feat(catalog): daily candidate scan 2026-11-12

CHANGELOG.md

@@ -291,6 +291,24 @@ Catalogue additions from the 2026-11-11 candidate review.
 - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were
   updated in the same change.
 
+Catalogue additions from the 2026-11-12 candidate review.
+
+- Two installable MCP servers, both smoke-checked through
+  `scripts/smoke_mcp.py`: `MinishLab/semble` (pinned
+  `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble`, 2 tools discovered;
+  CPU-only code search, recorded in `mcp-ecosystem`) and `hslee16/Archy`
+  (pinned `uvx --python 3.12 --from archy==0.55.1 archy mcp`, 14 tools
+  discovered; Python import-graph architecture assertions, recorded in
+  `python-toolchain`).
+- One reference-only entry: `scverse/acumen`, harness and scoring method for
+  building an agentic skill for a Python package, recorded in
+  `skill-ecosystem`.
+- The catalog now holds 119 entries: 51 installable resources (24 skills, 6 rule
+  packs, 19 MCP servers, and 2 LSP bridges) and 68 references. Profiles and rule
+  dependencies are unchanged; no launcher or installer behaviour was touched.
+- `docs/CATALOG.md`, `docs/RESEARCH.md`, and both READMEs were updated in the
+  same change.
+
 ## npm shell 0.1.1 — 2026-10-28
 
 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads,

README.md

@@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta
 
 The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**.
 
-The repository catalog includes **116 entries**: **49 installable resources** (24 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **67 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 51 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
+The repository catalog includes **119 entries**: **51 installable resources** (24 skills, 6 rule packs, 19 MCP servers, and 2 LSP bridges) and **68 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 52 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
 
 ## Contents
 

README.zh-CN.md

@@ -17,7 +17,7 @@
 
 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。
 
-仓库目录收录 **116 个条目**：**49 个可安装资源**（24 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **67 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、51 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
+仓库目录收录 **119 个条目**：**51 个可安装资源**（24 个 skills、6 套规则、19 个 MCP servers、2 个 LSP 桥接），以及 **68 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、52 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
 
 ## 目录
 

docs/CATALOG.md

@@ -1,6 +1,6 @@
 # Curated catalog / 精选目录
 
-Reviewed **2026-11-11**, catalog schema **2**. **116 entries**, with **49 installable/configurable integrations** and **67 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references.
+Reviewed **2026-11-12**, catalog schema **2**. **119 entries**, with **51 installable/configurable integrations** and **68 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 19 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references.
 
 Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status.
 
@@ -129,6 +129,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`mcp-context-forge`](https://github.com/IBM/mcp-context-forge) | Federate MCP, A2A and REST/gRPC servers behind one governed endpoint with a registry, virtual servers, auth, rate limiting, and an admin UI. | Reference only | 4,752 | Apache-2.0 |
 | [`powercontext`](https://github.com/oceanbase/powercontext) | Server-side memory, handoff and experience layer for coding agents, exposed as an HTTP contract with a Python client, CLI, dashboard and a curated MCP projection over revisioned artifacts. | Reference only | 1,575 | Apache-2.0 |
 | [`aoci-code`](https://github.com/aoci-spec/aoci-code) | Keep a Git-versioned, agent-written map of a repository's code, configuration, tests and database schema through a local Go MCP server, so an agent reads the index instead of re-reading the tree. | Reference only | 1,897 | FSL-1.1-MIT |
+| [`semble`](https://github.com/MinishLab/semble) | Answer code questions from a CPU-only repository index instead of grepping and reading files, over MCP (`search`, `find_related`), a CLI, an agent skill or a sub-agent. | Configure MCP | 6,403 | MIT |
 
 ## Language intelligence and LSP
 
@@ -191,6 +192,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`misata`](https://github.com/rasinmuhammed/misata) | Declare the facts a dataset must hold and get multi-table synthetic test rows over MCP, with a certificate a DuckDB run re-checks, next to a CLI and a pytest plugin. | Configure MCP | 75 | MIT |
 | [`mustel`](https://github.com/mustel-py/mustel) | Run Ruff, Bandit, Oxlint and pip-audit over MCP for the project it is launched in, with a compressed AST code map and an audit mode for dependency vulnerabilities. | Configure MCP | 19 | MIT |
 | [`ast-grep`](https://github.com/ast-grep/ast-grep) | Search, lint and rewrite code by AST pattern instead of text, over tree-sitter grammars including Python, installed as the `ast-grep-cli` package in a project environment. | Reference only | 16,554 | MIT |
+| [`archy`](https://github.com/hslee16/Archy) | Assert Python architecture on the import graph — blast radius, affected tests, cycles, coupling and declared layers — as a CLI that exits non-zero and an MCP server a session can call before committing. | Configure MCP | 8 | MIT |
 
 ## Building MCP integrations
 
@@ -235,6 +237,8 @@ Skill and rule archives are pinned to full commits and verified against a record
 | `dbhub` | `npx -y @bytebase/dbhub@1.5.1 --transport stdio --demo` | Node.js >=22.5 for the built-in `node:sqlite`; `--demo` serves the bundled sample SQLite database and is replaced by `--dsn` for a real database |
 | `mustel` | `uvx --python 3.12 --with mcp<2 --from mustel==0.3.4 mustel serve` | uv/uvx; Python 3.12 pinned (the package needs >=3.10 while this host's system Python is 3.9); published `0.3.4` leaves `mcp` uncapped, so the recipe adds `--with mcp<2`; the server analyses the directory it starts in, and its `bootstrap` tool is never called |
 | `squirrelscan` | `npx -y squirrelscan@0.0.173 mcp` | Node.js >=18; the audit fetches the target site over HTTP, so the server needs network access and an explicit site per call; the hosted endpoint and the signed-in report scopes need the user's own account |
+| `semble` | `uvx --python 3.12 --from 'semble[mcp]==0.7.3' semble` | uv/uvx; Python 3.12 pinned; the `mcp` extra caps `mcp<3.0`; the server indexes the directory it starts in, and the first run downloads the embedding model and grammars |
+| `archy` | `uvx --python 3.12 --from archy==0.55.1 archy mcp` | uv/uvx; Python 3.12 pinned; static import analysis of the directory it starts in, no state written and no test run |
 
 - **Context7:** API keys are optional in the pinned stdio package guidance for higher limits/private repositories. Service access and policy can change independently of the package version. Configure credentials through the chosen agent; do not commit secrets.
 - **Playwright:** A supported browser is needed for browser operations. Configuring the server does not install browser binaries.
@@ -311,3 +315,6 @@ See [research and verification evidence](RESEARCH.md), [ECC migration details](E
 - **mantis:** [Agentic vulnerability research as an orchestrated method](https://github.com/google/mantis) rather than another scanner: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-history`, `mantis-structural-index`, `mantis-plan`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-reflect`, `mantis-report`, `mantis-advise` and the rest) and `reference/` is a Google ADK harness that runs the same pipeline over a target checkout, with a second copy of the method inside the harness and an `action/` variant for pull requests. It stays reference-only because the useful unit is that collection plus a harness needing a model provider (Vertex AI or an API key) and a target repository, not one pinnable skill directory an installer can copy — and because upstream states that findings and patches produced this way must be verified by a security expert before being reported and that the pull-request scan is untested end to end and must not gate merges. Recorded in `security` next to `trailofbits-skills` as the orchestration layer in front of the scanners already listed there. Nothing was installed, no campaign was run and no code was scanned.
 - **retentioneering:** Product analytics where this catalog previously had schema and migration tooling but no lane for user behaviour. `SKILL.md` plus its bundled `references/` (analysis recipes, API map, gotchas and validation) and `scripts/inspect_event_log.py` take an agent from user-level event logs to paths, transitions, funnels, segments, retention, step matrices and sequence patterns, and every path the skill names resolves inside its own directory, so the pinned archive recipe copies a working unit. It is the only installable addition in this pass; the same repository also publishes the `retentioneering` Python package (5.3.0, Python >=3.11) and an MCP server that the skill calls, and the recipe installs only the skill, so the environment it analyses data in still needs the library. Nothing was installed and no dataset was analysed.
 - **aoci-code:** A [local-first Go MCP server](https://github.com/aoci-spec/aoci-code) that keeps the agent's own map of a repository — one line per file in `aoci.txt`, with `aoci.code.txt` and `aoci.meta.txt` alongside, committed to Git and re-verified against the tree as work lands — so an agent reads the index instead of re-reading the codebase; it is the same problem `codebase-memory-mcp`, `chunkhound` and `code-review-graph` address by indexing for retrieval, with a file the model writes and Git versions instead. It is reference-only because delivery is a release binary (`go.mod`, `Makefile`, `cmd/`, `engine/`, `internal/`, `.goreleaser.yml`) that a project registers itself, and because the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`; the GitHub API reports `NOASSERTION` for the adapted header), which permits non-competing use today and converts to MIT later — a second reason nothing from its `spec/`, `docs/` or `AGENTS.md` text is copied into this repository. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS`, `THIRD-PARTY-NOTICES`, a Glama listing and bilingual READMEs. Nothing was installed and no index was built.
+- **semble:** [Local code search built for agents](https://github.com/MinishLab/semble), delivered as a stdio MCP server behind the documented `semble[mcp]` extra, so an agent asks a question in natural language and gets ranked snippets back instead of grepping and reading whole files. Everything runs on CPU: no GPU, no API key and no external service, which is what makes rebuilding an index cheaper than caching one inside the project — the mechanism that separates it from `chunkhound` and `codebase-memory-mcp` (embedding index kept in the project), `code-review-graph` (tree-sitter graph), `repomix` (one packed file) and `aoci-code` (agent-written map). One installer offers four delivery modes — MCP configuration, `AGENTS.md`/`CLAUDE.md` instructions, a `semble-search` sub-agent, or a `semble` skill plus a one-line pointer — and this recipe writes only the MCP launch. The retrieval-quality, index-speed and token-count figures on the project page (`#benchmarks`, `assets/images/*.png`) are upstream's own measurements and were not reproduced. The smoke check completed `initialize` (server `semble`, version `0.7.3`, protocol `2025-11-25`) and listed 2 tools (`search`, `find_related`); no query was run, no index outside the working directory was built, and neither the CLI, the sub-agent nor the skill was installed.
+- **archy:** [Architecture assertions over the Python import graph](https://github.com/hslee16/Archy) — what an edit reaches, which tests it affects, where the cycles are, how coupled the modules are and whether the graph still agrees with the layers the project declared — exposed twice: a CLI whose `check` exits non-zero (usable in CI and pre-commit) and a stdio MCP server a session can call before it commits. Analysis is static, so it needs no interpreter run, no database and no test execution, and it writes no state into the project. It fills the lane the other Python checkers leave open: `ruff` and `ty`/`pyright` cover style, types and imports inside a file, while transitive reach and import direction are only visible against a declaration the project supplies. Upstream is explicit about the boundary — it is not a code-navigation tool, and that lane stays with `serena`, `lsp-mcp-server` and the descriptive graph entries — and it publishes its own negative results in `docs/WHAT_DIDNT_WORK.md`: across 25 unaided agent runs on the riskiest SWE-bench tasks no run introduced a cycle or a declared-layer violation (95% upper bound 12%), and 0.5% of 1,072 human commits did, which is why the README retracts the "agents will rot your import graph" premise rather than selling it. Recorded from a young repository (8 stars, last pushed 2026-11-12) whose CI, install e2e workflow, `docs/SCORING.md`, Claude Code marketplace manifest, bundled `skills/archy` skill and GitHub Action were read, not audited. The smoke check completed `initialize` (server `archy`, version `0.55.1`, protocol `2025-11-25`) and listed 14 tools (`archy_check`, `archy_impact`, `archy_cycles`, `archy_graph`, `archy_dsm`, `archy_conventions`, `archy_brief`, `archy_score` and the rest); no tool was called, so no project beyond the one-file sample was analysed, no layer configuration was written, and the `contracts` extra (import-linter) was not installed.
+- **acumen:** [Skills that are built and scored, not just reviewed](https://github.com/scverse/acumen) — the generating counterpart of the auditing tools already recorded (`skillevaluator`, `skillsaw`, `skillspector`): it scaffolds a configuration and a task set for one Python package, runs coding agents against the training split, rewrites the package's `SKILL.md` from the failures that were measured, and evaluates each new version on held-out validation tasks. It is reference-only because the delivered unit is that harness rather than one skill directory, rule pack, MCP server or bridge: using it means owning a driver model, an agent CLI, task data and throwaway environments for the target project, and the package is young (PyPI `0.0.2`, Python >=3.12) with its method, configuration and validation split documented on Read the Docs. It comes from the same upstream as the Python scientific tooling this catalog already references (`pytest`, `hypothesis`). Nothing was installed, no agent was run and no skill was rewritten.