zernie 86fdb5f141 fix(audit): read MCP servers from the layout, not a hard-coded path (#127) ...

Three defects, plus a cheap bet on the Agent Plugins packaging format.

- marketplace.json had drifted a full major behind plugin.json; a CI gate now
  fails on any future name/version/description/license drift between the
  manifests.
- Both collectMcpServers implementations hard-coded ".mcp.json", bypassing
  layout.mcpConfigFile and violating adapter-aware-lint-rules. Behaviour is
  unchanged for both shipping harnesses; the literal is gone.
- The report could say "MCP servers: no" while listing an MCP finding.

A plugin packaged to the Agent Plugins standard puts its MCP servers in a root
mcp.json that no harness layout names, so three MCP rules silently checked
nothing on such a plugin. src/core/agent-plugins.ts recognizes the standard by
the manifest's $schema, never by filename. Not modelled as a HarnessAdapter: the
standard is a packaging format with no tool catalog, hook events or runtime.

vigiles also ships as a conformant plugin. Docs are explicit that this is
additive — VS Code reads the standard's root manifest; Claude Code and Codex
document their own manifest paths.

2026-08-07 10:31:06 +05:00

499 B

Raw Permalink Blame History

View Raw