From a9fcccd24de0181452d8cd7163e066e257c41807 Mon Sep 17 00:00:00 2001 From: Karan Date: Wed, 28 Oct 2026 15:58:24 -0400 Subject: [PATCH] docs: the directory's verdict on the vendored plugin version (listings/mcp.md section 3) v0.2.1 at ec577ea, found by the scheduled check 7 minutes after the sync's push: validation passed, "Meets directory policy, with warnings" (no hold), security scan passed, waiting for a reviewer to list it. The warnings, by name, with what the page says about each. Co-Authored-By: Claude Fable 5.1 --- docs/adoption/listings/mcp.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/docs/adoption/listings/mcp.md b/docs/adoption/listings/mcp.md index ca8373d..0d2bfa1 100644 --- a/docs/adoption/listings/mcp.md +++ b/docs/adoption/listings/mcp.md @@ -140,8 +140,8 @@ support.claude.com "Anthropic Software Directory Policy". keeps `npx` everywhere, since that format has no plugin-root variable. An unpinned launcher would block; the manifests test keeps the `npx` pins equal to `package.json`'s version and checks the assembled tree. Between a version bump and its release the sync script exits 3 (npm does not serve the new version yet) and the plugin - repository stays at the previous release until the first sync after the publish. Whether a vendored server still - draws a hold is the reviewer's call; "MCP server command wasn't read" has not appeared. + repository stays at the previous release until the first sync after the publish. The vendored version drew no hold, + "Meets directory policy, with warnings" (the dated bullet below); "MCP server command wasn't read" has not appeared. - **Policy items.** Privacy policy URL: `privacyPolicyUrl` in `plugin.json` (the plugin README's Privacy section). Support: `supportUrl` (GitHub issues). Tool annotations: every tool has `title`, `readOnlyHint`, `destructiveHint` @@ -181,8 +181,18 @@ support.claude.com "Anthropic Software Directory Policy". asks for (the layout above): `.mcp.json` and the hook run the released server vendored under `server/` with `node` from `${CLAUDE_PLUGIN_ROOT}`, and the plugin ships no `package.json` or lockfile. Locally, the assembled repository passes `claude plugin validate --profile directory`, the vendored server answers `--version` and an MCP - `initialize`, and the hook exits silently without a bridge. The directory reads the result at its next check after - the sync pushes it; what it says is recorded here then. + `initialize`, and the hook exits silently without a bridge. The directory took that version, ec577ea, by its + scheduled check about 7 minutes after the sync's push (17 files, 333.2 kB): validation passed with the same 3 notes, + directory policy "Meets directory policy, with warnings" (no hold), the security scan passed in 3 minutes, and the + version is "with a reviewer": "This version passed the security scan and is waiting for a reviewer before it can be + listed. There's nothing you need to do." Compared with 68507fa: "3 new findings, 4 fixed". The warnings, each marked + as information or as something that can stay: "Uses a credential from the user's machine" (2 findings in + `server/cli.mjs`; the server writes and reads its own bridge token under `~/.genclass/`, and the text suggests a + `user_config` option with `sensitive: true` instead), "Unrecognized field in plugin.json" (the three URL fields), + "Contains a download-and-run command" in `server/cli.mjs` (the `npx` lines the server prints for other clients, and + `genclass_scan`, which runs `npx @genclass/runtime@beta scan`: "where the plugin runs this, ship the script inside + the plugin"; where it is documentation nothing changes), "Uses hooks" and "Runs a local program for an MCP server". + The first version still goes live only when an Anthropic reviewer publishes it; auto-publish applies after that. ## 4. punkpeye/awesome-mcp-servers