m9rco · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -24,6 +24,21 @@ Catalogue additions from the daily candidate review.
 - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were
   updated in the same change.
 
+Catalogue additions from the 2026-10-29 candidate review.
+
+- Two installable MCP servers, both smoke-checked through
+  `scripts/smoke_mcp.py`: `code-review-graph` (pinned
+  `uvx --from code-review-graph==2.3.9`, 30 tools discovered) and `mcp-tools-py`
+  (pinned `uvx --from mcp-tools-py==0.1.10 --with mcp<2`, 17 tools discovered;
+  Python lint, test, type, and refactor operations behind one project scope).
+- Two reference-only entries: `codebase-memory-mcp`, a native code knowledge
+  graph whose npm/PyPI packages are installer wrappers, and `mcpls`, a Rust
+  MCP-to-LSP bridge over `rust-analyzer`, `pyright`, and `gopls`.
+- The catalog now has 63 entries: 34 installable resources (22 skills, 6 rule
+  packs, 5 MCP servers, and Serena's bridge) and 29 references.
+- `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were
+  updated in the same change.
+
 ## npm shell 0.1.1 — 2026-10-28
 
 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads,

diff --git a/README.md b/README.md
@@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta
 
 The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**.
 
-The repository catalog includes **59 entries**: **32 installable resources** (22 skills, 6 rule packs, 3 MCP servers, and Serena's LSP bridge) and **27 references** (agent-lsp, 8 native language servers, and 18 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
+The repository catalog includes **63 entries**: **34 installable resources** (22 skills, 6 rule packs, 5 MCP servers, and Serena's LSP bridge) and **29 references** (agent-lsp, mcpls, 8 native language servers, and 19 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
 
 ## Contents
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -17,7 +17,7 @@
 
 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。
 
-仓库目录收录 **59 个条目**：**32 个可安装资源**（22 个 skills、6 套规则、3 个 MCP servers、1 个 Serena LSP 桥接），以及 **27 个参考条目**（agent-lsp、8 个原生语言服务、18 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
+仓库目录收录 **63 个条目**：**34 个可安装资源**（22 个 skills、6 套规则、5 个 MCP servers、1 个 Serena LSP 桥接），以及 **29 个参考条目**（agent-lsp、mcpls、8 个原生语言服务、19 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
 
 ## 目录
 

diff --git a/docs/CATALOG.md b/docs/CATALOG.md
@@ -1,6 +1,6 @@
 # Curated catalog / 精选目录
 
-Reviewed **2026-10-28**, catalog schema **2**. **59 entries**, with **32 installable/configurable integrations** and **27 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 3 MCP servers, and 1 MCP-to-LSP bridge. The 10 LSP entries comprise Serena, the reference-only agent-lsp bridge, and 8 standalone language-server references.
+Reviewed **2026-10-29**, catalog schema **2**. **63 entries**, with **34 installable/configurable integrations** and **29 reference-only tools**. The installable set contains 22 skills, 6 rule packs, 5 MCP servers, and 1 MCP-to-LSP bridge. The 11 LSP entries comprise Serena, the two reference-only bridges (agent-lsp, mcpls), and 8 standalone language-server references.
 
 Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status.
 
@@ -94,16 +94,20 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`context7`](https://github.com/upstash/context7/tree/master/packages/mcp) | Retrieve library documentation and version-specific examples for coding tasks. | Configure MCP | 63,759 | MIT |
 | [`playwright`](https://github.com/microsoft/playwright-mcp) | Browser inspection and interactive web testing through accessibility snapshots. | Configure MCP | 38,702 | Apache-2.0 |
 | [`fetch`](https://github.com/modelcontextprotocol/servers/tree/main/src/fetch) | Retrieve web pages as text/Markdown for documentation and research. | Configure MCP | 91,599 | Apache-2.0 / MIT; docs CC-BY-4.0 |
+| [`code-review-graph`](https://github.com/tirth8205/code-review-graph) | Serve a Tree-sitter code graph over MCP for review context, change impact, and affected-test hints. | Configure MCP | 32,459 | MIT |
+| [`mcp-tools-py`](https://github.com/MarcusJellinghaus/mcp-tools-py) | Run pylint, pytest, mypy, Ruff, Bandit, formatting, and symbol refactors on a Python project through one scoped MCP server. | Configure MCP | 20 | MIT |
 | [`github-mcp`](https://github.com/github/github-mcp-server) | Official GitHub tools for repositories, issues, and pull requests. | Reference only | 33,999 | MIT |
 | [`chrome-devtools`](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Inspect browser performance, network activity, and runtime behavior. | Reference only | 54,261 | Apache-2.0 |
 | [`sequential-thinking`](https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking) | A reference server for structured problem-solving tool calls. | Reference only | 91,599 | Apache-2.0 / MIT; docs CC-BY-4.0 |
+| [`codebase-memory-mcp`](https://github.com/DeusData/codebase-memory-mcp) | Local knowledge graph over code, documentation, configuration, and infrastructure for navigation and change impact. | Reference only | 47,734 | MIT |
 
 ## Language intelligence and LSP
 
 | ID / source | Use case | Delivery | Stars | License |
 | --- | --- | --- | ---: | --- |
 | [`serena`](https://github.com/oraios/serena) | Expose semantic code navigation, references, diagnostics, and edits to coding agents through an MCP-to-LSP bridge. | Configure LSP bridge | 30,759 | GPL-3.0-or-later (application); MIT (SolidLSP) |
 | [`agent-lsp`](https://github.com/blackwell-systems/agent-lsp) | Orchestrate native language servers into batch, refactor, and speculative-edit workflows for coding agents. | Reference only | 166 | MIT |
+| [`mcpls`](https://bug-ops.github.io/mcpls/) | Bridge MCP to rust-analyzer, pyright, gopls, and other language servers and expose 31 code tools to agents. | Reference only | 80 | MIT OR Apache-2.0 |
 | [`ruff`](https://docs.astral.sh/ruff/editors/) | Python linting, formatting, and the built-in Ruff language server for diagnostics and code actions. | Reference only | 50,317 | MIT |
 | [`pyright`](https://github.com/microsoft/pyright) | Python type checking and language-server support for navigation and diagnostics. | Reference only | 15,707 | MIT |
 | [`ty`](https://docs.astral.sh/ty/) | Rust-based Python type checker and language server with editor integrations; upstream labels it beta. | Reference only | 19,973 | MIT |
@@ -161,13 +165,20 @@ Skill and rule archives are pinned to full commits and verified against a record
 | `playwright` | `npx -y @playwright/[email protected]` | Node.js >=18 |
 | `fetch` | `uvx mcp-server-fetch==2026.10.24` | Python >=3.10 |
 | `serena` | See [exact Serena command](LSP.md#install-the-lsp-bridge); v2.1.0 at `5e4f5cd173c7ff3eed37ee3f1de6c266b937c5dc` | uv/uvx + Git; Python 3.13 selected by uvx; language-specific dependencies |
+| `code-review-graph` | `uvx --from code-review-graph==2.3.9 code-review-graph serve --repo {project}` | uv/uvx; Python >=3.10 selected by uvx |
+| `mcp-tools-py` | `uvx --from mcp-tools-py==0.1.10 --with mcp<2 mcp-tools-py --project-dir {project}` | uv/uvx; Python >=3.11 selected by uvx; pylint/pytest/mypy for the checks |
 
 - **Context7:** API keys are optional in the pinned stdio package guidance for higher limits/private repositories. Service access and policy can change independently of the package version. Configure credentials through the chosen agent; do not commit secrets.
 - **Playwright:** A supported browser is needed for browser operations. Configuring the server does not install browser binaries.
 - **Fetch:** Requires uv/uvx and a compatible Python. No private-IP bypass is enabled by this recipe.
 - **Serena:** The project path is resolved into the MCP configuration. First startup may download language-server dependencies and create Serena-owned state. The installer does not manage or uninstall those upstream caches. See [language intelligence and setup](LSP.md).
 - **Native language servers:** Pyright, Python LSP Server, Ruff, TypeScript Language Server, gopls, rust-analyzer, and clangd remain reference-only. Their native LSP commands need an LSP client; they are not interchangeable with MCP servers.
-- **agent-lsp:** A second, reference-only LSP bridge. It ships as a Go binary from an upstream install script, release archive, or container image, and requires the underlying language servers separately; there is no registry package or dependency version for this catalog to pin, so `apd` writes only the Serena recipe.
+- **agent-lsp:** One of two reference-only LSP bridges besides Serena. It ships as a Go binary from an upstream install script, release archive, or container image, and requires the underlying language servers separately; there is no registry package or dependency version for this catalog to pin, so `apd` writes only the Serena recipe.
+- **mcpls:** The other reference-only bridge. It is distributed as a Rust binary through `cargo install mcpls`, an upstream install script, release archives, or a container image, and needs at least one language server (for example pyright) installed separately. Enabling it next to Serena would give the same project two bridges over the same servers.
+- **code-review-graph:** The project path is resolved into the MCP configuration and the server indexes it with Tree-sitter; graph data stays in a `.code-review-graph` directory inside the project. Building or refreshing the graph is an explicit CLI or tool step, and upstream `install` also writes hooks, skills, and rules files that this recipe does not touch.
+- **mcp-tools-py:** A Python-only companion to the reference-only pytest, Ruff, and Bandit entries. Its `--with mcp<2` pin is deliberate: published `0.1.10` imports `mcp.server.fastmcp` without capping `mcp`, so the default mcp 2.x resolution fails at startup. The checks run through the server's own interpreter unless `--python-executable`/`--venv-path` is configured, so pylint, pytest, and mypy must exist in that environment.
+- **codebase-memory-mcp:** The documented MCP entry points at an installed native executable, and the npm, PyPI, and Go packages of the same name only verify and cache that runtime for the host, so there is no registry launch command to pin. Its installer also writes agent configuration, rules, skills, and hooks and its indexing persists to a shared cache directory with an optional daemon, which is a broader change than writing one launch configuration.
+- **Two code-graph servers overlap:** `code-review-graph` and `codebase-memory-mcp` both index a repository into a local graph for review and impact questions, with different runtimes and scope. Enable one per project rather than both.
 - **Conflict to resolve yourself:** `pyright` and `ty` are alternative Python type-checking servers, and `ruff server` covers lint/format diagnostics. Pick the servers your editor should run instead of enabling all of them.
 - **Test dependencies:** `hypothesis` is a project dependency next to `pytest`, not an MCP server or agent skill. Recording it neither adds nor runs tests and does not configure CI.
 - **agent-skills collection:** The two selected skills come from a larger, mostly single-file skill collection with its own plugin manifests and hooks. Only the pinned skill directories are copied; hooks, commands, and agent definitions stay upstream.

diff --git a/docs/LSP.md b/docs/LSP.md
@@ -74,6 +74,12 @@ Ruff supplies lint and formatting capabilities. Pair it with a navigation/type s
 
 It is a Go binary installed by the upstream script, a release archive, or a container image. The project publishes no registry package or dependency revision for this catalog to pin, and it needs the underlying language servers installed separately, so `apd` keeps writing only the Serena recipe. Configuring a second bridge would also duplicate Serena's role in the `lsp` profile. Review its tool surface and install path upstream if that workflow fits your project.
 
+## Another bridge: mcpls
+
+[mcpls](https://bug-ops.github.io/mcpls/) is catalogued as a second reference-only bridge next to agent-lsp. It runs language servers such as `rust-analyzer`, `pyright`, and `gopls` in one session and exposes their type information, references, diagnostics, and refactoring as 31 MCP tools over stdio or optional HTTP transport.
+
+It is a Rust binary distributed through `cargo install mcpls`, an upstream install script, release archives, or a container image, so there is no registry package revision for this catalog to pin; it also needs at least one language server installed separately. Like agent-lsp it stays a reference while `apd` writes only the Serena recipe. Use it when a project needs several of its supported language servers at once; otherwise an editor's native LSP setup already covers that work.
+
 ## OpenCode's native LSP support
 
 OpenCode also has native LSP integration independently of Serena. Its current documentation says LSP is disabled by default and can be enabled in `opencode.json`:
@@ -102,7 +108,7 @@ Select the intended scan scope and reviewed rule sets, pin dependencies in the p
 
 ## Verification recorded for this recipe
 
-On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`.
+On 2026-10-29, `mcpls` was added from repository metadata, the upstream documentation book, license files, and release v0.8.0 only: no language-server startup, editor configuration, or MCP session was run. The `code-review-graph` and `mcp-tools-py` MCP entries added the same day were launched through the pinned commands and completed `initialize` and `tools/list`; see [research evidence](RESEARCH.md#mcp-protocol-smoke-results). On 2026-10-28, `ty` and `agent-lsp` were added from repository metadata, upstream documentation, and license files only: no language-server startup, editor configuration, or MCP session was run for either entry. On 2026-10-27, the exact pinned Serena command completed MCP `initialize` and `tools/list` on macOS with Python 3.13 in a temporary Python project, using an isolated `SERENA_HOME`. Startup and tool discovery took about 35 seconds. It exposed 22 tools, including `find_symbol`, `find_referencing_symbols`, and `get_diagnostics_for_file`.
 
 The check made no `tools/call` requests and ended before language-server initialization completed. It verifies the package launch and MCP discovery path, not symbol correctness, every programming language, every operating system, or integration inside all five agent applications.