The zero-install detector does not read MCP registration sites, so it still reports vendor MCP servers as non-agent projects

[pengfei-threemoonslab]

Product priority (2026-09-04): P0 adoption blocker. The documented first-contact detector tells a user to stop on MCP repositories the installed CLI already supports. Preserve the bounded stdlib implementation and adversarial fixtures below; #497 owns continuing parity. Do not make #484's new Python extraction a prerequisite for repairing this already-supported TypeScript/Go route.

The zero-install detector does not read MCP registration sites, so it still reports vendor MCP servers as non-agent projects

Summary

#431 taught the installed CLI to read an MCP server's tool names out of TypeScript
or Go registration sites (tool_sources[].type: mcp_server_source). The
zero-install detector, tools/shipgate-detect.py, did not gain that detection —
so the two now disagree on the one question the script exists to answer:

workspace	agents-shipgate detect	tools/shipgate-detect.py
mongodb-js/mongodb-mcp-server	is_agent_project: true, 61 tools	false — "Stop"
grafana/mcp-grafana	is_agent_project: true, 114 tools	false — "Stop"
github/github-mcp-server	is_agent_project: true, 110 tools	false — "Stop"

This matters more than an ordinary gap because the script is the documented
front door for a repository that has not adopted Shipgate — which is 100% of
the population #431 is about. An agent that curls the detector onto a vendor MCP
server gets the exact "Stop" that issue was filed to end.

Why it was not done in #431

Porting means a second implementation of the load-bearing matcher — the
masking lexer and the five idioms — into a stdlib-only single file. That is the
recurring "second implementation" bug class in this repository, and it deserves
its own increment with a drift guard rather than being appended to an already
large change.

The parity test (test_script_verdict_matches_cli) could not see the
divergence: it compares the two on samples/, and no sample contains a
TypeScript or Go MCP server. #431 therefore added
test_framework_vocabulary_names_every_cli_omission, which pins the CLI's
framework vocabulary against the script's and fails on any new omission, and
named this one in the script's own "Intentional simplifications" list.

Scope

• Port agents_shipgate.inputs.mcp_idioms's reader (masking lexer, five
  idioms, is_scannable_path) and the dependency gate into
  tools/shipgate-detect.py, stdlib-only.
• A shared conformance corpus. The positive samples and the adversarial
  sweep in tests/test_mcp_idioms.py should be driven through both
  implementations by one parametrised test, so the two cannot drift on any case
  either of them has ever been asked about. This is the part that makes the
  duplication acceptable.
• Add a samples/ fixture with a TypeScript or Go MCP server so the existing
  parity test covers the route too, and remove mcp_server_source from
  known_omissions.

Acceptance

• python3 tools/shipgate-detect.py --workspace <mongodb checkout> --json
  returns is_agent_project: true with the same suggested_sources as the CLI.
• Every case in the shipped adversarial sweep produces identical sites in
  both implementations.
• test_framework_vocabulary_names_every_cli_omission passes with an empty
  known_omissions.

[pengfei-threemoonslab]

Priority: P1, v0.18.0. The zero-install detector is the documented first command a cold maintainer runs; disagreeing with the CLI on exactly the vendor MCP servers #431 just made visible is a front-door defect, not a nice-to-have. Must land before the MCP study and before any participant-validation outreach (#456 Gate 2) points people at the script.

[pengfei-threemoonslab]

Generalized as #497: this is the first proven instance of distribution-surface drift, and there are ten such surfaces with no parity test between them. #497 proposes the table-driven test (with this exact case as a row that fails before the fix and passes after) plus a registry of which surface claims what. Fixing this issue stays the immediate work; #497 is what stops the next one.