Fetch AGENTS.md changelog

https://raw.githubusercontent.com/modelcontextprotocol/servers/HEAD/AGENTS.md

− │                             claude.yml (@claude mentions), everything-mcp-diff.yml (everything's interface diff on PRs),− than `GITHUB_TOKEN`. Today that is `release.yml`'s publish jobs, `claude.yml`,− and `sdk-watch.yml`'s `analyze` and `post` jobs (`ANTHROPIC_API_KEY`). Jobs− - **A credentialed job that a comment, review or issue can start runs only−   for a trusted author**: `OWNER`, `MEMBER` or `COLLABORATOR` in the−   `author_association` of the text that triggered it, never of the thread−   around it. Today that is `claude.yml`, whose `if:` checks it on every event−   it listens to; `scripts/claude-workflow.test.mjs` evaluates that condition−   per event and fails when one loses its check.− - **Exception: a security advisory's fix, in its private fork.** A PR in the−   advisory's temporary private fork (`servers-ghsa-xxxx-yyyy-zzzz`) links no−   public issue, carries no labels, and is tracked by the advisory's `[GHSA-…]` draft−   card rather than an issue's card, because each of those would disclose the−   vulnerability before a fix ships. For the same reason the work-start rules−   on assigning an issue and naming the branch `v2/<type>/<ISSUE_NUMBER>-<slug>`−   do not apply: its branch is `v2/fix/<ghsa-id>`, with **no descriptive−   slug**. It still targets `v2/main`, and it is reviewed inside the fork. The−   flow is the `security-advisory` skill.−     and a summary can name the server or the attack. It becomes a public−     issue by conversion **once the advisory is published**, never merely once−     the fix ships. Work the fix leaves open is tracked by a second draft card,−     `[GHSA-xxxx-yyyy-zzzz follow-up]`, under the same rules. It stays open−     after conversion, because its work has not shipped. The `[GHSA-` prefix is−     load-bearing: **any other draft card is still a defect to delete**. The flow−     is the `security-advisory` skill.−   `Incoming` → `Todo`. Its milestone arrives with the public issue after−   publication.− - **After opening a PR, run a Copilot review loop to convergence, unprompted.**+ │                             everything-mcp-diff.yml (everything's interface diff on PRs),+ than `GITHUB_TOKEN`. Today that is `release.yml`'s publish jobs and+ `sdk-watch.yml`'s `analyze` and `post` jobs (`ANTHROPIC_API_KEY`). Jobs+ - **Exception: a security advisory's fix.** It is written and reviewed in a+   PR in the advisory's temporary private fork (`servers-ghsa-xxxx-yyyy-zzzz`),+   which links no public issue, carries no labels, and is tracked by the+   advisory's `[GHSA-…]` draft card rather than an issue's card, because each+   of those would disclose the vulnerability before a fix ships. For the same+   reason the work-start rules on assigning an issue and naming the branch+   `v2/<type>/<ISSUE_NUMBER>-<slug>` do not apply: its branch is+   `v2/fix/<ghsa-id>`, with **no descriptive slug**. It targets `v2/main`, and+   it is **not merged**. When the fix is ready to merge, close to the release,+   the draft card converts to an issue that keeps its opaque title, and that+   branch is pushed here under the same name and merged through a **public PR**+   that `Closes` that issue and follows every rule above, except that its+   title and body describe no part of the vulnerability and it gets **no+   Copilot review loop**: review comments on a public PR are public, and the+   review already happened in the fork. The fork's PR is then closed. The flow+   is the `security-advisory` skill.+     and a summary can name the server or the attack. It converts to an issue+     **when its fix is ready to merge**, keeping that opaque title, so the+     public PR that brings the fix to `v2/main` has an issue to close; the+     summary joins the title only **once the advisory is published**, never+     merely once the fix ships. Work the fix leaves open is tracked by a second+     draft card, `[GHSA-xxxx-yyyy-zzzz follow-up]`, under the same rules, except+     that it converts only once the advisory is published, since its write-up+     describes the gap. It stays open after conversion, because its work has+     not shipped. The `[GHSA-` prefix is load-bearing: **any other draft card+     is still a defect to delete**. The flow is the `security-advisory` skill.+   `Incoming` → `Todo`. Its milestone arrives when the card converts to an+   issue, before the fix's public PR opens.+ - **After opening a PR, run a Copilot review loop to convergence, unprompted**+   (except a security advisory's public fix PR; see+   [Contributing](#contributing)).

https://raw.githubusercontent.com/modelcontextprotocol/servers/HEAD/AGENTS.md

− | [`client-smoke`](.claude/skills/client-smoke/SKILL.md)           | Driving a built server with the Inspector CLI (the scripted path), the Inspector web UI (by hand) and an LLM client; the CLI's argument split and exit codes; protocol eras and what can be exercised today             | Model-invoked, or `/client-smoke`      |− │                             (dependency-refresh, dependabot-alerts, sdk-watch)− | Sweep                                                       | Replaces                                                                   | Files                                                                                                                                                                                                       | Cadence |− | ----------------------------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |− | `dependency-refresh.yml` → `scripts/dependency-refresh.mjs` | `.github/dependabot.yml` (deleted)                                         | **One** tracking issue: `npm outdated` across the root and workspaces, each Python server's `uv lock --upgrade` dry run, and each workflow `uses:` ref against its action's highest release                 | Monthly |− | `dependabot-alerts.yml` → `scripts/dependabot-alerts.mjs`   | Security-update PRs (the `automated-security-fixes` **repo setting**, off) | One issue per vulnerable package per lockfile (npm and pip) that has a patched release, targeting the lowest patched version outside every applicable range, or flagging that no listed fix clears them all | Daily   |− | `sdk-watch.yml` → `scripts/sdk-watch.mjs`                   | Nothing: SDK releases were watched by habit                                | One issue per MCP SDK group behind its registry (npm `@modelcontextprotocol/*`, PyPI `mcp`), plus a Claude analysis comment                                                                                 | Nightly |−   - The changesets **"Version Packages"** PR cannot carry a `Closes` line: the−     Tie it to the release issue with a **comment** (`Part of #N`), which an−     update does not overwrite.−    on the file's first line.−     the fix ships. The `[GHSA-` prefix is load-bearing: **any other draft card−     is still a defect to delete**. The flow is the `security-advisory` skill.−   `v2/fix/4810-filesystem-symlink-escape`) from `origin/v2/main`, **in a new−   git worktree**: never by switching branches in the primary checkout, which−   concurrent agent sessions share. Remove the worktree once the PR merges or−   is closed. The recipe is the `pr-flow` skill (step 2, and step 10 for the+ | [`client-smoke`](.claude/skills/client-smoke/SKILL.md)           | Driving a built server with the Inspector CLI (the scripted path), the Inspector web UI (through Playwright) and an LLM client; the CLI's argument split and exit codes; protocol eras and what can be exercised today             | Model-invoked, or `/client-smoke`      |+ ├── .claude/settings.json     The SessionStart hook that checks this session's instructions are current+ │                             (dependency-refresh, dependabot-alerts, sdk-watch), and the session-start+ │                             instructions check (session-instructions-check)+ - **A credentialed job that a comment, review or issue can start runs only+   for a trusted author**: `OWNER`, `MEMBER` or `COLLABORATOR` in the+   `author_association` of the text that triggered it, never of the thread+   around it. Today that is `claude.yml`, whose `if:` checks it on every event+   it listens to; `scripts/claude-workflow.test.mjs` evaluates that condition+   per event and fails when one loses its check.+ | Sweep                                                       | Replaces                                                                   | Files                                                                                                                                                                                                                                          | Cadence |+ | ----------------------------------------------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |+ | `dependency-refresh.yml` → `scripts/dependency-refresh.mjs` | `.github/dependabot.yml` (deleted)                                         | **One** tracking issue: `npm outdated` across the root and workspaces, each Python server's `uv lock --upgrade` dry run, and each workflow `uses:` ref against its action's highest release                                                    | Monthly |+ | `dependabot-alerts.yml` → `scripts/dependabot-alerts.mjs`   | Security-update PRs (the `automated-security-fixes` **repo setting**, off) | One issue per vulnerable package per lockfile (npm and pip), targeting the lowest patched version outside every applicable range, flagging that no listed fix clears them all, or asking for a decision on an advisory with no patched release | Daily   |+ | `sdk-watch.yml` → `scripts/sdk-watch.mjs`                   | Nothing: SDK releases were watched by habit                                | One issue per MCP SDK group behind its registry (npm `@modelcontextprotocol/*`, PyPI `mcp`), plus a Claude analysis comment                                                                                                                    | Nightly |+   - The changesets **"Version Packages"** PR cannot keep a `Closes` line: the+     It is still **linked** to the release issue like every other PR: with+     `addCloseIssueReferences` as soon as it is found, since the link lives+     outside the body and survives the rewrites (on `v2/main` it closes+     nothing at merge). Its body's first line becomes **`Part of #N`+     immediately before merging**, after the last regeneration, and is checked+     to still be there at merge. A `Part of #N` **comment** stays as the+     durable textual record, since an update does not overwrite it.+    on the file's first line. **A body holds no `$0`–`$9` and no `$ARGUMENTS`**:+    Claude Code substitutes them when a skill is invoked with arguments, so a+    recipe's shell parameters or awk fields reach the model rewritten.+     the fix ships. Work the fix leaves open is tracked by a second draft card,+     `[GHSA-xxxx-yyyy-zzzz follow-up]`, under the same rules. It stays open+     after conversion, because its work has not shipped. The `[GHSA-` prefix is+     load-bearing: **any other draft card is still a defect to delete**. The flow+     is the `security-advisory` skill.+ - **All work happens in a git worktree freshly cut from `origin/v2/main`, and+   the agent session runs inside it.** Not only PR branches: release+   verification, audits, triage, investigation and anything else done in a+   checkout. `git fetch origin` first, then `git worktree add` from+   `origin/v2/main`: a new branch for PR work, `--detach` for work that+   commits nothing. Never work in the primary checkout, which concurrent agent+   sessions share, and never in an existing worktree without first confirming+   it is at the current `origin/v2/main`.+   - **Start the session in that worktree.** Claude Code loads this file and

Showing the first 40 of each.

https://raw.githubusercontent.com/modelcontextprotocol/servers/HEAD/AGENTS.md

− ├── scripts/                  The pre-push gate (gate-lease, smoke-servers, validate-py, coverage-py), its guards (verify-*),− │                             claude.yml (@claude mentions), and the scheduled sweeps that file issues:− │                             dependency-refresh.yml, dependabot-alerts.yml, sdk-watch.yml− Node **22** for the TypeScript servers. Python **>= 3.10** for the Python− servers, at the version each server's `.python-version` pins. Python− coverage gate), `verify:skills:cli`, and `smoke` (every server− booted over each transport it implements). The stage-by-stage reference, and− what CI runs where, is [`docs/quality-gate.md`](./docs/quality-gate.md);−   not a substitute.** They skip the other language, the pinned skills validator−   and the boot smoke.−   is merged with a merge commit, never squashed. The flow is the `release`−   skill.−   `v2/fix/4810-filesystem-symlink-escape`) from `origin/v2/main`.+ ├── scripts/                  The pre-push gate (gate-lease, smoke-servers, validate-py, coverage-py, interface-diff), its guards (verify-*),+ │                             claude.yml (@claude mentions), everything-mcp-diff.yml (everything's interface diff on PRs),+ │                             main-source.yml (a PR into main must bring nothing that is not on v2/main),+ │                             and the scheduled sweeps that file issues: dependency-refresh.yml, dependabot-alerts.yml, sdk-watch.yml+ Node **24** for the TypeScript servers: the development version and the oldest+ supported (`engines` is `>=24`), and CI validates each TypeScript server on 24+ and 26 in parallel legs. Python **>= 3.10** for the Python servers, at the version each server's `.python-version` pins. Python+ coverage gate), `verify:skills:cli`, `smoke` (every server booted over each+ transport it implements), and `interface-diff` (the `everything` server's MCP+ interface diffed against the base it branched from). The stage-by-stage+ reference, and what CI runs where, is [`docs/quality-gate.md`](./docs/quality-gate.md);+   not a substitute.** They skip the other language, the pinned skills validator,+   the boot smoke and the interface diff.+ - **`verify-main-source` is not a gate stage either.** It applies only to a+   pull request into `main` (see the merge PR exception under+   [Contributing](#contributing)), and every local push targets a v2 branch.+   `main-source.yml` runs it.+ **`v2/main` changes only through a merged PR.** Its ruleset, `v2/main: PRs+ only`, refuses deletion, force-pushes and direct pushes, and has no bypass+ actors. It requires no approvals, so a maintainer can merge their own PR. No+ automation pushes to `v2/main`: the Version Packages and Prepare Python+ Release workflows push branches of their own and open PRs. A workflow that+ needs to push to `v2/main` directly is a change to this rule and its ruleset,+ decided first. The `main` guard (**Source is v2/main**) trusts `v2/main`'s+ history, so this ruleset is what makes that trust hold.+   is merged with a merge commit, never squashed. Both are enforced on `main`:+   its ruleset allows only merge commits, and requires the **Source is+   v2/main** check (`main-source.yml`), which fails a PR whose head carries+   any commit not already on `v2/main`. That ruleset has no bypass actors; a+   release that cannot be a pure merge (a release branch, a hotfix) goes+   through only by a repo admin disabling it for that one merge and+   re-enabling it at once, which is never automated. The flow is the+   `release` skill.+   `v2/fix/4810-filesystem-symlink-escape`) from `origin/v2/main`, **in a new+   git worktree**: never by switching branches in the primary checkout, which+   concurrent agent sessions share. Remove the worktree once the PR merges or+   is closed. The recipe is the `pr-flow` skill (step 2, and step 10 for the+   removal).+ ## Pacing GitHub writes+ **Pace bulk GitHub writes: 1 s between requests, never in parallel, under 80 a

file

absent → published

https://raw.githubusercontent.com/modelcontextprotocol/servers/HEAD/AGENTS.md

+ # MCP reference servers+ This repository holds the official Model Context Protocol reference servers:+ seven standalone packages under `src/`, four in TypeScript (published to npm)+ and three in Python (published to PyPI). They are reference implementations,+ meant to show how each part of the protocol is used, not general-purpose+ products.+ **This file holds the _rules_: the conventions a reviewer cites against a diff.**+ It is loaded in full at the start of every session, so it stays resident and must+ be complete enough to work from on its own. Procedures (multi-step recipes with+ commands and live IDs) belong in skills under `.claude/skills/`, which load on+ demand. A rule that must never silently drop out of context goes here; a recipe+ that can be re-read from disk goes in a skill.+ Every rule in this file is true of the repository as it stands. A rule whose+ machinery does not exist yet is added by the change that builds that machinery,+ not in advance.+ ## Skills index+ | Skill                                                            | Covers                                                                                                                                                                                                                  | How it loads                           |+ | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |+ | [`board-ops`](.claude/skills/board-ops/SKILL.md)                 | `gh project` recipes and the IDs for the Servers V2 board (#43); resolving option IDs by name; the option-deletion hazard and its recovery                                                                              | Model-invoked, or `/board-ops`         |+ | [`issue-create`](.claude/skills/issue-create/SKILL.md)           | The create flow: duplicate check, `v2` + type + server-scope labels, milestone, board card, Status + Priority, and the query that verifies them                                                                         | Model-invoked, or `/issue-create`      |+ | [`pr-flow`](.claude/skills/pr-flow/SKILL.md)                     | Issue to PR: branch, DCO signoff and repair, the gate, client evidence, `addCloseIssueReferences`, the Copilot loop and its exits, close-out on merge                                                                   | Model-invoked, or `/pr-flow`           |+ | [`issue-triage`](.claude/skills/issue-triage/SKILL.md)           | Inflow: the class check and canned responses (listings, new servers, duplicates, outside PRs), pass 1 onto the board as Incoming, the priority rubric and its score comment, the board audit                            | Model-invoked, or `/issue-triage`      |+ | [`pre-push-gate`](.claude/skills/pre-push-gate/SKILL.md)         | Running `npm run local:gate` and reading its result; what each stage checks and how to fix it when it fails; waiting on the gate lease                                                                                  | Model-invoked, or `/pre-push-gate`     |+ | [`security-advisory`](.claude/skills/security-advisory/SKILL.md) | A privately reported vulnerability end to end: the `[GHSA-…]` draft card, server or SDK ownership, the reach classes, accepting, the private fork, publishing, public tracking                                          | Model-invoked, or `/security-advisory` |+ | [`project-structure`](.claude/skills/project-structure/SKILL.md) | What is inside each server: the TypeScript and Python layouts, where each server registers its features, and where a new file goes                                                                                      | Model-invoked, or `/project-structure` |+ | [`local-dev`](.claude/skills/local-dev/SKILL.md)                 | Install, build and run each server from the checkout over the transports it implements; local `npx`/`uvx` and client-config runs; stale builds and fresh worktrees; the `overrides`, lockstep and `uv.lock` procedures  | Model-invoked, or `/local-dev`         |+ | [`testing`](.claude/skills/testing/SKILL.md)                     | The in-process protocol-level harness, test placement, the commands per suite, `test` versus `coverage`, and clearing the per-file coverage gate                                                                        | Model-invoked, or `/testing`           |+ | [`release`](.claude/skills/release/SKILL.md)                     | A milestone release end to end: the release issue, the preparation PRs on `v2/main` (audit, Version Packages, Python CalVer), the pure `v2/main` → `main` merge PR, the release ledger, and what a maintainer publishes | **Name-only**: `/release`              |+ | [`client-smoke`](.claude/skills/client-smoke/SKILL.md)           | Driving a built server with the Inspector CLI (the scripted path), the Inspector web UI (by hand) and an LLM client; the CLI's argument split and exit codes; protocol eras and what can be exercised today             | Model-invoked, or `/client-smoke`      |+ A PR that adds a skill under `.claude/skills/<name>/SKILL.md` adds its row to+ this table in the same change, and the table never lists a skill that does not+ exist. How skills are kept reachable is under+ [Maintaining the skills](#maintaining-the-skills).+ ## Project structure+ ```+ servers/+ ├── src/                      One directory per server; each publishes on its own+ │   ├── everything/           TS  @modelcontextprotocol/server-everything          npm   Exercises every MCP feature; the protocol showcase+ │   ├── filesystem/           TS  @modelcontextprotocol/server-filesystem          npm   File operations, access limited to allowed directories / Roots+ │   ├── memory/               TS  @modelcontextprotocol/server-memory              npm   Knowledge-graph persistence

Showing the first 40 of each.