Three defects, plus a cheap bet on the Agent Plugins packaging format.
- marketplace.json had drifted a full major behind plugin.json; a CI gate now
fails on any future name/version/description/license drift between the
manifests.
- Both collectMcpServers implementations hard-coded ".mcp.json", bypassing
layout.mcpConfigFile and violating adapter-aware-lint-rules. Behaviour is
unchanged for both shipping harnesses; the literal is gone.
- The report could say "MCP servers: no" while listing an MCP finding.
A plugin packaged to the Agent Plugins standard puts its MCP servers in a root
mcp.json that no harness layout names, so three MCP rules silently checked
nothing on such a plugin. src/core/agent-plugins.ts recognizes the standard by
the manifest's $schema, never by filename. Not modelled as a HarnessAdapter: the
standard is a packaging format with no tool catalog, hook events or runtime.
vigiles also ships as a conformant plugin. Docs are explicit that this is
additive — VS Code reads the standard's root manifest; Claude Code and Codex
document their own manifest paths.
zernie