From d8ec7c0e9f3dbf70ad8e2a5e0dfa40f2f6aeb8d6 Mon Sep 17 00:00:00 2001 From: Shaowei Pu Date: Thu, 12 Nov 2026 23:52:53 +0800 Subject: [PATCH] feat(catalog): add semble, archy, acumen (daily candidate review) MinishLab/semble: 6403 stars, MIT, CPU-only code search MCP server (uvx --python 3.12 --from "semble[mcp]==0.7.3" semble; smoke check 2 tools). hslee16/Archy: 8 stars, MIT, Python import-graph architecture assertions (uvx --python 3.12 --from archy==0.55.1 archy mcp; smoke check 14 tools). scverse/acumen: 20 stars, MIT, reference-only entry for building and scoring an agentic skill for a Python package. Stars and last_pushed_at read from the GitHub API; catalog now holds 119 entries (51 installable: 24 skills, 6 rule packs, 19 MCP servers, 2 LSP bridges; 68 references). --- CHANGELOG.md | 18 ++++ README.md | 2 +- README.zh-CN.md | 2 +- docs/CATALOG.md | 9 +- docs/RESEARCH.md | 25 +++++ src/awesome_python_dev/data/catalog.json | 111 ++++++++++++++++++++++- 6 files changed, 163 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d8f467..e27be94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -291,6 +291,24 @@ Catalogue additions from the 2026-11-11 candidate review. - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were updated in the same change. +Catalogue additions from the 2026-11-12 candidate review. + +- Two installable MCP servers, both smoke-checked through + `scripts/smoke_mcp.py`: `MinishLab/semble` (pinned + `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble`, 2 tools discovered; + CPU-only code search, recorded in `mcp-ecosystem`) and `hslee16/Archy` + (pinned `uvx --python 3.12 --from archy==0.55.1 archy mcp`, 14 tools + discovered; Python import-graph architecture assertions, recorded in + `python-toolchain`). +- One reference-only entry: `scverse/acumen`, harness and scoring method for + building an agentic skill for a Python package, recorded in + `skill-ecosystem`. +- The catalog now holds 119 entries: 51 installable resources (24 skills, 6 rule + packs, 19 MCP servers, and 2 LSP bridges) and 68 references. Profiles and rule + dependencies are unchanged; no launcher or installer behaviour was touched. +- `docs/CATALOG.md`, `docs/RESEARCH.md`, and both READMEs were updated in the + same change. + ## npm shell 0.1.1 — 2026-10-28 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads, diff --git a/README.md b/README.md index c1124c4..2272916 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**. -The repository catalog includes **116 entries**: **49 installable resources** (24 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **67 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 51 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. +The repository catalog includes **119 entries**: **51 installable resources** (24 skills, 6 rule packs, 19 MCP servers, and 2 LSP bridges) and **68 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 52 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. ## Contents diff --git a/README.zh-CN.md b/README.zh-CN.md index 9841d75..06c89ab 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -17,7 +17,7 @@ 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。 -仓库目录收录 **116 个条目**：**49 个可安装资源**（24 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **67 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、51 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 +仓库目录收录 **119 个条目**：**51 个可安装资源**（24 个 skills、6 套规则、19 个 MCP servers、2 个 LSP 桥接），以及 **68 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、52 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 ## 目录 diff --git a/docs/CATALOG.md b/docs/CATALOG.md index eaefe8e..1f54470 100644 --- a/docs/CATALOG.md +++ b/docs/CATALOG.md @@ -1,6 +1,6 @@ # Curated catalog / 精选目录 -Reviewed **2026-11-11**, catalog schema **2**. **116 entries**, with **49 installable/configurable integrations** and **67 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references. +Reviewed **2026-11-12**, catalog schema **2**. **119 entries**, with **51 installable/configurable integrations** and **68 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 19 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references. Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status. @@ -129,6 +129,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`mcp-context-forge`](https://github.com/IBM/mcp-context-forge) | Federate MCP, A2A and REST/gRPC servers behind one governed endpoint with a registry, virtual servers, auth, rate limiting, and an admin UI. | Reference only | 4,752 | Apache-2.0 | | [`powercontext`](https://github.com/oceanbase/powercontext) | Server-side memory, handoff and experience layer for coding agents, exposed as an HTTP contract with a Python client, CLI, dashboard and a curated MCP projection over revisioned artifacts. | Reference only | 1,575 | Apache-2.0 | | [`aoci-code`](https://github.com/aoci-spec/aoci-code) | Keep a Git-versioned, agent-written map of a repository's code, configuration, tests and database schema through a local Go MCP server, so an agent reads the index instead of re-reading the tree. | Reference only | 1,897 | FSL-1.1-MIT | +| [`semble`](https://github.com/MinishLab/semble) | Answer code questions from a CPU-only repository index instead of grepping and reading files, over MCP (`search`, `find_related`), a CLI, an agent skill or a sub-agent. | Configure MCP | 6,403 | MIT | ## Language intelligence and LSP @@ -191,6 +192,7 @@ Profiles select relevant tools instead of loading every available rule and frame | [`misata`](https://github.com/rasinmuhammed/misata) | Declare the facts a dataset must hold and get multi-table synthetic test rows over MCP, with a certificate a DuckDB run re-checks, next to a CLI and a pytest plugin. | Configure MCP | 75 | MIT | | [`mustel`](https://github.com/mustel-py/mustel) | Run Ruff, Bandit, Oxlint and pip-audit over MCP for the project it is launched in, with a compressed AST code map and an audit mode for dependency vulnerabilities. | Configure MCP | 19 | MIT | | [`ast-grep`](https://github.com/ast-grep/ast-grep) | Search, lint and rewrite code by AST pattern instead of text, over tree-sitter grammars including Python, installed as the `ast-grep-cli` package in a project environment. | Reference only | 16,554 | MIT | +| [`archy`](https://github.com/hslee16/Archy) | Assert Python architecture on the import graph — blast radius, affected tests, cycles, coupling and declared layers — as a CLI that exits non-zero and an MCP server a session can call before committing. | Configure MCP | 8 | MIT | ## Building MCP integrations @@ -235,6 +237,8 @@ Skill and rule archives are pinned to full commits and verified against a record | `dbhub` | `npx -y @bytebase/dbhub@1.5.1 --transport stdio --demo` | Node.js >=22.5 for the built-in `node:sqlite`; `--demo` serves the bundled sample SQLite database and is replaced by `--dsn` for a real database | | `mustel` | `uvx --python 3.12 --with mcp<2 --from mustel==0.3.4 mustel serve` | uv/uvx; Python 3.12 pinned (the package needs >=3.10 while this host's system Python is 3.9); published `0.3.4` leaves `mcp` uncapped, so the recipe adds `--with mcp<2`; the server analyses the directory it starts in, and its `bootstrap` tool is never called | | `squirrelscan` | `npx -y squirrelscan@0.0.173 mcp` | Node.js >=18; the audit fetches the target site over HTTP, so the server needs network access and an explicit site per call; the hosted endpoint and the signed-in report scopes need the user's own account | +| `semble` | `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble` | uv/uvx; Python 3.12 pinned; the `mcp` extra caps `mcp<3.0`; the server indexes the directory it starts in, and the first run downloads the embedding model and grammars | +| `archy` | `uvx --python 3.12 --from archy==0.55.1 archy mcp` | uv/uvx; Python 3.12 pinned; static import analysis of the directory it starts in, no state written and no test run | - **Context7:** API keys are optional in the pinned stdio package guidance for higher limits/private repositories. Service access and policy can change independently of the package version. Configure credentials through the chosen agent; do not commit secrets. - **Playwright:** A supported browser is needed for browser operations. Configuring the server does not install browser binaries. @@ -311,3 +315,6 @@ See [research and verification evidence](RESEARCH.md), [ECC migration details](E - **mantis:** [Agentic vulnerability research as an orchestrated method](https://github.com/google/mantis) rather than another scanner: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-history`, `mantis-structural-index`, `mantis-plan`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-reflect`, `mantis-report`, `mantis-advise` and the rest) and `reference/` is a Google ADK harness that runs the same pipeline over a target checkout, with a second copy of the method inside the harness and an `action/` variant for pull requests. It stays reference-only because the useful unit is that collection plus a harness needing a model provider (Vertex AI or an API key) and a target repository, not one pinnable skill directory an installer can copy — and because upstream states that findings and patches produced this way must be verified by a security expert before being reported and that the pull-request scan is untested end to end and must not gate merges. Recorded in `security` next to `trailofbits-skills` as the orchestration layer in front of the scanners already listed there. Nothing was installed, no campaign was run and no code was scanned. - **retentioneering:** Product analytics where this catalog previously had schema and migration tooling but no lane for user behaviour. `SKILL.md` plus its bundled `references/` (analysis recipes, API map, gotchas and validation) and `scripts/inspect_event_log.py` take an agent from user-level event logs to paths, transitions, funnels, segments, retention, step matrices and sequence patterns, and every path the skill names resolves inside its own directory, so the pinned archive recipe copies a working unit. It is the only installable addition in this pass; the same repository also publishes the `retentioneering` Python package (5.3.0, Python >=3.11) and an MCP server that the skill calls, and the recipe installs only the skill, so the environment it analyses data in still needs the library. Nothing was installed and no dataset was analysed. - **aoci-code:** A [local-first Go MCP server](https://github.com/aoci-spec/aoci-code) that keeps the agent's own map of a repository — one line per file in `aoci.txt`, with `aoci.code.txt` and `aoci.meta.txt` alongside, committed to Git and re-verified against the tree as work lands — so an agent reads the index instead of re-reading the codebase; it is the same problem `codebase-memory-mcp`, `chunkhound` and `code-review-graph` address by indexing for retrieval, with a file the model writes and Git versions instead. It is reference-only because delivery is a release binary (`go.mod`, `Makefile`, `cmd/`, `engine/`, `internal/`, `.goreleaser.yml`) that a project registers itself, and because the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`; the GitHub API reports `NOASSERTION` for the adapted header), which permits non-competing use today and converts to MIT later — a second reason nothing from its `spec/`, `docs/` or `AGENTS.md` text is copied into this repository. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS`, `THIRD-PARTY-NOTICES`, a Glama listing and bilingual READMEs. Nothing was installed and no index was built. +- **semble:** [Local code search built for agents](https://github.com/MinishLab/semble), delivered as a stdio MCP server behind the documented `semble[mcp]` extra, so an agent asks a question in natural language and gets ranked snippets back instead of grepping and reading whole files. Everything runs on CPU: no GPU, no API key and no external service, which is what makes rebuilding an index cheaper than caching one inside the project — the mechanism that separates it from `chunkhound` and `codebase-memory-mcp` (embedding index kept in the project), `code-review-graph` (tree-sitter graph), `repomix` (one packed file) and `aoci-code` (agent-written map). One installer offers four delivery modes — MCP configuration, `AGENTS.md`/`CLAUDE.md` instructions, a `semble-search` sub-agent, or a `semble` skill plus a one-line pointer — and this recipe writes only the MCP launch. The retrieval-quality, index-speed and token-count figures on the project page (`#benchmarks`, `assets/images/*.png`) are upstream's own measurements and were not reproduced. The smoke check completed `initialize` (server `semble`, version `0.7.3`, protocol `2025-11-25`) and listed 2 tools (`search`, `find_related`); no query was run, no index outside the working directory was built, and neither the CLI, the sub-agent nor the skill was installed. +- **archy:** [Architecture assertions over the Python import graph](https://github.com/hslee16/Archy) — what an edit reaches, which tests it affects, where the cycles are, how coupled the modules are and whether the graph still agrees with the layers the project declared — exposed twice: a CLI whose `check` exits non-zero (usable in CI and pre-commit) and a stdio MCP server a session can call before it commits. Analysis is static, so it needs no interpreter run, no database and no test execution, and it writes no state into the project. It fills the lane the other Python checkers leave open: `ruff` and `ty`/`pyright` cover style, types and imports inside a file, while transitive reach and import direction are only visible against a declaration the project supplies. Upstream is explicit about the boundary — it is not a code-navigation tool, and that lane stays with `serena`, `lsp-mcp-server` and the descriptive graph entries — and it publishes its own negative results in `docs/WHAT_DIDNT_WORK.md`: across 25 unaided agent runs on the riskiest SWE-bench tasks no run introduced a cycle or a declared-layer violation (95% upper bound 12%), and 0.5% of 1,072 human commits did, which is why the README retracts the "agents will rot your import graph" premise rather than selling it. Recorded from a young repository (8 stars, last pushed 2026-11-12) whose CI, install e2e workflow, `docs/SCORING.md`, Claude Code marketplace manifest, bundled `skills/archy` skill and GitHub Action were read, not audited. The smoke check completed `initialize` (server `archy`, version `0.55.1`, protocol `2025-11-25`) and listed 14 tools (`archy_check`, `archy_impact`, `archy_cycles`, `archy_graph`, `archy_dsm`, `archy_conventions`, `archy_brief`, `archy_score` and the rest); no tool was called, so no project beyond the one-file sample was analysed, no layer configuration was written, and the `contracts` extra (import-linter) was not installed. +- **acumen:** [Skills that are built and scored, not just reviewed](https://github.com/scverse/acumen) — the generating counterpart of the auditing tools already recorded (`skillevaluator`, `skillsaw`, `skillspector`): it scaffolds a configuration and a task set for one Python package, runs coding agents against the training split, rewrites the package's `SKILL.md` from the failures that were measured, and evaluates each new version on held-out validation tasks. It is reference-only because the delivered unit is that harness rather than one skill directory, rule pack, MCP server or bridge: using it means owning a driver model, an agent CLI, task data and throwaway environments for the target project, and the package is young (PyPI `0.0.2`, Python >=3.12) with its method, configuration and validation split documented on Read the Docs. It comes from the same upstream as the Python scientific tooling this catalog already references (`pytest`, `hypothesis`). Nothing was installed, no agent was run and no skill was rewritten. diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index 48b34a8..05b48be 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -198,6 +198,20 @@ Rejected candidates in this pass fell into three groups. Duplicative or aggregat No entry was executed in this pass. The installable addition was verified by downloading and hashing its pinned archive; the four references were recorded from repository metadata, upstream documentation, package metadata and license files only. Nothing was installed, no search or rewrite was run, no plugin was activated, no security campaign was started, and no index was built. +## Candidate review on 2026-11-12 + +A further daily pass over recently active coding-agent skills, MCP servers and Python/web tooling added three entries after de-duplication against the previous 116: two configurable MCP servers (`MinishLab/semble`, `hslee16/Archy`) and one reference-only entry (`scverse/acumen`). + +`semble` is a code-search server whose mechanism differs from every index already recorded: the index is built by static embeddings on CPU with no GPU and no external service, so it can be rebuilt per session instead of being kept in the project the way `chunkhound` and `codebase-memory-mcp` keep theirs, and it answers with ranked snippets rather than the tree-sitter graph `code-review-graph` builds, the single packed file `repomix` produces, or the agent-written map `aoci-code` maintains. Delivery is a stdio MCP server behind the documented `semble[mcp]` extra, and upstream's installer offers four modes — MCP configuration, `AGENTS.md`/`CLAUDE.md` instructions, a `semble-search` sub-agent, or a `semble` skill plus a one-line pointer; the recipe records only the MCP launch. The retrieval-quality, index-speed and token-count figures on the project page are upstream's own measurements and were not reproduced. The smoke check completed `initialize` (server `semble`, version `0.7.3`, protocol `2025-11-25`) and listed 2 tools (`search`, `find_related`). + +`archy` covers the Python architecture question the other checkers in this catalog leave open: what an edit reaches transitively, which tests it affects, where the cycles are, how coupled the modules are and whether the import graph still agrees with the layers a project declared. It answers over an MCP server (14 tools) and over a CLI whose `check` exits non-zero, so an agent can ask before committing and CI can gate on the same graph. Upstream is explicit that it is not a code-navigation tool and publishes its own negative results in `docs/WHAT_DIDNT_WORK.md`: across 25 unaided agent runs on the riskiest SWE-bench tasks no run introduced a cycle or a declared-layer violation (95% upper bound 12%) and 0.5% of 1,072 human commits did, which is why the README retracts the "agents will rot your import graph" premise instead of selling it. It was recorded from a young repository (8 stars, last pushed 2026-11-12) whose CI, install end-to-end workflow, `docs/SCORING.md`, `server.json` MCP-registry metadata, bundled `skills/archy` skill and GitHub Action were read rather than audited. The smoke check completed `initialize` (server `archy`, version `0.55.1`, protocol `2025-11-25`) and listed 14 tools, none of which was called. + +`acumen` is the generating counterpart of the auditing tools already recorded (`skillevaluator`, `skillsaw`, `skillspector`): it scaffolds a configuration and task set for one Python package, runs coding agents against the training split, rewrites that package's `SKILL.md` from the failures measured, and scores each version on held-out validation tasks. It is reference-only because the delivered unit is that harness rather than one skill directory, rule pack, MCP server or bridge — using it means owning a driver model, an agent CLI, task data and throwaway environments for the target project — and because the package is young (PyPI `0.0.2`, Python >=3.12) with the method, configuration and validation split documented on Read the Docs. It comes from the same upstream as the Python scientific tooling this catalog already references. + +Rejected candidates in this pass fell into three groups. Duplicative lanes, where a second entry would add an entry point without adding a mechanism: `colbymchenry/codegraph` (77,476 stars, MIT, TypeScript, last pushed 2026-11-01), a pre-indexed code knowledge graph against the recorded `code-review-graph`, `codebase-memory-mcp` and `aoci-code`; `xerj-org/xerj` (18,943 stars, Apache-2.0, Rust), whose MCP surface is a client over a search-engine product the recorded code-search entries already cover; `wlsdks/ontology-atlas` (154 stars, MIT, pushed the same day), an agent-maintained Markdown ontology committed to Git, which is the mechanism `aoci-code` was recorded for yesterday; `Qiuner/birdview` (687 stars, MIT, pushed the same day), an architecture map before every change with no CLI exit contract or MCP server a project can pin; `dyoshikawa/rulesync` (1,600 stars, MIT, pushed the same day) in the agent-configuration lane already held by `ruler` and `ai-rulez`; `feder-cr/invisible_playwright_mcp` (879 stars, MIT, last pushed 2026-10-21), a third browser server after `playwright` and `seleniumbase`, where anti-bot evasion is a policy decision rather than a missing capability; `athola/claude-night-market` (350 stars, MIT, Python, pushed 2026-11-11), a third plugin marketplace after `claude-plugins-official` and `trailofbits/skills` with no single revision to pin; and `gts360/django-mcp-server` (387 stars, MIT, last pushed 2026-03-10), a library an application adds to expose its own Django models, in the ORM lane already held by `orm-lens`. Below the activity bar while the daily pass looks for recently active projects: `giuseppe-trisciuoglio/developer-kit` (370 stars, MIT, last pushed 2026-09-10), a plugin marketplace. Failed the admission criteria on license or remit: `KnockOutEZ/wigolo` (5,540 stars, pushed the same day) with no detectable SPDX license (`NOASSERTION`) for a local-first search/fetch/crawl server, and `EverMind-AI/SkillCorpus` (703 stars, Apache-2.0, Python, pushed the same day), skill-corpus and retrieval infrastructure whose useful product is a hosted service plus model checkpoints rather than a unit a project configures, in the discovery lane already covered by `skills-cli` and the two marketplaces. + +Both MCP servers were exercised with the repository's own smoke script against a one-file temporary project; nothing was queried, no repository beyond it was indexed, no graph or layer configuration was written, no test or check was run, and nothing was installed into any project. `acumen` was recorded from repository and package metadata, its documentation and license only; no harness was created and no agent was run. + ## Installable upstream evidence | Item | Evidence checked | Result | @@ -228,6 +242,8 @@ The six skill/rule source archives were downloaded from `codeload.github.com` at | Squirrelscan MCP | [Repository README](https://github.com/squirrelscan/squirrelscan/blob/main/README.md), [CLI `mcp` command](https://github.com/squirrelscan/squirrelscan/blob/main/apps/cli/src/cli/commands/mcp.ts), [npm package](https://www.npmjs.com/package/squirrelscan/v/0.0.173), [license](https://github.com/squirrelscan/squirrelscan/blob/main/LICENSE) | Published `0.0.173`; the package declares Node.js `>=18` and one `squirrel` binary whose `mcp` subcommand starts the local stdio server, which is exactly what the smoke check launched. Upstream also documents a hosted HTTP endpoint (`https://mcp.squirrelscan.com/mcp`) and a plugin-marketplace route, both outside this recipe, and report, publish and comment scopes need the user's own account. Nothing was audited: no site was fetched, no report was written and no MCP tool was called. | | Retentioneering skill | [Pinned skill tree](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics), repository metadata, root `LICENSE` (Apache-2.0), complete downloaded archive | The selected directory exists at the pin with five entries (`SKILL.md`, `references/api-map.md`, `references/analysis-recipes.md`, `references/gotchas-and-validation.md`, `scripts/inspect_event_log.py`), and every path `SKILL.md` refers to resolves inside that directory, including the bundled-reference table. The skill's own frontmatter carries `license: Apache-2.0` and states it needs Python >=3.11 with Retentioneering 5.x, which matches the repository's `pyproject.toml` (version 5.3.0). Archive SHA-256 `c0fe070c7ad6…` recorded in the manifest. Nothing was installed and no dataset was analysed. | +| Semble MCP | [Repository README](https://github.com/MinishLab/semble/blob/main/README.md), [installation guide](https://github.com/MinishLab/semble/blob/main/docs/installation.md), [package metadata and extras](https://github.com/MinishLab/semble/blob/main/pyproject.toml), [PyPI version metadata](https://pypi.org/project/semble/0.7.3/), [license](https://github.com/MinishLab/semble/blob/main/LICENSE) | Published `0.7.3`; `pyproject.toml` declares Python `>=3.10` and the `mcp` extra requires `mcp>=2.0,<3.0`, so the launcher pins `--python 3.12` (an unpinned `uvx` resolution on this host picks Python 3.9). Upstream documents `uvx --from "semble[mcp]" semble` as the stdio server and the corresponding `claude mcp add semble …` form for the client configuration; the smoke check discovered 2 tools (`search`, `find_related`). Upstream's installer additionally writes instruction-file blocks, a `semble-search` sub-agent and a `semble` skill, and the first run downloads the embedding model and tree-sitter grammars; this recipe performs none of that and no query was run. | +| Archy MCP | [Repository README](https://github.com/hslee16/Archy/blob/main/README.md), [MCP registry metadata](https://github.com/hslee16/Archy/blob/main/server.json), [PyPI version metadata](https://pypi.org/project/archy/0.55.1/), [published results and retractions](https://github.com/hslee16/Archy/blob/main/docs/WHAT_DIDNT_WORK.md), [license](https://github.com/hslee16/Archy/blob/main/LICENSE) | Published `0.55.1`; the package declares Python `>=3.10` and carries `mcp>=1.28.1,<3` as a base dependency, so the launcher pins `--python 3.12` and needs no `--with` override. Upstream documents `archy mcp` as the stdio server, which `server.json` also records for the package registry, and the CLI's `check` as the CI entry point. Analysis is static over the directory the server starts in, writes no state and needs no interpreter run or test execution; the smoke check discovered 14 tools and called none of them, so no project other than the temporary one was analysed. | ## Why some tools are reference-only @@ -364,6 +380,15 @@ On **2026-11-09**, the pinned `squirrelscan` launcher was checked the same way, The package installs one `squirrel` binary (`npx -y squirrelscan@0.0.173 mcp` starts its stdio server). The negotiated protocol was 2025-11-25 and the discovered tools were `audit_website`, `quick_check`, `get_report`, `list_audits`, `list_issues`, `get_issue`, `comment_on_issue`, `list_rules`, `get_rule`, `list_entities`, `get_entity`, `get_entity_graph`, `compare_entities`, `get_entity_findings` and `send_feedback`. No tool was invoked, so no site was fetched, no audit ran, no report was written and no account was used. +On **2026-11-12**, the same script checked the two MCP servers added that day (Python `3.12.13`, SDK `2.3.0`). Both negotiated protocol **2025-11-25**. + +| Package pin | Reported server version | Tools discovered | Result | +| --- | --- | ---: | --- | +| `semble[mcp]==0.7.3` (`semble`) | `0.7.3` | 2 | Passed | +| `archy==0.55.1` (`archy mcp`) | `0.55.1` | 14 | Passed | + +`semble` reported itself as `semble` and exposed `search` and `find_related`; `archy` reported itself as `archy` and exposed `archy_score`, `archy_cycles`, `archy_check`, `archy_impact`, `archy_snapshot`, `archy_diff`, `archy_simulate`, `archy_graph`, `archy_what_to_refactor_next`, `archy_dsm`, `archy_duplicates`, `archy_conventions`, `archy_module_view` and `archy_brief`. Both servers analyse the directory they are started in, so this run was scoped to the one-file temporary project the script creates: no query was run, no index or graph beyond it was built, no layer configuration was written and no test or check was executed. The `semble` launcher pins `--python 3.12` (the package requires >=3.10 while an unpinned resolution on this host picks Python 3.9) and takes the documented `mcp` extra, which caps `mcp<3.0`; the first run of that server downloads the embedding model and tree-sitter grammars, which is why it is checked with a 300-second timeout rather than the script's 90-second default. The `archy` launcher pins the same Python for the same reason; `mcp>=1.28.1,<3` is a base dependency, so no `--with` override is needed. + Reproduce with `uv run --no-project --python 3.12 --with mcp==2.3.0 python scripts/smoke_mcp.py`. The optional script uses a 90-second timeout per server and a temporary npm cache. It forwards only network proxy/CA settings in addition to the SDK's default subprocess environment. Initial attempts on this host exposed missing proxy forwarding and SDK 2.x field-name changes in the smoke helper; the recorded results are from clean reruns after fixing both. ### Serena bridge smoke result diff --git a/src/awesome_python_dev/data/catalog.json b/src/awesome_python_dev/data/catalog.json index d20e87b..16afa6a 100644 --- a/src/awesome_python_dev/data/catalog.json +++ b/src/awesome_python_dev/data/catalog.json @@ -1,6 +1,6 @@ { "schema_version": 2, - "reviewed_at": "2026-11-11", + "reviewed_at": "2026-11-12", "tools": [ { "id": "systematic-debugging", @@ -3140,6 +3140,115 @@ "notes": "Reference only because the delivered unit is a Go binary that starts a local MCP server a project registers itself: `.goreleaser.yml`, `docs/` (22 entries) and `spec/` (the index grammar) describe the release binaries and the file format, and the README documents the agent-written index (`aoci.txt`, `aoci.code.txt`, `aoci.meta.txt`) committed next to the code and updated through the server's 9 tools as work lands, with the badge still marking v0.2.0-rc1. It is recorded in `mcp-ecosystem` next to `codebase-memory-mcp`, `chunkhound`, `powercontext` and `code-review-graph` for the same problem — a repository an agent should not re-read on every task — with a different mechanism: one model-written line per file, versioned by Git and re-verified against the tree instead of retrieved by embedding. License caveat recorded with the entry: the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`, FSL-1.1-MIT; the GitHub API reports `NOASSERTION` because the header is adapted), which permits non-competing use and converts to MIT later, so no text from `spec/` or `docs/` is copied into this repository and the entry stays reference-only. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS` and `THIRD-PARTY-NOTICES` files plus a Glama listing. Evidence read in this pass: repository metadata, both READMEs, README.zh-CN.md, the root tree listing, the `docs/` and `spec/` listings and `LICENSE`. Nothing was installed and no index was built.", "repository": "aoci-spec/aoci-code", "stars": 1897 + }, + { + "archived": false, + "category": "mcp-ecosystem", + "checked_at": "2026-11-12", + "description": "Answer code questions from a local CPU-only repository index that returns ranked snippets instead of making the agent grep and read whole files, over an MCP server, a CLI, an agent skill or a sub-agent.", + "evidence": [ + "https://api.github.com/repos/MinishLab/semble", + "https://github.com/MinishLab/semble/blob/main/README.md", + "https://github.com/MinishLab/semble/blob/main/docs/installation.md", + "https://github.com/MinishLab/semble/blob/main/pyproject.toml", + "https://github.com/MinishLab/semble/blob/main/src/semble/mcp.py", + "https://pypi.org/project/semble/0.7.3/", + "https://github.com/MinishLab/semble/blob/main/LICENSE" + ], + "homepage": "https://minish.ai/packages/semble/introduction/", + "id": "semble", + "install": { + "type": "mcp", + "command": "uvx", + "args": [ + "--python", + "3.12", + "--from", + "semble[mcp]==0.7.3", + "semble" + ], + "requirements": [ + "uvx" + ], + "version": "0.7.3", + "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); the `mcp` extra requires mcp>=2.0,<3.0; the server indexes the directory it is started in, and the first run downloads the embedding model and the tree-sitter grammars" + }, + "kind": "mcp", + "last_pushed_at": "2026-11-08T08:23:11Z", + "license": "MIT", + "name": "Semble", + "notes": "Installable because the distribution ships a stdio MCP server behind a documented extra: upstream configures clients as `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble` (the `mcp` extra caps `mcp<3.0`), and in this pass that exact command passed `initialize` and `tools/list` through the Python MCP SDK before any tool was called. Recorded in `mcp-ecosystem` next to `chunkhound`, `codebase-memory-mcp`, `repomix`, `aoci-code` and `code-review-graph` as a different retrieval mechanism for the same problem — a repository an agent should not re-read per task: static embeddings and reranking on CPU, no GPU, no API key and no external service, so the index is cheap enough to rebuild instead of cached in the project. The package offers four delivery modes from one installer (`semble install` writes MCP configuration, AGENTS.md/CLAUDE.md instructions, a `semble-search` sub-agent, or a `semble` skill plus a one-line pointer); this recipe records only the MCP launch, and no instruction file, sub-agent or skill is written by this catalog. Retrieval-quality, index-speed and token-count figures in the README (`#benchmarks`, `assets/images/*.png`) are upstream's own measurements and were not reproduced here. Evidence read in this pass: repository metadata, README, `docs/installation.md`, `pyproject.toml`, `src/semble/` layout (`mcp.py`, `search.py`, `agents/`), PyPI 0.7.3 metadata and `LICENSE` (MIT). No query was run beyond the smoke check and no index outside the working directory was built.", + "repository": "MinishLab/semble", + "stars": 6403 + }, + { + "archived": false, + "category": "python-toolchain", + "checked_at": "2026-11-12", + "description": "Turn a Python import graph into assertions an agent and CI can both fail on: what an edit reaches, which tests it affects, where the cycles are, and whether the graph still agrees with the layers the project declared.", + "evidence": [ + "https://api.github.com/repos/hslee16/Archy", + "https://github.com/hslee16/Archy/blob/main/README.md", + "https://github.com/hslee16/Archy/blob/main/server.json", + "https://github.com/hslee16/Archy/blob/main/docs/WHAT_DIDNT_WORK.md", + "https://github.com/hslee16/Archy/blob/main/skills/archy/SKILL.md", + "https://github.com/hslee16/Archy/blob/main/src/archy/mcp.py", + "https://github.com/hslee16/Archy/blob/main/pyproject.toml", + "https://pypi.org/project/archy/0.55.1/", + "https://github.com/hslee16/Archy/blob/main/LICENSE" + ], + "homepage": "https://github.com/hslee16/Archy", + "id": "archy", + "install": { + "type": "mcp", + "command": "uvx", + "args": [ + "--python", + "3.12", + "--from", + "archy==0.55.1", + "archy", + "mcp" + ], + "requirements": [ + "uvx" + ], + "version": "0.55.1", + "runtime": "uv/uvx; Python 3.12 pinned for the launcher (the package requires >=3.10 while this host's system Python is 3.9); `mcp>=1.28.1,<3` is a base dependency; the server analyses the import graph of the directory it is started in and writes no state there" + }, + "kind": "mcp", + "last_pushed_at": "2026-11-12T15:30:46Z", + "license": "MIT", + "name": "Archy", + "notes": "Installable because the same graph is exposed twice, and the second surface is a documented stdio MCP server: upstream records `mcp` as the package argument in `server.json` and in the README's install section, and in this pass `uvx --python 3.12 --from archy==0.55.1 archy mcp` passed `initialize` and `tools/list` through the Python MCP SDK. Python-only and static: it parses imports, so it needs no interpreter run, no database and no test execution to answer blast radius, affected tests, cycles, coupling and layer agreement, and `check` exits non-zero on a violation, which is what makes it usable both in a session and in CI. It fills a lane this catalog was missing: `ruff`, `ty` and `pyright` cover style, types and imports at file scope, while this answers transitive reach and direction against layers the project declares. Upstream is unusually explicit about what it is not — a code-navigation tool; that lane stays with `serena`, `lsp-mcp-server` and the descriptive graph tools — and it publishes its negative results (0 of 25 unaided agent runs on the riskiest SWE-bench tasks introduced a cycle or a declared-layer violation, upper bound 12%; 0.5% of 1,072 human commits did), which is why its own README retracts the 'agents will rot your import graph' premise in `docs/WHAT_DIDNT_WORK.md`. Recorded from a young repository (8 stars on 2026-11-12) whose CI, e2e install workflow, scoring documents, Claude Code marketplace manifest, bundled `skills/archy` skill and GitHub Action were read rather than audited. Evidence read in this pass: repository metadata, README, `server.json`, `docs/SCORING.md`, `docs/WHAT_DIDNT_WORK.md`, the `src/archy/` module list, PyPI 0.55.1 metadata and `LICENSE` (MIT). No project beyond the smoke check was analysed, no layer configuration was written and the `contracts` extra (import-linter) was not installed.", + "repository": "hslee16/Archy", + "stars": 8 + }, + { + "archived": false, + "category": "skill-ecosystem", + "checked_at": "2026-11-12", + "description": "Build, benchmark and optimise an agentic skill for a Python package by running coding agents against training tasks, rewriting the skill from the errors they make, and scoring each version on held-out validation tasks.", + "evidence": [ + "https://api.github.com/repos/scverse/acumen", + "https://github.com/scverse/acumen/blob/main/README.md", + "https://github.com/scverse/acumen/blob/main/docs/getting_started.md", + "https://github.com/scverse/acumen/blob/main/docs/index.md", + "https://github.com/scverse/acumen/tree/main/src/acumen", + "https://github.com/scverse/acumen/blob/main/pyproject.toml", + "https://pypi.org/project/acumen/0.0.2/", + "https://github.com/scverse/acumen/blob/main/LICENSE" + ], + "homepage": "https://acumen-skills.readthedocs.io/", + "id": "acumen", + "install": null, + "kind": "reference", + "last_pushed_at": "2026-11-12T15:30:12Z", + "license": "MIT", + "name": "Acumen", + "notes": "Reference only because the delivered unit is a project harness rather than a skill, rule pack, MCP server or bridge: `acumen init` scaffolds a configuration and a task set for one target package, the run executes coding agents against the training split, the rewrite step edits the package's `SKILL.md` from the measured failures, and the score step evaluates the new version on held-out validation tasks — so using it means owning a driver model, an agent CLI, task data and throwaway environments for the target project. It is recorded in `skill-ecosystem` next to `skillevaluator` and `agent-skills` as the generating counterpart of the auditing tools this catalog already had: those measure or review a skill that exists, this one produces and optimises it and reports the score per version. Same upstream as the Python scientific tooling already recorded (`pytest`, `hypothesis`); the package is young (PyPI 0.0.2, Python >=3.12) and documents its own method, configuration and validation split on Read the Docs. Evidence read in this pass: repository metadata, README, `docs/` (index and getting-started), the `src/acumen/` layout, `pyproject.toml`, PyPI metadata and `LICENSE` (MIT). Nothing was installed, no agent was run and no skill was rewritten.", + "repository": "scverse/acumen", + "stars": 20 } ], "profiles": {