v1.13.0

• MCP config scanning — .mcp.json, claude_desktop_config.json, .cursor/mcp.json, and .vscode/mcp.json are parsed structurally as a first-class detection surface: one mcp_server finding per configured server. Remote (url) servers resolve their host against the provider KB (loopback → local, env-templated → unknown); stdio servers resolve their package/binary/image against the new bundled mcp_servers.json map (npm version suffixes stripped, docker plumbing skipped); anything unmapped surfaces as an explicit unknown. A parsed config is claimed by the structural parser — no duplicate endpoint detections — and malformed JSON falls back to ordinary line scanning. Findings flow through the existing policy/waiver/report machinery with no new flags: the same residency policy that gates your code now gates your agent stack.
• KB — six service providers added (GitHub, Slack, Google Drive, Brave Search, Notion, Sentry), including Sentry's hosted remote MCP endpoint mcp.sentry.dev, found by validating against real-world configs (getsentry/sentry-mcp, apache/skywalking-banyandb, Doist/todoist-mcp).