diff --git a/CHANGELOG.md b/CHANGELOG.md index dfbf624..603a9be 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,6 +24,21 @@ Catalogue additions from the daily candidate review. - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were updated in the same change. +Catalogue additions from the 2026-10-29 candidate review. + +- Two installable MCP servers, both smoke-checked through + `scripts/smoke_mcp.py`: `code-review-graph` (pinned + `uvx --from code-review-graph==2.3.9`, 30 tools discovered) and `mcp-tools-py` + (pinned `uvx --from mcp-tools-py==0.1.10 --with mcp<2`, 17 tools discovered; + Python lint, test, type, and refactor operations behind one project scope). +- Two reference-only entries: `codebase-memory-mcp`, a native code knowledge + graph whose npm/PyPI packages are installer wrappers, and `mcpls`, a Rust + MCP-to-LSP bridge over `rust-analyzer`, `pyright`, and `gopls`. +- The catalog now has 63 entries: 34 installable resources (22 skills, 6 rule + packs, 5 MCP servers, and Serena's bridge) and 29 references. +- `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were + updated in the same change. + ## npm shell 0.1.1 — 2026-10-28 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads, diff --git a/README.md b/README.md index f7e7334..f14b0e2 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**. -The repository catalog includes **59 entries**: **32 installable resources** (22 skills, 6 rule packs, 3 MCP servers, and Serena's LSP bridge) and **27 references** (agent-lsp, 8 native language servers, and 18 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. +The repository catalog includes **63 entries**: **34 installable resources** (22 skills, 6 rule packs, 5 MCP servers, and Serena's LSP bridge) and **29 references** (agent-lsp, mcpls, 8 native language servers, and 19 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime. ## Contents diff --git a/README.zh-CN.md b/README.zh-CN.md index a4f0a73..499d594 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -17,7 +17,7 @@ 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。 -仓库目录收录 **59 个条目**：**32 个可安装资源**（22 个 skills、6 套规则、3 个 MCP servers、1 个 Serena LSP 桥接），以及 **27 个参考条目**（agent-lsp、8 个原生语言服务、18 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 +仓库目录收录 **63 个条目**：**34 个可安装资源**（22 个 skills、6 套规则、5 个 MCP servers、1 个 Serena LSP 桥接），以及 **29 个参考条目**（agent-lsp、mcpls、8 个原生语言服务、19 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。 ## 目录 diff --git a/docs/CATALOG.md b/docs/CATALOG.md index 10acc17..0550b07 100644 --- a/docs/CATALOG.md +++ b/docs/CATALOG.md @@ -1,6 +1,6 @@ # Curated catalog / 精选目录 -Reviewed **2026-10-28**, catalog schema **2**. **59 entries**, with **32 installable/configurable integrations** and **27 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 3 MCP servers, and 1 MCP-to-LSP bridge. The 10 LSP entries comprise Serena, the reference-only agent-lsp bridge, and 8 standalone language-server references. +Reviewed **2026-10-29**, catalog schema **2**. **63 entries**, with **34 installable/configurable integrations** and **29 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 5 MCP servers, and 1 MCP-to-LSP bridge. The 11 LSP entries comprise Serena, the two reference-only bridges (agent-lsp, mcpls), and 8 standalone language-server references. Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status. @@ -94,9 +94,12 @@ Profiles select relevant tools instead of loading every available rule and frame | [`context7`](https://github.com/upstash/context7/tree/master/packages/mcp) | Retrieve library documentation and version-specific examples for coding tasks. | Configure MCP | 63,759 | MIT | | [`playwright`](https://github.com/microsoft/playwright-mcp) | Browser inspection and interactive web testing through accessibility snapshots. | Configure MCP | 38,702 | Apache-2.0 | | [`fetch`](https://github.com/modelcontextprotocol/servers/tree/main/src/fetch) | Retrieve web pages as text/Markdown for documentation and research. | Configure MCP | 91,599 | Apache-2.0 / MIT; docs CC-BY-4.0 | +| [`code-review-graph`](https://github.com/tirth8205/code-review-graph) | Serve a Tree-sitter code graph over MCP for review context, change impact, and affected-test hints. | Configure MCP | 32,459 | MIT | +| [`mcp-tools-py`](https://github.com/MarcusJellinghaus/mcp-tools-py) | Run pylint, pytest, mypy, Ruff, Bandit, formatting, and symbol refactors on a Python project through one scoped MCP server. | Configure MCP | 20 | MIT | | [`github-mcp`](https://github.com/github/github-mcp-server) | Official GitHub tools for repositories, issues, and pull requests. | Reference only | 33,999 | MIT | | [`chrome-devtools`](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Inspect browser performance, network activity, and runtime behavior. | Reference only | 54,261 | Apache-2.0 | | [`sequential-thinking`](https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking) | A reference server for structured problem-solving tool calls. | Reference only | 91,599 | Apache-2.0 / MIT; docs CC-BY-4.0 | +| [`codebase-memory-mcp`](https://github.com/DeusData/codebase-memory-mcp) | Local knowledge graph over code, documentation, configuration, and infrastructure for navigation and change impact. | Reference only | 47,734 | MIT | ## Language intelligence and LSP @@ -104,6 +107,7 @@ Profiles select relevant tools instead of loading every available rule and frame | --- | --- | --- | ---: | --- | | [`serena`](https://github.com/oraios/serena) | Expose semantic code navigation, references, diagnostics, and edits to coding agents through an MCP-to-LSP bridge. | Configure LSP bridge | 30,759 | GPL-3.0-or-later (application); MIT (SolidLSP) | | [`agent-lsp`](https://github.com/blackwell-systems/agent-lsp) | Orchestrate native language servers into batch, refactor, and speculative-edit workflows for coding agents. | Reference only | 166 | MIT | +| [`mcpls`](https://bug-ops.github.io/mcpls/) | Bridge MCP to rust-analyzer, pyright, gopls, and other language servers and expose 31 code tools to agents. | Reference only | 80 | MIT OR Apache-2.0 | | [`ruff`](https://docs.astral.sh/ruff/editors/) | Python linting, formatting, and the built-in Ruff language server for diagnostics and code actions. | Reference only | 50,317 | MIT | | [`pyright`](https://github.com/microsoft/pyright) | Python type checking and language-server support for navigation and diagnostics. | Reference only | 15,707 | MIT | | [`ty`](https://docs.astral.sh/ty/) | Rust-based Python type checker and language server with editor integrations; upstream labels it beta. | Reference only | 19,973 | MIT | @@ -161,13 +165,20 @@ Skill and rule archives are pinned to full commits and verified against a record | `playwright` | `npx -y @playwright/mcp@0.0.83` | Node.js >=18 | | `fetch` | `uvx mcp-server-fetch==2026.10.24` | Python >=3.10 | | `serena` | See [exact Serena command](LSP.md#install-the-lsp-bridge); v2.1.0 at `5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc` | uv/uvx + Git; Python 3.13 selected by uvx; language-specific dependencies | +| `code-review-graph` | `uvx --from code-review-graph==2.3.9 code-review-graph serve --repo {project}` | uv/uvx; Python >=3.10 selected by uvx | +| `mcp-tools-py` | `uvx --from mcp-tools-py==0.1.10 --with mcp<2 mcp-tools-py --project-dir {project}` | uv/uvx; Python >=3.11 selected by uvx; pylint/pytest/mypy for the checks | - **Context7:** API keys are optional in the pinned stdio package guidance for higher limits/private repositories. Service access and policy can change independently of the package version. Configure credentials through the chosen agent; do not commit secrets. - **Playwright:** A supported browser is needed for browser operations. Configuring the server does not install browser binaries. - **Fetch:** Requires uv/uvx and a compatible Python. No private-IP bypass is enabled by this recipe. - **Serena:** The project path is resolved into the MCP configuration. First startup may download language-server dependencies and create Serena-owned state. The installer does not manage or uninstall those upstream caches. See [language intelligence and setup](LSP.md). - **Native language servers:** Pyright, Python LSP Server, Ruff, TypeScript Language Server, gopls, rust-analyzer, and clangd remain reference-only. Their native LSP commands need an LSP client; they are not interchangeable with MCP servers. -- **agent-lsp:** A second, reference-only LSP bridge. It ships as a Go binary from an upstream install script, release archive, or container image, and requires the underlying language servers separately; there is no registry package or dependency version for this catalog to pin, so `apd` writes only the Serena recipe. +- **agent-lsp:** One of two reference-only LSP bridges besides Serena. It ships as a Go binary from an upstream install script, release archive, or container image, and requires the underlying language servers separately; there is no registry package or dependency version for this catalog to pin, so `apd` writes only the Serena recipe. +- **mcpls:** The other reference-only bridge. It is distributed as a Rust binary through `cargo install mcpls`, an upstream install script, release archives, or a container image, and needs at least one language server (for example pyright) installed separately. Enabling it next to Serena would give the same project two bridges over the same servers. +- **code-review-graph:** The project path is resolved into the MCP configuration and the server indexes it with Tree-sitter; graph data stays in a `.code-review-graph` directory inside the project. Building or refreshing the graph is an explicit CLI or tool step, and upstream `install` also writes hooks, skills, and rules files that this recipe does not touch. +- **mcp-tools-py:** A Python-only companion to the reference-only pytest, Ruff, and Bandit entries. Its `--with mcp<2` pin is deliberate: published `0.1.10` imports `mcp.server.fastmcp` without capping `mcp`, so the default mcp 2.x resolution fails at startup. The checks run through the server's own interpreter unless `--python-executable`/`--venv-path` is configured, so pylint, pytest, and mypy must exist in that environment. +- **codebase-memory-mcp:** The documented MCP entry points at an installed native executable, and the npm, PyPI, and Go packages of the same name only verify and cache that runtime for the host, so there is no registry launch command to pin. Its installer also writes agent configuration, rules, skills, and hooks and its indexing persists to a shared cache directory with an optional daemon, which is a broader change than writing one launch configuration. +- **Two code-graph servers overlap:** `code-review-graph` and `codebase-memory-mcp` both index a repository into a local graph for review and impact questions, with different runtimes and scope. Enable one per project rather than both. - **Conflict to resolve yourself:** `pyright` and `ty` are alternative Python type-checking servers, and `ruff server` covers lint/format diagnostics. Pick the servers your editor should run instead of enabling all of them. - **Test dependencies:** `hypothesis` is a project dependency next to `pytest`, not an MCP server or agent skill. Recording it neither adds nor runs tests and does not configure CI. - **agent-skills collection:** The two selected skills come from a larger, mostly single-file skill collection with its own plugin manifests and hooks. Only the pinned skill directories are copied; hooks, commands, and agent definitions stay upstream. diff --git a/docs/LSP.md b/docs/LSP.md index 359c9d0..2adfe9f 100644 --- a/docs/LSP.md +++ b/docs/LSP.md @@ -74,6 +74,12 @@ Ruff supplies lint and formatting capabilities. Pair it with a navigation/type s It is a Go binary installed by the upstream script, a release archive, or a container image. The project publishes no registry package or dependency revision for this catalog to pin, and it needs the underlying language servers installed separately, so `apd` keeps writing only the Serena recipe. Configuring a second bridge would also duplicate Serena's role in the `lsp` profile. Review its tool surface and install path upstream if that workflow fits your project. +## Another bridge: mcpls + +[mcpls](https://bug-ops.github.io/mcpls/) is catalogued as a second reference-only bridge next to agent-lsp. It runs language servers such as `rust-analyzer`, `pyright`, and `gopls` in one session and exposes their type information, references, diagnostics, and refactoring as 31 MCP tools over stdio or optional HTTP transport. + +It is a Rust binary distributed through `cargo install mcpls`, an upstream install script, release archives, or a container image, so there is no registry package revision for this catalog to pin; it also needs at least one language server installed separately. Like agent-lsp it stays a reference while `apd` writes only the Serena recipe. Use it when a project needs several of its supported language servers at once; otherwise an editor's native LSP setup already covers that work. + ## OpenCode's native LSP support OpenCode also has native LSP integration independently of Serena. Its current documentation says LSP is disabled by default and can be enabled in `opencode.json`: @@ -102,7 +108,7 @@ Select the intended scan scope and reviewed rule sets, pin dependencies in the p ## Verification recorded for this recipe -On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`. +On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`. The check made no `tools/call` requests and ended before language-server initialization completed. It verifies the package launch and MCP discovery path, not symbol correctness, every programming language, every operating system, or integration inside all five agent applications. diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index d0cc392..ffad9c0 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -1,6 +1,6 @@ # Research and provenance -Research date: **2026-10-28**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 22 skill entries come from four upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. +Research date: **2026-10-29**. Repository metadata was fetched with `gh api repos//`; package versions came from the npm and PyPI registries. The manifest records the snapshot date, repository stars, latest push timestamp, license, and source links. Stars belong to whole repositories: the 22 skill entries come from four upstream repositories, and the six ECC rule packs share the ECC repository snapshot. A high star count is not an independent quality score for every skill or rule. ## Patterns adopted @@ -14,7 +14,7 @@ Research date: **2026-10-28**. Repository metadata was fetched with `gh api repo ## Version 0.2 catalog expansion -Catalog schema 2 contains **59 entries** and **11 profiles**. Thirty-two entries have an installation recipe: **22 skills, 6 rule packs, 3 MCP servers, and the Serena MCP-to-LSP bridge**. The remaining 27 are references, including a second LSP bridge, eight native language servers, and four security scanners. +Catalog schema 2 contains **63 entries** and **11 profiles**. Thirty-four entries have an installation recipe: **22 skills, 6 rule packs, 5 MCP servers, and the Serena MCP-to-LSP bridge**. The remaining 29 are references, including two further LSP bridges, eight native language servers, and four security scanners. The expansion adds a reviewed subset of ECC for engineering standards, security review, Python/FastAPI/Django, TypeScript/React/Next.js, Spring Boot, Go, API design, migrations, and deployment guidance. Rule packs use explicit source-file allowlists, native language scopes, and shared-rule dependencies. They preserve upstream originals while activating a disclosed portable adaptation. See [ECC source selection and migration boundaries](ECC-MIGRATION.md). @@ -28,6 +28,16 @@ A search pass over GitHub for recently active coding-agent skills, MCP servers, Both new skills are single-directory skills whose `SKILL.md` is self-contained; the collection's plugin manifests, hooks, and commands are not installed, and the two entries share one archive digest. The three new references record repository metadata, upstream documentation, and license files only. No package install, language-server startup, client configuration, or MCP session was run for `ty`, `agent-lsp`, or `hypothesis` in this pass, so they stay reference-only until verified. +## Candidate review on 2026-10-29 + +A second search pass over recently active coding-agent skills, MCP servers, LSP bridges, and Python development tooling added four entries after de-duplication against the previous 59: two installable MCP servers (`tirth8205/code-review-graph`, `MarcusJellinghaus/mcp-tools-py`) and two reference-only entries (`DeusData/codebase-memory-mcp`, `bug-ops/mcpls`). + +`code-review-graph` serves a Tree-sitter graph of the configured project for review context and change impact, and `mcp-tools-py` exposes Python checks (pylint, pytest, mypy, Ruff, Bandit, import/vulture/tach checks, formatting) and symbol refactors behind an explicit project directory. Both are published on PyPI, so they could be pinned as stdio services and launched with the repository's smoke script; both recipes were verified that way before admission. `codebase-memory-mcp` and `mcpls` remain references because they ship native binaries through their own installers rather than a pinnable registry launch command. + +Rejected candidates in this pass were either duplicative (further Python type checkers, additional Python LSP bridges next to Serena's backends, and a second generic Cypher-backed code-graph server of the same shape as `codebase-memory-mcp`) or insufficiently specific: skill collections without a stable pin, clear license, or Python relevance to this catalog. + +Only the two new MCP servers were executed. Their startup commands were run from this repository's smoke script with a temporary one-file project, so no user repository was indexed and no project check was executed. + ## Installable upstream evidence | Item | Evidence checked | Result | @@ -40,6 +50,8 @@ Both new skills are single-directory skills whose `SKILL.md` is self-contained; | Context7 | [MCP package README](https://github.com/upstash/context7/blob/master/packages/mcp/README.md), [client configuration](https://context7.com/docs/resources/all-clients), [npm version metadata](https://registry.npmjs.org/@upstash%2fcontext7-mcp/4.4.4) | Published stdio package `4.4.4`; Node.js `>=20.18.1`. The package README describes optional API keys for higher limits/private repositories. Hosted service behavior can change independently of the package pin. | | Playwright MCP | [Official README](https://github.com/microsoft/playwright-mcp), [npm version metadata](https://registry.npmjs.org/@playwright%2fmcp/0.0.83) | Published stdio package `0.0.83`; Node.js `>=18`. Browser installation is a separate prerequisite. | | Fetch MCP | [Official README](https://github.com/modelcontextprotocol/servers/tree/main/src/fetch), [PyPI version metadata](https://pypi.org/pypi/mcp-server-fetch/2026.10.24/json), [licensing](https://github.com/modelcontextprotocol/servers/blob/main/LICENSE) | Published `2026.10.24`; Python `>=3.10`; supports `uvx`. The repository is transitioning from MIT to Apache-2.0, with separate documentation licensing. | +| code-review-graph MCP | [Upstream `.mcp.json`](https://github.com/tirth8205/code-review-graph/blob/main/.mcp.json), [usage documentation](https://github.com/tirth8205/code-review-graph/blob/main/docs/USAGE.md), [PyPI version metadata](https://pypi.org/pypi/code-review-graph/2.3.9/json), [license](https://github.com/tirth8205/code-review-graph/blob/main/LICENSE) | Published `2.3.9`; Python `>=3.10`; the graph is stored inside the project. Upstream launches `uvx code-review-graph serve`; the recipe adds the documented `--repo` flag so the configured project is always indexed. A one-file temporary project built a 5-node/5-edge graph before the protocol check. | +| MCP Tools Py | [Client configuration](https://github.com/MarcusJellinghaus/mcp-tools-py#mcp-client-configuration), [installation guide](https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/INSTALL.md), [PyPI version metadata](https://pypi.org/pypi/mcp-tools-py/0.1.10/json), [license](https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/LICENSE) | Published `0.1.10`; Python `>=3.11`. The server needs pylint, pytest, and mypy in its own environment. The package does not cap `mcp`, so the pin adds `--with mcp<2`; without it the default mcp 2.x resolution fails at import. | The three skill/rule source archives were downloaded from `codeload.github.com` at full 40-character commits. Their SHA-256 values in the manifest were computed from the downloaded bytes. Serena instead uses an explicit Git source revision through uvx. Skill and original rule contents are upstream third-party material; catalog descriptions, selection notes, and disclosed rule adaptations are authored for this project. No upstream archive is vendored into this repository. @@ -52,6 +64,8 @@ The three skill/rule source archives were downloaded from `codeload.github.com` - [uv](https://github.com/astral-sh/uv), [pytest](https://github.com/pytest-dev/pytest), [hypothesis](https://github.com/HypothesisWorks/hypothesis), and [pre-commit](https://github.com/pre-commit/pre-commit) belong in a project's development toolchain. They are not ready-to-register MCP servers. - The eight native LSP references — [Pyright](https://github.com/microsoft/pyright), [Python LSP Server](https://github.com/python-lsp/python-lsp-server), [Ruff](https://docs.astral.sh/ruff/editors/), [ty](https://docs.astral.sh/ty/), [TypeScript Language Server](https://github.com/typescript-language-server/typescript-language-server), [gopls](https://go.dev/gopls/), [rust-analyzer](https://rust-analyzer.github.io/), and [clangd](https://clangd.llvm.org/) — require compatible toolchains and an LSP client. Their raw launch commands do not speak MCP. Ruff also remains useful as a Python lint/format CLI, and `ty` overlaps Pyright on Python type checking. - [agent-lsp](https://github.com/blackwell-systems/agent-lsp) does speak MCP, but it is distributed as a Go binary built by its own install script or release archive. There is no registry version or dependency revision to pin here, and it needs the individual language servers installed separately, so it stays a reference next to Serena rather than a configured bridge. +- [mcpls](https://bug-ops.github.io/mcpls/) speaks MCP over LSP in the same way, with `rust-analyzer`, `pyright`, `gopls`, and other servers in one session. It is distributed as a Rust binary through cargo, its install script, release archives, or a container image, and needs those servers separately, so it stays reference-only as well. +- [codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp) ships a native pure-C binary through its own install script, a Homebrew formula, and a Nix flake, with npm, PyPI, and Go packages that only verify and cache that runtime for the host. The documented MCP entry points at the installed executable, so no registry launch command is recorded and the wrapper path was not exercised as a launcher. Its installer also writes rules, skills, hooks, and agent configuration, which is a broader change than writing one launch configuration. - [Semgrep](https://github.com/semgrep/semgrep), [Bandit](https://github.com/PyCQA/bandit), [pip-audit](https://github.com/pypa/pip-audit), and [Gitleaks](https://github.com/gitleaks/gitleaks) need project-specific inputs, scan scope, reviewed policies/rules, and CI decisions. Their official metadata, licensing, and setup links are recorded in the manifest. Installing security guidance does not execute a scanner or imply a clean result. - [FastMCP](https://github.com/jlowin/fastmcp) and the [MCP Python SDK](https://github.com/modelcontextprotocol/python-sdk) help build integrations; they are not preconfigured MCP services. @@ -71,6 +85,15 @@ On 2026-10-27, the three exact manifest launch commands passed `initialize` and The Playwright server reports its underlying implementation version, which differs from the published MCP wrapper version. No browser was opened, no MCP tool was invoked, and no Context7 query or Fetch request was made. These results establish process startup and tool discovery; they do not establish browser availability, API access, or end-to-end application behavior. +On **2026-10-29**, the same script checked the two MCP servers added that day with the same command line and Python/SDK versions on the same host. Both negotiated protocol **2025-11-25**. + +| Package pin | Reported server version | Tools discovered | Result | +| --- | --- | ---: | --- | +| `code-review-graph==2.3.9` | `2.3.9` | 30 | Passed | +| `mcp-tools-py==0.1.10` with `mcp<2` | `1.30.0` | 17 | Passed | + +The `mcp-tools-py` pin carries an extra `--with mcp<2` requirement because published `0.1.10` imports `mcp.server.fastmcp` without capping `mcp`; its reported version is the service version inside the package. For both servers no MCP tool was invoked, no lint/test/mypy/rename operation was executed, and no repository beyond the temporary sample project was indexed. + Reproduce with `uv run --no-project --python 3.12 --with mcp==2.3.0 python scripts/smoke_mcp.py`. The optional script uses a 90-second timeout per server and a temporary npm cache. It forwards only network proxy/CA settings in addition to the SDK's default subprocess environment. Initial attempts on this host exposed missing proxy forwarding and SDK 2.x field-name changes in the smoke helper; the recorded results are from clean reruns after fixing both. ### Serena bridge smoke result diff --git a/src/awesome_python_dev/data/catalog.json b/src/awesome_python_dev/data/catalog.json index 8c51222..c9df4a1 100644 --- a/src/awesome_python_dev/data/catalog.json +++ b/src/awesome_python_dev/data/catalog.json @@ -1,6 +1,6 @@ { "schema_version": 2, - "reviewed_at": "2026-10-28", + "reviewed_at": "2026-10-29", "tools": [ { "id": "systematic-debugging", @@ -1549,6 +1549,131 @@ "https://github.com/blackwell-systems/agent-lsp/blob/main/docs/guide/speculative-execution.md", "https://github.com/blackwell-systems/agent-lsp/blob/main/LICENSE" ] + }, + { + "id": "code-review-graph", + "name": "code-review-graph", + "kind": "mcp", + "category": "mcp-ecosystem", + "description": "Local Tree-sitter code graph served over MCP for review context, change impact, and affected-test hints.", + "repository": "tirth8205/code-review-graph", + "homepage": "https://github.com/tirth8205/code-review-graph", + "license": "MIT", + "stars": 32459, + "checked_at": "2026-10-29", + "last_pushed_at": "2026-10-16T11:20:26Z", + "archived": false, + "install": { + "type": "mcp", + "command": "uvx", + "args": [ + "--from", + "code-review-graph==2.3.9", + "code-review-graph", + "serve", + "--repo", + "{project}" + ], + "requirements": [ + "uvx" + ], + "version": "2.3.9", + "runtime": "uv/uvx; Python >=3.10 selected by uvx" + }, + "notes": "Pins the latest published PyPI release 2.3.9 (upstream tag v2.3.9). The upstream .mcp.json launches `uvx code-review-graph serve`; the recipe adds the documented --repo flag so the server always indexes the project apd configures. Graph data lives in the project directory (.code-review-graph) and is created by the CLI's own build/update commands, not by this recipe; upstream `install` additionally writes hooks, skills, and rules files, which apd does not do. Smoke-checked on macOS: `uvx --from code-review-graph==2.3.9 code-review-graph build` parsed a one-file temporary Python project (5 nodes, 5 edges), `status` reported the same graph, and the pinned launch command completed MCP initialize and listed 30 tools. No real repository indexing, agent session, or benchmark was run.", + "evidence": [ + "https://api.github.com/repos/tirth8205/code-review-graph", + "https://github.com/tirth8205/code-review-graph/blob/main/.mcp.json", + "https://github.com/tirth8205/code-review-graph/blob/main/docs/USAGE.md", + "https://pypi.org/project/code-review-graph/2.3.9/", + "https://github.com/tirth8205/code-review-graph/blob/main/LICENSE" + ] + }, + { + "id": "mcp-tools-py", + "name": "MCP Tools Py", + "kind": "mcp", + "category": "mcp-ecosystem", + "description": "Run pylint, pytest, mypy, Ruff, Bandit, formatting, and symbol refactors on one Python project through a scoped MCP server.", + "repository": "MarcusJellinghaus/mcp-tools-py", + "homepage": "https://github.com/MarcusJellinghaus/mcp-tools-py", + "license": "MIT", + "stars": 20, + "checked_at": "2026-10-29", + "last_pushed_at": "2026-10-23T12:39:42Z", + "archived": false, + "install": { + "type": "mcp", + "command": "uvx", + "args": [ + "--from", + "mcp-tools-py==0.1.10", + "--with", + "mcp<2", + "mcp-tools-py", + "--project-dir", + "{project}" + ], + "requirements": [ + "uvx" + ], + "version": "0.1.10", + "runtime": "uv/uvx; Python >=3.11 selected by uvx" + }, + "notes": "Python-specific companion to the reference-only pytest, Ruff, and Bandit entries: one server exposes the checks, formats, and symbol refactorings for a single project directory. The extra `--with mcp<2` pin is required because published 0.1.10 imports mcp.server.fastmcp without capping the mcp dependency, so the default resolution to mcp 2.x fails at startup; with the pin the server starts normally. The server runs the project's checks with its own environment by default and exposes --python-executable/--venv-path when pylint, pytest, and mypy live elsewhere; apd writes only the launch configuration. Smoke-checked on macOS: the pinned command completed MCP initialize (service 1.30.0) and listed 17 tools, including run_pylint_check, run_pytest_check, run_mypy_check, run_ruff_check, and rename_symbol. No check was executed against a real test suite.", + "evidence": [ + "https://api.github.com/repos/MarcusJellinghaus/mcp-tools-py", + "https://github.com/MarcusJellinghaus/mcp-tools-py#mcp-client-configuration", + "https://pypi.org/project/mcp-tools-py/0.1.10/", + "https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/INSTALL.md", + "https://github.com/MarcusJellinghaus/mcp-tools-py/blob/main/LICENSE" + ] + }, + { + "id": "codebase-memory-mcp", + "name": "Codebase Memory MCP", + "kind": "reference", + "category": "mcp-ecosystem", + "description": "Local knowledge graph MCP server linking code, documentation, configuration, and infrastructure for navigation and change impact.", + "repository": "DeusData/codebase-memory-mcp", + "homepage": "https://deusdata.github.io/codebase-memory-mcp/", + "license": "MIT", + "stars": 47734, + "checked_at": "2026-10-29", + "last_pushed_at": "2026-10-28T17:16:38Z", + "archived": false, + "install": null, + "notes": "Reference only: releases ship a native pure-C binary plus install.sh/install.ps1, an upstream Homebrew formula, and a Nix flake, and the documented MCP configuration points at the installed executable rather than a registry launch command. The npm, PyPI, and Go packages of the same name only verify and cache that native runtime for the host, and the upstream installer also writes agent configuration, rules, skills, and hooks, so this catalog records no launch command for it and does not run the installer. Upstream reports 17 MCP tools, 162 parsed languages and formats, Hybrid LSP type resolution, an optional daemon plus UI, and 45 client integrations; indexing persists to a shared cache directory. Installation, indexing, and any MCP session were not run in this pass.", + "evidence": [ + "https://api.github.com/repos/DeusData/codebase-memory-mcp", + "https://github.com/DeusData/codebase-memory-mcp#mcp-tools", + "https://github.com/DeusData/codebase-memory-mcp/blob/main/server.json", + "https://deusdata.github.io/codebase-memory-mcp/", + "https://github.com/DeusData/codebase-memory-mcp/blob/main/LICENSE" + ] + }, + { + "id": "mcpls", + "name": "mcpls", + "kind": "lsp", + "category": "lsp-bridge", + "description": "MCP-to-LSP bridge that runs rust-analyzer, pyright, gopls, and other language servers and exposes 31 code tools to agents.", + "repository": "bug-ops/mcpls", + "homepage": "https://bug-ops.github.io/mcpls/", + "license": "MIT OR Apache-2.0", + "stars": 80, + "checked_at": "2026-10-29", + "last_pushed_at": "2026-10-28T21:48:33Z", + "archived": false, + "install": null, + "notes": "Second reference-only LSP bridge next to agent-lsp, and the third bridge entry overall: it is distributed as a Rust binary through cargo install mcpls, an upstream install script, release archives, or a container image, so there is no registry package revision for the installer to pin. It manages several language servers in one session and exposes hover, references, diagnostics, and rename as 31 MCP tools, with stdio and optional HTTP transport; it needs at least one language server installed separately (pyright for Python). Repository metadata, the documentation book, license files, and release v0.8.0 were checked; no server startup or MCP session was run in this pass.", + "evidence": [ + "https://api.github.com/repos/bug-ops/mcpls", + "https://bug-ops.github.io/mcpls/getting-started/installation.html", + "https://bug-ops.github.io/mcpls/tools/overview.html", + "https://github.com/bug-ops/mcpls/releases/tag/v0.8.0", + "https://github.com/bug-ops/mcpls/blob/main/LICENSE-MIT" + ] } ], "profiles": {