `mcp-context-forge` (gateway and registry) rather than a duplicate of either. Nothing was installed or launched. +- [Trail of Bits Skills](https://github.com/trailofbits/skills) is a plugin marketplace of 47 Agent Skills for security and development workflows, not one installable unit: upstream's delivery is `/plugin marketplace add trailofbits/skills` plus per-plugin directories whose scripts and references differ, and its content is CC-BY-SA-4.0 rather than a plain permissive license, so nothing is copied here. It sits next to the `security-review` skill and the scanner references as the workflow layer around them. +- [PowerContext](https://github.com/oceanbase/powercontext) publishes an installable server (`uv tool install "powercontext[cli,server]==1.5.1"`, Apache-2.0) rather than a stdio MCP launch: memory, handoff and experience live behind an HTTP contract, the MCP endpoint is a curated projection over that server, and automatic capture needs per-host hooks and plugins trusted in the client (Codex `/hooks`, `UserPromptSubmit`). Running it means owning a server, a `scope_id` binding and client configuration, so it stays a reference next to `hippo-memory` and `codebase-memory-mcp`. + ## Verification boundaries This research verifies source identity, published package availability, manifest pins, selected skill/rule directory completeness, declared setup requirements, and the protocol checks below. Native rule generation is covered by this project's adapter tests; that does not imply every upstream guidance example was executed. It does not establish a security audit, benchmark ranking, or compatibility with every version of every agent. Installer tests and release CI cover this repository's configuration behavior; users still need the selected agent, required runtimes, network access, and any upstream service credentials. diff --git a/src/awesome_python_dev/data/catalog.json b/src/awesome_python_dev/data/catalog.json index 1535d82..dd9fab4 100644 --- a/src/awesome_python_dev/data/catalog.json +++ b/src/awesome_python_dev/data/catalog.json @@ -2915,6 +2915,100 @@ "notes": "Third entry in the `build-mcp` lane next to `fastmcp` and the official `mcp-python-sdk`, and the most widely deployed of the three (the README attributes 7,500+ prebuilt tools across 81 hosted MCP servers to it): a decorator API covering tools, resources, prompts, sampling, elicitation, progress and logging, `requires_auth=` declarations that let the framework own OAuth and token refresh, a vendor-neutral client story, and the `arcade-mcp` CLI for scaffolding, running and deploying servers. It is reference-only for the same reason as `fastmcp`: it is a Python library (`pyproject.toml`, monorepo `libs/arcade-core`, `libs/arcade-mcp-server`, `libs/arcade-cli`, `libs/arcade-evals`, `libs/arcade-serve`, `examples/mcp_servers/`) installed as a dependency inside a server project, not an agent-side MCP server this installer can configure by launching a command, so there is no pinned recipe; `pip install arcade-mcp` resolves PyPI 1.17.6 (Python >=3.10) and the server package publishes separately as `arcade-mcp-server` 1.33.0. MIT license. Evidence read in this pass: repository metadata, README (framework highlights and install sections), the `libs/` and `examples/` trees, and the PyPI metadata for both packages. Nothing was installed and no server was started.", "repository": "ArcadeAI/arcade-mcp", "stars": 1088 + }, + { + "archived": false, + "category": "language-servers", + "checked_at": "2026-11-10", + "description": "Fork of Pyright that adds Pylance features, configurable checking modes, a baseline file and an `--outputjson` report, shipped with a `basedpyright-langserver` that speaks LSP.", + "evidence": [ + "https://api.github.com/repos/DetachHead/basedpyright", + "https://github.com/DetachHead/basedpyright/blob/main/README.md", + "https://github.com/DetachHead/basedpyright/blob/main/docs/installation/command-line-and-language-server.md", + "https://github.com/DetachHead/basedpyright/blob/main/.zed/settings.json", + "https://github.com/DetachHead/basedpyright/blob/main/LICENSE.txt", + "https://pypi.org/project/basedpyright/1.40.2/" + ], + "homepage": "https://docs.basedpyright.com", + "id": "basedpyright", + "install": null, + "kind": "lsp", + "last_pushed_at": "2026-11-10T11:06:10Z", + "license": "MIT", + "name": "basedpyright", + "notes": "Recorded next to `pyright`, `ty`, `pyrefly` and `python-lsp-server` as the third Python type checker here that also ships a language server, because it exists for the parts upstream Pyright does not open-source: Pylance-style features (inlay hints, semantic highlighting, import organization), the `recommended` and `all` checking modes, a baseline file that lets an existing project adopt strict typing incrementally instead of fixing everything at once, and a CLI report in `--outputjson` for CI. Upstream describes it as a fork of Pyright with type-checking improvements and Pylance features, and publishes a documentation site for the differences. Distribution: PyPI package `basedpyright` 1.40.2 (published 2026-10-04, Python >=3.10, bundles a Node.js runtime), a Homebrew formula, and VS Code, Open VSX and Sublime Text integrations; the launch command `basedpyright-langserver --stdio` is taken from the repository's own Zed configuration (`.zed/settings.json`). It stays reference-only for the same reason as every raw language server here: LSP does not speak MCP, so an editor or an MCP-to-LSP bridge has to start it. License note: `LICENSE.txt` carries the MIT text inherited from Pyright, the PyPI classifiers say MIT, and the GitHub API reports `NOASSERTION` because of the modified header. 3,647 stars and 138 forks on 2026-11-10; nothing was installed and no language-server or editor session was started for this entry.", + "repository": "DetachHead/basedpyright", + "stars": 3647 + }, + { + "archived": false, + "category": "mcp-ecosystem", + "checked_at": "2026-11-10", + "description": "Server-side memory, handoff and experience layer for coding agents, exposed through an HTTP contract with a Python client, CLI, dashboard and a curated Agent-facing MCP projection over revisioned artifacts.", + "evidence": [ + "https://api.github.com/repos/oceanbase/powercontext", + "https://github.com/oceanbase/powercontext/blob/main/README.md", + "https://github.com/oceanbase/powercontext/blob/main/LICENSE", + "https://powercontext.oceanbase.io", + "https://github.com/oceanbase/powercontext/blob/main/docs/en/docs/integrations/claude-code.md", + "https://pypi.org/project/powercontext/1.5.1/" + ], + "homepage": "https://powercontext.oceanbase.io", + "id": "powercontext", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-10T15:32:42Z", + "license": "Apache-2.0", + "name": "PowerContext", + "notes": "Recorded in the memory lane that already holds `hippo-memory` and `codebase-memory-mcp`, with a different shape: memory, handoff, experience and skill are server-side artifacts behind an HTTP contract, and the Python client, CLI, dashboard, in-process Core SDK and MCP endpoint are views over the same server rather than files inside one agent's home directory. Delivery is a server the user runs and binds - `uv tool install --force \"powercontext[cli,server]==1.5.1\"` (PyPI 1.5.1, Apache-2.0) followed by creating the Scopes and using the returned `scope_id` - so no stdio launch command can be pinned and no install type in this catalog fits. Automatic capture additionally needs the client-side integration enabled, including trusting the PowerContext hooks in Codex, where the `UserPromptSubmit` hook is what makes prompt capture and recall run; the repository documents per-host integrations under `docs/en/docs/integrations/` (Codex is the `official` host, Claude Code and others are `community`) plus agent plugins, and all of it writes agent configuration rather than one launch entry. 1,575 stars, 631 forks and a push on 2026-11-10. Nothing was installed: no server was started, no scope was created, no hook was trusted and no MCP session was started.", + "repository": "oceanbase/powercontext", + "stars": 1575 + }, + { + "archived": false, + "category": "language-servers", + "checked_at": "2026-11-10", + "description": "Rust language server for pytest that resolves fixture definitions across `conftest.py` and third-party plugins, and answers yield navigation, fixture call hierarchy, completion, references, rename and diagnostics for test code.", + "evidence": [ + "https://api.github.com/repos/bellini666/pytest-language-server", + "https://github.com/bellini666/pytest-language-server/blob/master/README.md", + "https://github.com/bellini666/pytest-language-server/blob/master/LICENSE", + "https://pypi.org/project/pytest-language-server/0.26.0/", + "https://crates.io/crates/pytest-language-server" + ], + "homepage": "https://github.com/bellini666/pytest-language-server", + "id": "pytest-language-server", + "install": null, + "kind": "lsp", + "last_pushed_at": "2026-11-07T09:22:51Z", + "license": "MIT", + "name": "pytest-language-server", + "notes": "Recorded for a lane no other entry covers: pytest fixture semantics. It answers go-to-definition for fixtures in the same file, in `conftest.py` files and in third-party fixtures from plugins such as pytest-mock and pytest-asyncio while respecting pytest's fixture shadowing and priority rules; jumps to the `yield` that produces a generator fixture (with teardown navigation); exposes incoming and outgoing call hierarchy so the tests and fixtures around a dependency are visible; completes fixture names inside test and fixture functions with hierarchy-aware suggestions; finds references; renames; and reports diagnostics. The README documents root markers `pytest.ini`, `pyproject.toml`, `setup.py`, `setup.cfg` and `.git`. It stays reference-only because it is a raw LSP binary launched as `pytest-language-server`, the same boundary as `ruff`, `pyright` and `tombi`. Distribution: PyPI `pytest-language-server` 0.26.0 (published 2026-11-03, Python >=3.10, prebuilt wheels), `uv tool install` / `pip install` / `pipx`, a Homebrew tap, crates.io, GitHub release binaries and a source build. It is early-stage and single-maintainer (Rust, 124 stars, first release November 2025) and its README states it was built with AI coding agents and reviewed afterwards, so treat it as an addition to - not a replacement for - a navigation and type server. Nothing was installed and no editor or language-server session was started.", + "repository": "bellini666/pytest-language-server", + "stars": 124 + }, + { + "archived": false, + "category": "security", + "checked_at": "2026-11-10", + "description": "Trail of Bits plugin marketplace of 47 Agent Skills for security and development workflows: audit context building, differential and variant analysis, Semgrep rule authoring, property-based and mutation testing, supply-chain auditing and a modern Python project skill.", + "evidence": [ + "https://api.github.com/repos/trailofbits/skills", + "https://github.com/trailofbits/skills/blob/main/README.md", + "https://github.com/trailofbits/skills/blob/main/.claude-plugin/marketplace.json", + "https://github.com/trailofbits/skills/blob/main/LICENSE", + "https://github.com/trailofbits/skills/tree/main/plugins" + ], + "homepage": "https://github.com/trailofbits/skills", + "id": "trailofbits-skills", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-06T15:20:09Z", + "license": "CC-BY-SA-4.0", + "name": "Trail of Bits Skills", + "notes": "The most complete security-workflow skill collection found in this pass, from an upstream that publishes security research and audits: 47 plugins in `.claude-plugin/marketplace.json`, including audit-context-building, differential-review, variant-analysis, patching-bugs, post-patch-validation, semgrep-rule-creator and semgrep-rule-variant-creator, cvss-scoring, sharp-edges, insecure-defaults, supply-chain-risk-auditor, plus traces of adjacent domains this catalog does not cover (smart contracts, malware and YARA, proofs), and a development group that does serve Python and Web work (`modern-python`, `code-improver`, `review-walkthrough`, `second-opinion`, `regression-hunt`, `property-based-testing`, `mutation-testing`, `static-analysis`, `gh-cli`, `devcontainer-setup`). It does not duplicate `security-review` (one ECC skill), `open-code-review`, or the scanner references (`semgrep`, `bandit`, `osv-scanner`, `gitleaks`, `pipelock`, `skillspector`): this is the workflow layer that decides what to audit, how to reproduce a finding and how to verify a patch, and upstream keeps a public trophy case of bugs found with it. It is reference-only because upstream delivers it as a plugin marketplace (`/plugin marketplace add trailofbits/skills`) and as per-plugin skill directories whose scripts and references differ, so there is no single subtree this catalog can pin and verify; the license is a second reason not to copy text - the content is CC-BY-SA-4.0 with a share-alike term, unlike the MIT skill collections already recorded (`anthropics/skills`, `vercel-labs/agent-skills`). 8,109 stars and 692 forks on 2026-11-10, last pushed 2026-11-06. Nothing was installed, no plugin was activated and no skill was run.", + "repository": "trailofbits/skills", + "stars": 8109 } ], "profiles": {