diff --git a/CHANGELOG.md b/CHANGELOG.md index fb17de5..1d8f467 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -275,6 +275,22 @@ Catalogue additions from the 2026-11-10 evening candidate review. - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were updated in the same change. +Catalogue additions from the 2026-11-11 candidate review. + +- One installable skill, `retentioneering/retentioneering-tools` + (`retentioneering-product-analytics`), pinned to commit + `68f699f67674375c59ea26c6a719e91e83905f51` with archive SHA-256 + `c0fe070c7ad6…`, recorded in `data-workflows`. +- Four reference-only entries: `ast-grep/ast-grep` (structural search and + rewrite for the Python toolchain), `anthropics/claude-plugins-official` + (the 317-plugin Claude Code marketplace), `google/mantis` (agentic security + review: 19 skills plus an ADK harness) and `aoci-spec/aoci-code` + (local-first code-map MCP server, FSL-1.1-MIT). +- The catalog now holds 116 entries: 49 installable resources (24 skills, 6 rule + packs, 17 MCP servers, and 2 LSP bridges) and 67 references. +- `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were + updated in the same change. + ## npm shell 0.1.1 — 2026-10-28 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads, diff --git a/README.md b/README.md index 1a6f5dc..c1124c4 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**. -The repository catalog includes **111 entries**: **48 installable resources** (23 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **63 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 47 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. +The repository catalog includes **116 entries**: **49 installable resources** (24 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **67 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 51 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. ## Contents diff --git a/README.zh-CN.md b/README.zh-CN.md index ee46013..9841d75 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -17,7 +17,7 @@ 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。 -仓库目录收录 **111 个条目**：**48 个可安装资源**（23 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **63 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、47 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 +仓库目录收录 **116 个条目**：**49 个可安装资源**（24 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **67 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、51 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 ## 目录 diff --git a/docs/CATALOG.md b/docs/CATALOG.md index 4c47ad1..eaefe8e 100644 --- a/docs/CATALOG.md +++ b/docs/CATALOG.md @@ -1,6 +1,6 @@ # Curated catalog / 精选目录 -Reviewed **2026-11-10**, catalog schema **2**. **111 entries**, with **48 installable/configurable integrations** and **63 reference-only tools**. The installable set contains 23 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references. +Reviewed **2026-11-11**, catalog schema **2**. **116 entries**, with **49 installable/configurable integrations** and **67 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references. Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status. @@ -52,6 +52,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`graphify`](https://github.com/Graphify-Labs/graphify) | Build a local, deterministic knowledge graph of a repository, its docs, SQL schemas and configuration, and answer architecture, dependency and change-impact questions through a coding-agent skill with no vector store. | Reference only | 142,432 | Apache-2.0 | | [`brooks-lint`](https://github.com/hyhmrright/brooks-lint) | Six review modes for architecture decay, technical debt, test weakness, and remediation, using book-derived risk codes and a 0-100 health score, packaged for fourteen coding agents. | Reference only | 1,561 | MIT | | [`planning-with-files`](https://github.com/OthmanAdi/planning-with-files/tree/2362ca385ad74f061aa0e7b73f56543a4b7e6df2/skills/planning-with-files) | Keep the plan in files instead of context: `.planning/` plan, progress and findings documents, per-turn re-injection against context rot, session recovery after `/clear` or compaction, and a deterministic completion gate. | Install skill | 27,973 | MIT | +| [`retentioneering`](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics) | Product analytics from user-level event logs: paths, transitions, funnels, segments, retention, step matrices and sequence patterns, with a bundled API map, analysis recipes and a log-inspection script. | Install skill | 946 | Apache-2.0 | ## Python, languages, and framework practices @@ -85,6 +86,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`skillspector`](https://github.com/NVIDIA/SkillSpector) | Scan a skill directory, MCP server, Git URL, archive, or MCP registry snapshot for prompt injection, exfiltration, credential access, obfuscation, and supply-chain risk before installing it. | Reference only | 24,520 | Apache-2.0 | | [`pipelock`](https://github.com/pipelab-org/pipelock) | Mediate an agent's egress and MCP traffic against a policy file, scanning requests and responses and signing a receipt for every decision. | Reference only | 987 | Apache-2.0 | | [`trailofbits-skills`](https://github.com/trailofbits/skills) | Trail of Bits plugin marketplace of 47 Agent Skills for security review — audit context building, differential and variant analysis, Semgrep rule authoring, patch validation, supply-chain auditing — plus development workflows including `modern-python`, property-based testing and static analysis. | Reference only | 8,109 | CC-BY-SA-4.0 | +| [`mantis`](https://github.com/google/mantis) | Run agentic vulnerability research as a method: history review, semantic index, threat model, hypothesis planning, deduplication, static verification, reproduction, chaining, adversarial patching and severity calibration, plus an ADK harness and a pull-request action. | Reference only | 2,759 | Apache-2.0 | ## Portable agent rules @@ -126,6 +128,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`codeboarding`](https://github.com/CodeBoarding/CodeBoarding) | Render a codebase as interactive architecture maps plus Markdown, HTML, MDX or reStructuredText documentation for review and a coding agent's next prompt. | Reference only | 2,663 | MIT | | [`mcp-context-forge`](https://github.com/IBM/mcp-context-forge) | Federate MCP, A2A and REST/gRPC servers behind one governed endpoint with a registry, virtual servers, auth, rate limiting, and an admin UI. | Reference only | 4,752 | Apache-2.0 | | [`powercontext`](https://github.com/oceanbase/powercontext) | Server-side memory, handoff and experience layer for coding agents, exposed as an HTTP contract with a Python client, CLI, dashboard and a curated MCP projection over revisioned artifacts. | Reference only | 1,575 | Apache-2.0 | +| [`aoci-code`](https://github.com/aoci-spec/aoci-code) | Keep a Git-versioned, agent-written map of a repository's code, configuration, tests and database schema through a local Go MCP server, so an agent reads the index instead of re-reading the tree. | Reference only | 1,897 | FSL-1.1-MIT | ## Language intelligence and LSP @@ -173,6 +176,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`skillsaw`](https://github.com/stbenjam/skillsaw) | Lint, autofix and baseline the skills, plugin manifests, hooks and instruction files a coding agent loads across the major agent ecosystems. | Reference only | 71 | Apache-2.0 | | [`agents-cli`](https://github.com/google/agents-cli) | Seven Agent Skills plus a CLI for building, evaluating, deploying, observing and publishing ADK agents on Google Cloud. | Reference only | 6,315 | Apache-2.0 | | [`agent-skills-spec`](https://github.com/agentskills/agentskills) | The Agent Skills specification plus `skills-ref`, the Python reference validator that checks a skill directory and renders the properties and prompt block a client would load. | Reference only | 27,113 | Apache-2.0 | +| [`claude-plugins-official`](https://github.com/anthropics/claude-plugins-official) | Anthropic's vetted Claude Code plugin marketplace: 317 skills, agents, hooks, commands and MCP servers plus 14 partner plugins, installed with `/plugin install @claude-plugins-official`. | Reference only | 46,870 | Apache-2.0 | ## Python project toolchain @@ -186,6 +190,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`orm-lens`](https://github.com/FROWNINGdev/orm-lens) | Answer Django model questions over MCP from static parsing — relations, ER diagrams, migration risk, N+1 candidates, and schema drift — with SQLAlchemy preview support. | Configure MCP | 96 | MIT | | [`misata`](https://github.com/rasinmuhammed/misata) | Declare the facts a dataset must hold and get multi-table synthetic test rows over MCP, with a certificate a DuckDB run re-checks, next to a CLI and a pytest plugin. | Configure MCP | 75 | MIT | | [`mustel`](https://github.com/mustel-py/mustel) | Run Ruff, Bandit, Oxlint and pip-audit over MCP for the project it is launched in, with a compressed AST code map and an audit mode for dependency vulnerabilities. | Configure MCP | 19 | MIT | +| [`ast-grep`](https://github.com/ast-grep/ast-grep) | Search, lint and rewrite code by AST pattern instead of text, over tree-sitter grammars including Python, installed as the `ast-grep-cli` package in a project environment. | Reference only | 16,554 | MIT | ## Building MCP integrations @@ -207,6 +212,7 @@ Skill and rule archives are pinned to full commits and verified against a record | [affaan-m/ECC](https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b) | `25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b` | `7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1` | | [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d) | `aeac41d4d005999432bb7312f7ff06383a91d59d` | `0211a580aab7d45c73886d6f96d2f0679416119b4f9add08b6ceea5c0c15fbf1` | | [OthmanAdi/planning-with-files](https://github.com/OthmanAdi/planning-with-files/tree/2362ca385ad74f061aa0e7b73f56543a4b7e6df2) | `2362ca385ad74f061aa0e7b73f56543a4b7e6df2` | `cf60990c520c8f5d6fff876524450ce67172ad8ce785213a9bc50dbb06ac2227` | +| [retentioneering/retentioneering-tools](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51) | `68f699f67674375c59ea26c6a719e91e83905f51` | `c0fe070c7ad635c57b69f4d24ce394b6f21664c234ccdcf24db49af554568781` | | Service | Pinned launcher | Runtime / setup | | --- | --- | --- | @@ -300,3 +306,8 @@ Admission considers the coding task served, documented setup, maintenance activi See [research and verification evidence](RESEARCH.md), [ECC migration details](ECC-MIGRATION.md), [LSP and security-tool setup](LSP.md), and [agent configuration paths](AGENTS.md). **Updates are curated and pinned.** Refreshing installed instructions regenerates them from the catalog shipped with this CLI version. It does not watch upstream repositories, follow their default branches, or silently adopt new skills/rules. A catalog update requires reviewing upstream changes and licenses, selecting a new pin, recomputing archive hashes where applicable, updating these documents, and testing the installation lifecycle. +- **ast-grep:** [Structural search, linting and rewriting by AST pattern](https://github.com/ast-grep/ast-grep) rather than by text, which is the difference that matters when an agent is asked to change every occurrence of one code shape across a project. It stays reference-only because the delivered unit is a native CLI built from a Rust workspace (`crates/`: `cli`, `core`, `language`, `config`, `dynamic`, `lsp`, `outline`, `napi`, `pyo3`, `wasm`) and not one of this catalog's install types: the Python route is the published package `ast-grep-cli` (root `pyproject.toml`, built with maturin from `crates/pyo3`), which belongs in a project environment next to `ruff` and `deptry` rather than in a client configuration, and the CLI's own `lsp` subcommand (`crates/cli/src/lsp.rs`) serves ast-grep rule diagnostics to an editor rather than the Python language intelligence the LSP entries here provide. Python patterns are parsed by `crates/language/src/python.rs`. Nothing was installed and no search or rewrite was run. +- **claude-plugins-official:** [The directory Anthropic maintains for Claude Code plugins](https://github.com/anthropics/claude-plugins-official): `.claude-plugin/marketplace.json` lists 317 plugins — skills, agents, hooks, commands and MCP servers — installed with `/plugin install @claude-plugins-official`, with 14 partner entries under `external_plugins/` and the first-party ones grouped under `plugins/`. It is reference-only because a marketplace is a catalogue of pointers: each plugin resolves to its own repository, subdirectory or version tag, so there is no single subtree to pin and verify — the same reason recorded for `trailofbits/skills` and `anthropics/skills`. Use it to choose a plugin, including the MCP servers already recorded here (`serena`, `context7`, `playwright`, `github`), and note the README's own boundary: Anthropic does not control the MCP servers, files or software inside third-party plugins and cannot verify they behave as intended. Nothing was installed and no plugin was activated. +- **mantis:** [Agentic vulnerability research as an orchestrated method](https://github.com/google/mantis) rather than another scanner: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-history`, `mantis-structural-index`, `mantis-plan`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-reflect`, `mantis-report`, `mantis-advise` and the rest) and `reference/` is a Google ADK harness that runs the same pipeline over a target checkout, with a second copy of the method inside the harness and an `action/` variant for pull requests. It stays reference-only because the useful unit is that collection plus a harness needing a model provider (Vertex AI or an API key) and a target repository, not one pinnable skill directory an installer can copy — and because upstream states that findings and patches produced this way must be verified by a security expert before being reported and that the pull-request scan is untested end to end and must not gate merges. Recorded in `security` next to `trailofbits-skills` as the orchestration layer in front of the scanners already listed there. Nothing was installed, no campaign was run and no code was scanned. +- **retentioneering:** Product analytics where this catalog previously had schema and migration tooling but no lane for user behaviour. `SKILL.md` plus its bundled `references/` (analysis recipes, API map, gotchas and validation) and `scripts/inspect_event_log.py` take an agent from user-level event logs to paths, transitions, funnels, segments, retention, step matrices and sequence patterns, and every path the skill names resolves inside its own directory, so the pinned archive recipe copies a working unit. It is the only installable addition in this pass; the same repository also publishes the `retentioneering` Python package (5.3.0, Python >=3.11) and an MCP server that the skill calls, and the recipe installs only the skill, so the environment it analyses data in still needs the library. Nothing was installed and no dataset was analysed. +- **aoci-code:** A [local-first Go MCP server](https://github.com/aoci-spec/aoci-code) that keeps the agent's own map of a repository — one line per file in `aoci.txt`, with `aoci.code.txt` and `aoci.meta.txt` alongside, committed to Git and re-verified against the tree as work lands — so an agent reads the index instead of re-reading the codebase; it is the same problem `codebase-memory-mcp`, `chunkhound` and `code-review-graph` address by indexing for retrieval, with a file the model writes and Git versions instead. It is reference-only because delivery is a release binary (`go.mod`, `Makefile`, `cmd/`, `engine/`, `internal/`, `.goreleaser.yml`) that a project registers itself, and because the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`; the GitHub API reports `NOASSERTION` for the adapted header), which permits non-competing use today and converts to MIT later — a second reason nothing from its `spec/`, `docs/` or `AGENTS.md` text is copied into this repository. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS`, `THIRD-PARTY-NOTICES`, a Glama listing and bilingual READMEs. Nothing was installed and no index was built. diff --git a/docs/LSP.md b/docs/LSP.md index 6557eff..72dde24 100644 --- a/docs/LSP.md +++ b/docs/LSP.md @@ -136,7 +136,7 @@ Select the intended scan scope and reviewed rule sets, pin dependencies in the p ## Verification recorded for this recipe -On 2026-11-10, no MCP or language-server entry was added or changed: the `planning-with-files` skill added that day had its pinned archive downloaded and SHA-256 verified but was not installed, and the `ui-ux-pro-max`, `agent-skills-spec` and `arcade-mcp` references added the same day were recorded from repository metadata, upstream documentation, package metadata and license files only, so no client files were generated, no skill was validated and no MCP server was started. On 2026-11-09, the `squirrelscan` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no site was audited, no report was written, and no account was used. The `pipelock`, `elephant-goldfish`, and `lspyx` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no proxy was started and no policy was loaded, no traffic was intercepted, no plugin, agent, or skill was activated, and no language-server startup or MCP session was run for `lspyx`. On 2026-11-06, the `misata` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no dataset was generated, no certificate was re-verified, and no database was seeded. The `agnix`, `skillspector`, and `brooks-lint` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no lint run or `--fix`, no scan, no installer, and no editor or MCP session was started. On 2026-11-02, the `roam-code`, `orm-lens`, and `lsp-mcp-server` entries added that day were launched through their pinned commands from a temporary project and completed MCP `initialize` and `tools/list` with 17, 13, and 29 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no codebase was indexed, no Django or SQLAlchemy project was analysed, and no language server was driven. The `ai-rulez` entry added the same day stays a reference: its npm and PyPI packages are installers for a native binary, and the wrapper's own download did not finish in the smoke window, so no MCP session was started. On 2026-11-01, the `repomix` MCP entry added that day passed the same launch check with six tools discovered, while `pyrefly`, `osv-scanner`, and `deptry` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, scan, or MCP session was run for those three references. On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-30, the `fallow` MCP entry added that day passed the same launch check with 43 tools discovered, while `chunkhound` was recorded as a reference after its pinned command failed to complete `initialize` in a fresh project within the smoke window. On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`. +On 2026-11-11, no MCP or language-server entry was added or changed either: the `retentioneering` skill added that day had its pinned archive downloaded and SHA-256 verified but was not installed, and the `ast-grep`, `claude-plugins-official`, `mantis` and `aoci-code` references added the same day were recorded from repository metadata, upstream documentation, package metadata and license files only — no search or rewrite was run, no plugin was activated, no security campaign was started and no index was built, and the recorded launch commands were not executed. On 2026-11-10, no MCP or language-server entry was added or changed: the `planning-with-files` skill added that day had its pinned archive downloaded and SHA-256 verified but was not installed, and the `ui-ux-pro-max`, `agent-skills-spec` and `arcade-mcp` references added the same day were recorded from repository metadata, upstream documentation, package metadata and license files only, so no client files were generated, no skill was validated and no MCP server was started. On 2026-11-09, the `squirrelscan` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no site was audited, no report was written, and no account was used. The `pipelock`, `elephant-goldfish`, and `lspyx` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no proxy was started and no policy was loaded, no traffic was intercepted, no plugin, agent, or skill was activated, and no language-server startup or MCP session was run for `lspyx`. On 2026-11-06, the `misata` MCP entry added that day was launched through its pinned command from a temporary project and completed MCP `initialize` and `tools/list` with 15 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no dataset was generated, no certificate was re-verified, and no database was seeded. The `agnix`, `skillspector`, and `brooks-lint` references added the same day were recorded from repository metadata, upstream documentation, package metadata, and license files only: no lint run or `--fix`, no scan, no installer, and no editor or MCP session was started. On 2026-11-02, the `roam-code`, `orm-lens`, and `lsp-mcp-server` entries added that day were launched through their pinned commands from a temporary project and completed MCP `initialize` and `tools/list` with 17, 13, and 29 tools discovered ([research evidence](RESEARCH.md#mcp-protocol-smoke-results)); no `tools/call` request was issued, so no codebase was indexed, no Django or SQLAlchemy project was analysed, and no language server was driven. The `ai-rulez` entry added the same day stays a reference: its npm and PyPI packages are installers for a native binary, and the wrapper's own download did not finish in the smoke window, so no MCP session was started. On 2026-11-01, the `repomix` MCP entry added that day passed the same launch check with six tools discovered, while `pyrefly`, `osv-scanner`, and `deptry` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, scan, or MCP session was run for those three references. On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-30, the `fallow` MCP entry added that day passed the same launch check with 43 tools discovered, while `chunkhound` was recorded as a reference after its pinned command failed to complete `initialize` in a fresh project within the smoke window. On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`. The check made no `tools/call` requests and ended before language-server initialization completed. It verifies the package launch and MCP discovery path, not symbol correctness, every programming language, every operating system, or integration inside all five agent applications. @@ -150,4 +150,6 @@ On **2026-11-10**, a second pass on the same date added the two language-server 已验证 Serena 的 MCP 握手和工具列表，尚未执行符号操作或逐一验证所有 agent 界面。项目移动后需核对生成配置中的绝对路径；Serena 自己创建的缓存和项目状态不由 `apd remove` 清理。lsp-mcp-server 不自带语言服务：需自行安装（Python 用 python-lsp-server 提供的 `pylsp`）并在项目内配置 `.lsp-mcp.json`，它只是把已有语言服务接到 agent。2026-11-02 新增的 roam-code、orm-lens、lsp-mcp-server 也通过了握手与工具列表检查（分别 17、13、29 个工具），但没有调用任何工具。2026-11-06 新增的 `misata`（Python 合成测试数据 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具；同期的 `agnix`（agent 配置 lint / LSP）、`skillspector`（技能与 MCP 安全扫描）、`brooks-lint`（六种代码审查模式）仅按仓库元数据、上游文档与许可证收录，未运行安装器、扫描或语言服务。 2026-11-09 新增的 `squirrelscan`（网站审计 MCP）通过握手与工具列表检查（15 个工具），未调用任何工具、未审计任何站点；同期的 `pipelock`（出网与 MCP 策略网关）、`elephant-goldfish`（多 harness 设计评审插件）、`lspyx`（Python 专用 ty+Ruff 桥接）仅按仓库元数据、上游文档与许可证收录，未运行安装器、代理、插件或语言服务。 2026-11-10 新增的 `planning-with-files`（把计划、进度与发现写进 `.planning/` 文件的 skill）只下载并校验了固定归档的 SHA-256，未安装、未启动 agent 会话；同期的 `ui-ux-pro-max`（本地设计数据 skill，经生成器 CLI 交付）、`agent-skills-spec`（Agent Skills 规范与 `skills-ref` 校验器）、`arcade-mcp`（Python MCP 框架）仅按仓库元数据、上游文档与许可证收录，未生成客户端文件、未运行校验、未启动 MCP 会话。 +2026-11-11 新增的 `retentioneering`（产品分析 skill，固定归档并校验 SHA-256，未安装、未分析数据）只下载并校验了归档；同期的 `ast-grep`（按 AST 结构搜索与改写，经 `ast-grep-cli` 装进项目环境）、`claude-plugins-official`（317 个插件的官方 Claude Code 市场）、`mantis`（Google 的 agent 化安全审计方法，19 个 skill 加 ADK 参考实现）、`aoci-code`（本地优先的代码地图 MCP，FSL-1.1-MIT）仅按仓库元数据、上游文档、包元数据与许可证收录，未安装、未运行搜索或改写、未启用插件、未执行安全审计、未建立索引。 + 2026-11-10 晚间追加的两个独立语言服务参考（`basedpyright`、`pytest-language-server`）仅按仓库元数据、上游文档、包元数据与许可证收录：未安装、未启动语言服务、未开启编辑器会话；同批的 `trailofbits-skills`（CC-BY-SA-4.0 插件市场）与 `powercontext`（需自建服务并信任 hooks 的记忆层）同样未安装或运行。 diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index 78b1aed..48b34a8 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -1,6 +1,6 @@ # Research and provenance -Research date: **2026-11-10**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 23 skill entries come from five upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. +Research date: **2026-11-11**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 24 skill entries come from six upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. ## Patterns adopted @@ -180,6 +180,24 @@ Rejected candidates in this pass were duplicative, archived, or unverifiable: `H No entry was executed in this pass. All four were recorded from repository metadata, upstream documentation, package metadata and license files: nothing was installed, no language-server or MCP session was started, no plugin was activated, no hook was trusted, and no server or scope was created. +## Candidate review on 2026-11-11 + +A fourth daily pass over recently active coding-agent skills, MCP servers and Python/web tooling added five entries after de-duplication against the previous 111: one installable skill (`retentioneering/retentioneering-tools`) and four reference-only entries (`ast-grep/ast-grep`, `anthropics/claude-plugins-official`, `google/mantis`, `aoci-spec/aoci-code`). + +`retentioneering` is the only candidate in this pass whose delivered unit is a single self-contained skill directory, so it takes a commit-pinned archive recipe: `.agents/skills/retentioneering-product-analytics/` holds `SKILL.md` (frontmatter `license: Apache-2.0`, `compatibility: Requires Python >= 3.11 and Retentioneering 5.x`), three references (`analysis-recipes.md`, `api-map.md`, `gotchas-and-validation.md`) and `scripts/inspect_event_log.py`, and every path the skill names resolves inside that directory. The archive was downloaded from `codeload.github.com` at `68f699f67674375c59ea26c6a719e91e83905f51` (5,951,483 bytes, SHA-256 `c0fe070c7ad635c57b69f4d24ce394b6f21664c234ccdcf24db49af554568781`, 5 files under the subtree), but it was not installed and no dataset was analysed. The same repository publishes the `retentioneering` Python package (PyPI 5.3.0, Python >=3.11) and an MCP server that the skill calls; the recipe installs only the skill, so an environment without the library can follow the instructions but not run the analysis. + +`claude-plugins-official` is the second marketplace recorded here after `trailofbits/skills`, and the first first-party one: `.claude-plugin/marketplace.json` lists 317 plugins, 14 partner entries live under `external_plugins/`, and `plugins/` groups the Anthropic-maintained ones. It is reference-only for the structural reason — each entry resolves to its own repository, subdirectory or tag through the marketplace file, so there is no single revision this catalog can pin and hash — and its README states the trust boundary explicitly: Anthropic does not control the MCP servers, files or software inside third-party plugins and cannot verify they behave as intended. Choosing a plugin from it does not activate one, and the MCP servers this catalog already configures (`serena`, `context7`, `playwright`, `github`) appear there as well. + +`ast-grep` is the structural rewrite layer next to the Python toolchain entries: tree-sitter patterns such as `def $F($$$ARGS)` match code by shape, which is what lets an agent apply one change across a repository instead of approximating it with `sed`. Python is one of the grammars it parses (`crates/language/src/python.rs`), the published Python route is `pip install ast-grep-cli` (root `pyproject.toml`, maturin build over `crates/pyo3`), and the CLI carries an `lsp` subcommand (`crates/cli/src/lsp.rs`) that reports ast-grep rule diagnostics to an editor — an integration this catalog does not record in the LSP lane, which documents Python language servers. It stays reference-only because the unit is a CLI installed into a project environment rather than a skill, rule pack, MCP server or bridge, and no registry launch command exists to pin. + +`mantis` is the agentic security-review method, from the same upstream as `osv-scanner` and `google/agents-cli`: 19 skills in `skills/` and a Google ADK harness in `reference/` with `install.sh`, two harness-internal skills, a documented run mode (`python3 scripts/configure.py`, `./run.sh `) and an `action/` variant for pull requests. It is reference-only because the useful unit is a collection plus a harness that needs a model provider and a target checkout, and because upstream records its own limits: findings and patches must be verified by a security expert before being reported, and the pull-request scan is untested end to end and should not gate merges. Recorded in `security` as the orchestration layer in front of `semgrep`, `bandit`, `gitleaks` and `osv-scanner`, not as a replacement for them. + +`aoci-code` joins the code-index lane (`code-review-graph`, `codebase-memory-mcp`, `chunkhound`) with the opposite mechanism: instead of an embedding index built by a tool, the agent writes the map, one line per file, into `aoci.txt` plus `aoci.code.txt` and `aoci.meta.txt`, commits it with the code, and serves nine MCP tools over a local Go binary that re-verifies the map against the tree. It is reference-only because delivery is a release binary a project registers itself, and because the license is the Functional Source License 1.1 with an MIT future license (`LICENSE`; the GitHub API reports `NOASSERTION` for the adapted header) — source-available rather than OSI-approved today. Nothing from its `spec/`, `docs/` or `AGENTS.md` text is copied into this repository. + +Rejected candidates in this pass fell into three groups. Duplicative or aggregator-shaped, with no reviewed selection to pin: `aovestdipaperino/tokensave` (702 stars, MIT, pushed the same day), a code-intelligence MCP server whose lane is already served by the four recorded above and by `code-review-graph`; `davepoon/buildwithclaude` (3,741 stars, MIT), a hub to browse skills, agents, commands, hooks and plugins, in the same discovery lane as `skills-cli`, `ai-rulez` and the new marketplace entry; `Mindrally/skills` (302 stars, Apache-2.0) and `coco-research/coco` (630 stars, Apache-2.0) with the latter's skill and subagent collections; and `HoangNguyen0403/agent-skills-standard` (584 stars, MIT), rejected again for the reason recorded on 2026-11-10. Below the activity bar while the daily pass looks for recently active projects: `ciembor/agent-rules-books` (3,251 stars, MIT, last pushed 2026-09-10), `hoangnb24/repository-harness` (1,266 stars, MIT, last pushed 2026-10-04) in the agent-configuration generator lane already held by `ruler` and `ai-rulez`, and `PatrickJS/awesome-cursorrules` (41,145 stars, CC0-1.0, last pushed 2026-05-30). Failed the admission criteria on license or remit: `mksglu/context-mode` (33,873 stars, pushed the same day) with no detectable SPDX license (`NOASSERTION`), `Piebald-AI/claude-code-lsps` (521 stars, pushed 2026-11-08) with no license detected at all for an LSP-plugin marketplace in a lane that already holds 18 entries, `modem-dev/hunk` (9,816 stars, MIT), a terminal diff viewer for agentic coders rather than a skill, rule pack, MCP server, LSP or reference this catalog records, and `obsidianmd/obsidian-skills` (51,653 stars, MIT), official agent skills for a note-taking application rather than software development. + +No entry was executed in this pass. The installable addition was verified by downloading and hashing its pinned archive; the four references were recorded from repository metadata, upstream documentation, package metadata and license files only. Nothing was installed, no search or rewrite was run, no plugin was activated, no security campaign was started, and no index was built. + ## Installable upstream evidence | Item | Evidence checked | Result | @@ -206,9 +224,11 @@ No entry was executed in this pass. All four were recorded from repository metad | Reticle MCP | [Client configuration](https://github.com/reticlehq/reticle/blob/main/README.md), [installer](https://github.com/reticlehq/reticle/blob/main/install/install.sh), [framework guides](https://github.com/reticlehq/reticle/blob/main/docs/frameworks.mdx), [npm version metadata](https://registry.npmjs.org/@reticlehq%2fserver/3.9.0), [license](https://github.com/reticlehq/reticle/blob/main/LICENSE) | Published `3.9.0`; npm declares Node.js `>=20.11`, the `reticle` binary, and an optional Playwright peer. Upstream documents `npx @reticlehq/server@ mcp` for a client that already exists, and a one-line installer or `reticle setup mcp` for a machine-level setup that also appends instruction blocks and a prompt hook. Verdicts are computed locally; anonymous usage counts are on by default, and prompt upload requires linking the project. | | Mustel MCP | [Repository README](https://github.com/mustel-py/mustel/blob/main/README.md), [package metadata](https://github.com/mustel-py/mustel/blob/main/pyproject.toml), [PyPI version metadata](https://pypi.org/project/mustel/0.3.4/), [license](https://github.com/mustel-py/mustel/blob/main/LICENSE) | Published `0.3.4`; `pyproject.toml` declares Python `>=3.10` and leaves `mcp` uncapped (`mcp>=1.0.0`), so the launcher pins `--python 3.12` and `--with mcp<2`. Upstream documents `mustel serve` as the stdio server and lists five MCP tools (`review`, `review_file`, `get_code_map`, `env`, `bootstrap`), which matches what the smoke check discovered. The README is the source for the dual dev/audit mode switch (`CI`, `GITHUB_ACTIONS`, `PRE_COMMIT`), the stat-based cache, the 1,500-token `get_code_map` claim, Jupyter `.ipynb` parsing, and the `bootstrap` behaviour that rewrites IDE configuration, `.cursorrules`/`.windsurfrules` and git pre-commit hooks - none of which this recipe performs. | -The five skill/rule source archives were downloaded from `codeload.github.com` at full 40-character commits. Their SHA-256 values in the manifest were computed from the downloaded bytes. Serena instead uses an explicit Git source revision through uvx. Skill and original rule contents are upstream third-party material; catalog descriptions, selection notes, and disclosed rule adaptations are authored for this project. No upstream archive is vendored into this repository. +The six skill/rule source archives were downloaded from `codeload.github.com` at full 40-character commits. Their SHA-256 values in the manifest were computed from the downloaded bytes. Serena instead uses an explicit Git source revision through uvx. Skill and original rule contents are upstream third-party material; catalog descriptions, selection notes, and disclosed rule adaptations are authored for this project. No upstream archive is vendored into this repository. | Squirrelscan MCP | [Repository README](https://github.com/squirrelscan/squirrelscan/blob/main/README.md), [CLI `mcp` command](https://github.com/squirrelscan/squirrelscan/blob/main/apps/cli/src/cli/commands/mcp.ts), [npm package](https://www.npmjs.com/package/squirrelscan/v/0.0.173), [license](https://github.com/squirrelscan/squirrelscan/blob/main/LICENSE) | Published `0.0.173`; the package declares Node.js `>=18` and one `squirrel` binary whose `mcp` subcommand starts the local stdio server, which is exactly what the smoke check launched. Upstream also documents a hosted HTTP endpoint (`https://mcp.squirrelscan.com/mcp`) and a plugin-marketplace route, both outside this recipe, and report, publish and comment scopes need the user's own account. Nothing was audited: no site was fetched, no report was written and no MCP tool was called. | +| Retentioneering skill | [Pinned skill tree](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics), repository metadata, root `LICENSE` (Apache-2.0), complete downloaded archive | The selected directory exists at the pin with five entries (`SKILL.md`, `references/api-map.md`, `references/analysis-recipes.md`, `references/gotchas-and-validation.md`, `scripts/inspect_event_log.py`), and every path `SKILL.md` refers to resolves inside that directory, including the bundled-reference table. The skill's own frontmatter carries `license: Apache-2.0` and states it needs Python >=3.11 with Retentioneering 5.x, which matches the repository's `pyproject.toml` (version 5.3.0). Archive SHA-256 `c0fe070c7ad6…` recorded in the manifest. Nothing was installed and no dataset was analysed. | + ## Why some tools are reference-only - [GitHub MCP Server](https://github.com/github/github-mcp-server) needs an authentication and tool-permission decision. Its official setup remains the entry point. diff --git a/src/awesome_python_dev/data/catalog.json b/src/awesome_python_dev/data/catalog.json index dd9fab4..d20e87b 100644 --- a/src/awesome_python_dev/data/catalog.json +++ b/src/awesome_python_dev/data/catalog.json @@ -1,6 +1,6 @@ { "schema_version": 2, - "reviewed_at": "2026-11-10", + "reviewed_at": "2026-11-11", "tools": [ { "id": "systematic-debugging", @@ -3009,6 +3009,137 @@ "notes": "The most complete security-workflow skill collection found in this pass, from an upstream that publishes security research and audits: 47 plugins in `.claude-plugin/marketplace.json`, including audit-context-building, differential-review, variant-analysis, patching-bugs, post-patch-validation, semgrep-rule-creator and semgrep-rule-variant-creator, cvss-scoring, sharp-edges, insecure-defaults, supply-chain-risk-auditor, plus traces of adjacent domains this catalog does not cover (smart contracts, malware and YARA, proofs), and a development group that does serve Python and Web work (`modern-python`, `code-improver`, `review-walkthrough`, `second-opinion`, `regression-hunt`, `property-based-testing`, `mutation-testing`, `static-analysis`, `gh-cli`, `devcontainer-setup`). It does not duplicate `security-review` (one ECC skill), `open-code-review`, or the scanner references (`semgrep`, `bandit`, `osv-scanner`, `gitleaks`, `pipelock`, `skillspector`): this is the workflow layer that decides what to audit, how to reproduce a finding and how to verify a patch, and upstream keeps a public trophy case of bugs found with it. It is reference-only because upstream delivers it as a plugin marketplace (`/plugin marketplace add trailofbits/skills`) and as per-plugin skill directories whose scripts and references differ, so there is no single subtree this catalog can pin and verify; the license is a second reason not to copy text - the content is CC-BY-SA-4.0 with a share-alike term, unlike the MIT skill collections already recorded (`anthropics/skills`, `vercel-labs/agent-skills`). 8,109 stars and 692 forks on 2026-11-10, last pushed 2026-11-06. Nothing was installed, no plugin was activated and no skill was run.", "repository": "trailofbits/skills", "stars": 8109 + }, + { + "archived": false, + "category": "python-toolchain", + "checked_at": "2026-11-11", + "description": "Structural search, lint and rewrite CLI over tree-sitter that matches code by AST pattern instead of text, shipped on PyPI as `ast-grep-cli` and recorded as the precise-rewrite layer a coding agent can call when a textual edit is not enough.", + "evidence": [ + "https://api.github.com/repos/ast-grep/ast-grep", + "https://github.com/ast-grep/ast-grep/blob/main/README.md", + "https://github.com/ast-grep/ast-grep/blob/main/pyproject.toml", + "https://github.com/ast-grep/ast-grep/tree/main/crates", + "https://github.com/ast-grep/ast-grep/blob/main/LICENSE", + "https://pypi.org/project/ast-grep-cli/", + "https://ast-grep.github.io/" + ], + "homepage": "https://ast-grep.github.io/", + "id": "ast-grep", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-11T11:55:46Z", + "license": "MIT", + "name": "ast-grep", + "notes": "Reference only because the delivered unit is a native CLI, not one of this catalog's four install types: the repository is a Rust workspace (`crates/cli`, `core`, `language`, `config`, `lsp`, `pyo3`, `napi`, `wasm`) whose Python packaging path is `pip install ast-grep-cli` (root `pyproject.toml`, maturin backend, 0.51.2), so it belongs in a project environment next to `ruff` and `deptry` rather than in a client configuration. It fills the structural-rewrite lane this catalog did not have: the tree-sitter grammar for Python (`crates/language`) lets patterns such as `def $F($$$ARGS)` match by syntax and `--rewrite` apply one change across a repository, which a `grep`/`sed` pass cannot express safely. Upstream also carries an `lsp` subcommand (`crates/cli/src/lsp.rs`) for reporting ast-grep rules in an editor; that is rule diagnostics for the tool itself, not a Python language server, so it is not recorded in the LSP lane. Third-party MCP wrappers exist but are not this project's; no upstream skill or server is registered here. Evidence read in this pass: repository metadata, README, root `pyproject.toml`, the `crates/` tree, `LICENSE` (MIT) and the documentation site. Nothing was installed and no search or rewrite was run.", + "repository": "ast-grep/ast-grep", + "stars": 16554 + }, + { + "archived": false, + "category": "skill-ecosystem", + "checked_at": "2026-11-11", + "description": "Anthropic-managed directory of vetted Claude Code plugins — 317 entries covering skills, agents, hooks, commands and MCP servers — installed with `/plugin install @claude-plugins-official`.", + "evidence": [ + "https://api.github.com/repos/anthropics/claude-plugins-official", + "https://github.com/anthropics/claude-plugins-official/blob/main/README.md", + "https://github.com/anthropics/claude-plugins-official/blob/main/.claude-plugin/marketplace.json", + "https://github.com/anthropics/claude-plugins-official/tree/main/plugins", + "https://github.com/anthropics/claude-plugins-official/tree/main/external_plugins", + "https://github.com/anthropics/claude-plugins-official/blob/main/LICENSE" + ], + "homepage": "https://code.claude.com/docs/en/plugins", + "id": "claude-plugins-official", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-11T07:28:56Z", + "license": "Apache-2.0", + "name": "Claude Code plugin directory (official)", + "notes": "Reference only because the delivered unit is a marketplace, not one pinnable subtree: each name in `.claude-plugin/marketplace.json` resolves to its own repository, subdirectory or version tag, so there is no single commit to pin and no skill directory to install. It is recorded next to `anthropics/skills`, `skills-cli` and `awesome-copilot` as the reviewed directory a project should prefer when it wants a Claude Code plugin, and it covers this catalog's lanes too — `plugins/` groups the Anthropic-maintained entries (including the MCP servers recorded here as `serena`, `context7`, `playwright` and `github`), while `external_plugins/` carries 14 partner entries that point back to their own projects. Upstream states the trust boundary explicitly: Anthropic does not control the MCP servers, files or software that third-party plugins reference and cannot verify they behave as intended, so review stays with the user. Evidence read in this pass: repository metadata, README (structure, installation and submission sections), `.claude-plugin/marketplace.json` (317 names, 41 top-level `plugins/` entries, 14 `external_plugins/` entries) and `LICENSE` (Apache-2.0). Nothing was installed and no plugin was activated.", + "repository": "anthropics/claude-plugins-official", + "stars": 46870 + }, + { + "archived": false, + "category": "security", + "checked_at": "2026-11-11", + "description": "Modular, stack-agnostic toolkit of 19 security-review skills plus a Google ADK reference harness that lets coding agents threat-model, research, reproduce, deduplicate, patch and calibrate vulnerabilities across a codebase.", + "evidence": [ + "https://api.github.com/repos/google/mantis", + "https://github.com/google/mantis/blob/main/README.md", + "https://github.com/google/mantis/tree/main/skills", + "https://github.com/google/mantis/blob/main/reference/README.md", + "https://github.com/google/mantis/blob/main/reference/install.sh", + "https://github.com/google/mantis/blob/main/schema.json", + "https://github.com/google/mantis/blob/main/LICENSE" + ], + "homepage": "https://github.com/google/mantis", + "id": "mantis", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-10T03:41:46Z", + "license": "Apache-2.0", + "name": "Mantis (Google)", + "notes": "Reference only because the delivered unit is a skill collection plus a separate harness rather than one subtree to copy: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-structural-index`, `mantis-reflect` and the rest) that an agent loads on demand, while `reference/` is a Google ADK pipeline for the same method (`./install.sh`, `python3 scripts/configure.py --auto`, `./run.sh path/to/code`) that needs its own model provider (Vertex AI ADC or an API key) and `action/` runs it over a pull request. It is recorded in `security` next to `trailofbits-skills` and the scanner references because it orchestrates existing tools instead of adding another scanner, with upstream stating that AI findings and patches must be verified by a security expert before they are reported. Upstream's README also marks the pull-request scan as untested end to end and says not to use it to gate merges. Evidence read in this pass: repository metadata, README (installation, run modes, overview and warnings), the `skills/` listing (20 entries including its own README), `reference/README.md`, `reference/install.sh`, `schema.json` and `LICENSE` (Apache-2.0). Nothing was installed, no campaign was run and no code was scanned.", + "repository": "google/mantis", + "stars": 2758 + }, + { + "archived": false, + "category": "data-workflows", + "checked_at": "2026-11-11", + "description": "Self-contained product-analytics skill that turns user-level event logs into reproducible path, transition, funnel, segment, retention and sequence analysis results on top of the Apache-2.0 Retentioneering Python library.", + "evidence": [ + "https://api.github.com/repos/retentioneering/retentioneering-tools", + "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/SKILL.md", + "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/references/analysis-recipes.md", + "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics/scripts/inspect_event_log.py", + "https://github.com/retentioneering/retentioneering-tools/blob/68f699f67674375c59ea26c6a719e91e83905f51/LICENSE", + "https://codeload.github.com/retentioneering/retentioneering-tools/tar.gz/68f699f67674375c59ea26c6a719e91e83905f51", + "https://pypi.org/project/retentioneering/", + "https://retentioneering.com/docs/" + ], + "homepage": "https://retentioneering.com", + "id": "retentioneering", + "install": { + "license_path": "LICENSE", + "ref": "68f699f67674375c59ea26c6a719e91e83905f51", + "sha256": "c0fe070c7ad635c57b69f4d24ce394b6f21664c234ccdcf24db49af554568781", + "subdir": ".agents/skills/retentioneering-product-analytics", + "type": "skill", + "url": "https://codeload.github.com/retentioneering/retentioneering-tools/tar.gz/68f699f67674375c59ea26c6a719e91e83905f51" + }, + "kind": "skill", + "last_pushed_at": "2026-11-08T11:26:31Z", + "license": "Apache-2.0", + "name": "Retentioneering", + "notes": "Installable as one self-contained skill directory: `.agents/skills/retentioneering-product-analytics/` holds `SKILL.md` (with `name`, `description` and `license: Apache-2.0` frontmatter) plus `references/` (api-map, analysis-recipes, gotchas-and-validation) and `scripts/inspect_event_log.py`, five files whose every referenced path stays inside that directory, so the pinned archive recipe copies a working unit rather than a fragment. The same repository publishes the `retentioneering` Python package (Python >= 3.11) and an MCP server, which are the engine this skill drives; only the skill is installed here, so the library still has to be present in the environment that holds the event data. It is recorded in `data-workflows` because it answers product questions from user-level event data — paths, transitions, funnels, segments, retention, step matrices and sequence mining — which is the analysis lane this catalog had for schemas and migrations but not for clickstream behaviour. Evidence read in this pass: repository metadata, `SKILL.md` and its bundled-reference table, the `references/` and `scripts/` listings, `LICENSE` (Apache-2.0) and the downloaded archive at the pinned commit (5,951,483 bytes, subtree file count 5). Nothing was installed and no dataset was analysed.", + "repository": "retentioneering/retentioneering-tools", + "stars": 946 + }, + { + "archived": false, + "category": "mcp-ecosystem", + "checked_at": "2026-11-11", + "description": "Local-first Go MCP server (9 tools) that keeps a Git-versioned, agent-written map of a codebase and its database schema so a coding agent can orient itself without re-reading the repository on every task.", + "evidence": [ + "https://api.github.com/repos/aoci-spec/aoci-code", + "https://github.com/aoci-spec/aoci-code/blob/main/README.md", + "https://github.com/aoci-spec/aoci-code/blob/main/README.zh-CN.md", + "https://github.com/aoci-spec/aoci-code/tree/main/docs", + "https://github.com/aoci-spec/aoci-code/tree/main/spec", + "https://github.com/aoci-spec/aoci-code/blob/main/LICENSE" + ], + "homepage": "https://www.aoci.ai", + "id": "aoci-code", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-11T07:21:07Z", + "license": "FSL-1.1-MIT", + "name": "AOCI-CODE", + "notes": "Reference only because the delivered unit is a Go binary that starts a local MCP server a project registers itself: `.goreleaser.yml`, `docs/` (22 entries) and `spec/` (the index grammar) describe the release binaries and the file format, and the README documents the agent-written index (`aoci.txt`, `aoci.code.txt`, `aoci.meta.txt`) committed next to the code and updated through the server's 9 tools as work lands, with the badge still marking v0.2.0-rc1. It is recorded in `mcp-ecosystem` next to `codebase-memory-mcp`, `chunkhound`, `powercontext` and `code-review-graph` for the same problem — a repository an agent should not re-read on every task — with a different mechanism: one model-written line per file, versioned by Git and re-verified against the tree instead of retrieved by embedding. License caveat recorded with the entry: the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`, FSL-1.1-MIT; the GitHub API reports `NOASSERTION` because the header is adapted), which permits non-competing use and converts to MIT later, so no text from `spec/` or `docs/` is copied into this repository and the entry stays reference-only. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS` and `THIRD-PARTY-NOTICES` files plus a Glama listing. Evidence read in this pass: repository metadata, both READMEs, README.zh-CN.md, the root tree listing, the `docs/` and `spec/` listings and `LICENSE`. Nothing was installed and no index was built.", + "repository": "aoci-spec/aoci-code", + "stars": 1897 } ], "profiles": {