MCP server and client inventory

Repository snapshot: 2026-10-07, slice 1 of the v2 migration; the tasks and elicitation section was added 2026-10-24. The migration target is protocol revision 2025-11-25 and the split TypeScript SDK at exact stable 2.4.0. The parent ticket’s alpha warning is stale: the npm registry lists stable 2.0.0 through 2.4.0. Protocol revision and SDK major are independent; v1 can already negotiate 2025-11-25.

The inventory covers tracked manifests, npm and Bun lockfiles, SDK imports, vendored bundles, MCP launch configurations and the policy registry. Runtime user configuration and upstream server source are not shipped here: unknown is not a compliance claim. Policy counts below are enumerated policy tools, not a live tools/list; aliases share one implementation. The first four production implementations have source-derived counts instead.

Server / client	Owner and repository evidence	SDK version	Transport	Tool count	Migration risk / disposition
luna-correlate server	marketplace/plugins/luna-correlate/{package.json,bun.lock,server.ts,.mcp.json}	Before: monolith 1.32.1; pilot target: split server 2.4.0	stdio, Bun	5	Low: low-level handlers retain JSON schemas, custom validation and text/error output. Exact pin; regression initializes, lists tools, calls offline series.load, rejects bad arguments/unknown tools and checks EOF.
jira server	scripts/jira/{package.json,package-lock.json,src/mcp.ts}; CLI mcp verb	Before: monolith 1.32.1; now split server 2.4.0 (spec 2025-11-25)	stdio, Node	14	Migrated, low-level Server kept: Jira writes, attachments, transition and roadmap dispatch and typed errors unchanged.
telegram server	marketplace/plugins/telegram-himmel/{package.json,bun.lock,server.ts,.mcp.json}	Before: monolith 1.32.1; now split server 2.4.0	stdio, Bun; Telegram network I/O is not MCP transport	4	Migrated, low-level Server kept: tools, schemas, notifications, poller gate and EOF shutdown unchanged. tests/stdio.test.ts drives a non-owner session with a dummy token and a dead proxy, no live bot.
Obsidian Local REST API embedded server	templates/luna-second-brain/.obsidian/plugins/obsidian-local-rest-api/{main.js,manifest.json}; plugin 5.4.0	Already split @modelcontextprotocol/server, core, node bundle; exact SDK release not recorded	Streamable HTTP (NodeStreamableHTTPServerTransport), sessionful/sessionless	17 base + 2 signed-URL tools + 1 event-listener tool when enabled; extensions can add more	Medium: already v2 API (McpServer.registerTool, Standard Schema adapter). Re-vendor upstream, do not codemod compiled bundle; unknown exact pin needs upstream evidence.
fake-mcp test server	scripts/testing/fixtures/fake-mcp-server.mjs	None, handwritten JSON-RPC	newline-delimited stdio, Node	1 (fake_echo)	No dependency migration. Credential-free fixture echoes requested protocol; default 2025-06-18 is not a supported-version negotiation implementation.
stdio regression test client	marketplace/plugins/luna-correlate/tests/stdio.test.ts	None, handwritten JSON-RPC test client	stdio subprocess	Calls the pilot’s 5-tool list	No SDK object crossing. Uses literal 2025-11-25 initialize and offline fixtures.
Claude Code / Codex harness clients	scripts/mcp/build-mcp-profiles.mjs, scripts/lanes/plugin-profiles.json, scripts/codex/	External binaries; no in-repo SDK client imports	Configured stdio / HTTP	Server-dependent	Generated config is not an SDK client implementation. Upgrade client binaries separately; do not infer SDK from CLI version.
qmd / plugin_qmd_qmd	marketplace/plugins/qmd/.mcp.json, policy registry	External service, exact SDK unknown	HTTP http://localhost:8181/mcp	4 policy entries	External package upgrade, not a repo codemod. Plugin and user registrations alias the same service.
shadcn / plugin_shadcn-mcp_shadcn	marketplace/plugins/shadcn-mcp/.mcp.json	External shadcn@4.21.0; SDK unknown	stdio (npx … mcp)	7 policy entries	Pin is application version, not SDK version; upstream dependency audit needed.
playwright / plugin_playwright_playwright	scripts/lanes/plugin-profiles.json mcpCatalog; profile generator; policy registry	External @playwright/mcp@0.0.83 in worker-e2e; generator fallback uses @latest; SDK unknown	stdio (npx)	25 policy entries	Browser side effects; audit upstream and resolve mutable fallback separately.
chrome-devtools	scripts/mcp/build-mcp-profiles.mjs, .claude/mcp-profiles/profiles.json	External chrome-devtools-mcp@latest; SDK unknown	stdio (npx)	Unknown, not enumerated	Mutable upstream/browser tooling; no source codemod here.
context7 / remote / plugin / claude_ai_Context7	Profile generator, profile definitions, policy registry	Hosted or external plugin; SDK unknown	Remote HTTP https://mcp.context7.com/mcp for generator; connector/plugin transport not recorded	2 policy entries each	Hosted service cannot be migrated by this repo; query text egress remains governed by policy.
obsidian-vault	Profile definitions, policy registry	External mcp-obsidian, Python SDK exact version unknown	Local server; on demand via the vault profile (spec in the on-demand registry, not ~/.claude.json)	15 policy entries	REST API compatibility and vault-write safety; separate from embedded Obsidian server above.
plugin_obsidian-second-brain_vault	Lane plugin profiles and policy registry	External plugin SDK unknown; source not vendored here	Not recorded in tracked launch config	12 policy entries	Plugin-owned migration; strict profiles may strip its server while keeping skills.
graphify	Installer/upstream registration, policy registry	External Python graphify/MCP dependency; exact SDK unknown	Local graph server; on demand via the graph profile (installer registers it in the on-demand registry, not ~/.claude.json)	10 policy entries	Python service is outside TS codemod scope; preserve graph/data routing.
onepassword	.claude/mcp-profiles/profiles.json	User-scope external SDK unknown	Resolved from user configuration	Unknown, not enumerated	Secrets integration; operator-owned upgrade, not a repo migration.
tokensave	Policy registry and fleet cleanup references	External SDK unknown	Local service; transport not pinned here	6 policy entries	External code-index server, no implementation in tracked source.
himmelprobe	Policy registry	Unknown; no tracked implementation found	Not recorded	1 policy entry	Registry entry alone is not evidence of an installed server.
claude_ai_Atlassian_MCP / plugin_atlassian_atlassian	Policy registry	Hosted / external SDK unknown	Connector/plugin transport not recorded	7 connector policy entries; plugin unenumerated	Prefer Jira CLI; hosted/backend policy is independent of SDK migration.
claude_ai_Claude_Docs	Policy registry	Hosted SDK unknown	Connector transport not recorded	8 policy entries	Provider-owned; no local codemod.
claude_ai_Gmail	Policy registry	Hosted SDK unknown	Connector transport not recorded	30 policy entries	Provider-owned; sending/deleting policy unchanged.
claude_ai_Google_Calendar	Policy registry	Hosted SDK unknown	Connector transport not recorded	9 policy entries	Provider-owned; no local codemod.
claude_ai_Google_Drive	Policy registry	Hosted SDK unknown	Connector transport not recorded	11 policy entries	Provider-owned; sharing/deleting policy unchanged.
claude-in-chrome	Policy registry	External SDK unknown	Browser integration; transport not pinned here	11 policy entries	Operator browser and arbitrary-JS surface; no local source migration.
plugin_builder-visual_agent-native-dispatch	Policy registry	Hosted Builder.io SDK unknown	Hosted transport not recorded	Unknown, unenumerated	Provider-owned; egress guard remains authoritative.
himmel-bus server	Implemented: marketplace/plugins/himmel-bus/server/index.mjs	Split server/client 2.4.0 (exact pin)	stdio, Node	2 (send, read)	New-on-v2, not a remaining v1 migration.

Tasks and elicitation (protocol 2026-07-28)

Target row: protocol revision 2026-07-28 adds tasks and elicitation. The 2026-10-24 audit recorded that tasks need a 2026-07-28 connection and a Claude Code client of 2.1.304 or later (this station runs 2.1.310); neither is verified against the specification here. The 2025-11-25 migration target above is unchanged; 2026-07-28 is the next target, not yet adopted. Nothing here is a live probe: a cell is unverified unless a source file is named. The “No” cells mean the inspected local source does not use tasks or the 2026-07-28 input-required elicitation flow; external and hosted servers stay unverified.

Server	Tasks	Elicitation	Evidence
qmd (fork)	Possible: SDK 2.3.1 bundles 2026-07-28 code; not yet returned from a query	Unverified	A query returning a task is not yet verified
himmel-bus	No: send and read are plain calls	No	marketplace/plugins/himmel-bus/server/index.mjs, SDK 2.4.0
jira MCP	No: 14 plain tool calls	No	scripts/jira/src/mcp.ts, SDK 2.4.0; not registered on this station
luna-correlate	No: 5 plain tool calls	No	marketplace/plugins/luna-correlate/server.ts, SDK 2.4.0
graphify MCP	Unverified	Unverified	External Python server, SDK unknown
obsidian-vault	Unverified; pins mcp 1.28.1 (v1), so unlikely	Unverified	External mcp-obsidian
context7	Unverified	Unverified	Hosted service
Atlassian	Unverified	Unverified	Hosted connector or plugin; prefer the Jira CLI

Blockers

• Per the audit, a subagent’s MCP calls do not become tasks; whether a server may still create one depends on the client advertising task support and the server’s decision, which is unverified here.
• Per the audit, claude -p without --output-format stream-json gets no tasks; this is unverified against the Claude CLI reference.
• claude --bg and third-party-provider sessions are pending the probe in HIMMEL-7304.

Pilot migration

The official @modelcontextprotocol/codemod@2.3.1 v1-to-v2 . is run at the pilot package root, first with --dry-run. It replaces the server/stdio imports and schema-constant handler registration with literal method names (tools/list, tools/call). Keep the low-level Server: replacing it with high-level McpServer.registerTool would also change schema validation and unknown-tool error dispatch, contrary to this pilot’s behavior-preservation contract. The five JSON schemas and business logic remain unchanged.

The codemod emits a caret dependency; tighten it to exact 2.4.0, regenerate bun.lock, and remove the v1 monolith only after no imports remain. The plugin manifest advances from 0.2.6 through 0.2.7 and 0.2.8 to 0.2.9 (schema-baseline and warm-upgrade review fixes); the existing wire server identity is intentionally unchanged. Tests use no client SDK and never pass objects between SDK majors. Startup always refreshes dependencies with bun install --frozen-lockfile --no-summary, sending installer diagnostics to stderr so stdout remains JSON-RPC-only. An existing node_modules directory is not evidence that the new dependency is installed. The stdio regression starts an isolated package with an existing but empty dependency directory. Dependency installation may contact the package registry; it is separate from tool egress. Only factors.cache retains the existing public-network tool path; the new stdio test calls no network tool.

Staged completion

• Jira CLI server migration (done, #2140).
• telegram-himmel server migration (done, #2144).
• Doctor/CI lint against new v1 dependencies/imports, with explicit vendored/external policy (done, see below).

The v1 gate

bash scripts/lint/check-mcp-sdk-v1.sh refuses a tracked package.json dependency on, a lockfile entry for (npm, bun, yarn, pnpm; direct or transitive), or an import/require of @modelcontextprotocol/sdk. It runs as the no-mcp-sdk-v1 pre-commit hook, as doctor row C58-mcp-sdk-v1 (WARN), and scripts/lint/test-check-mcp-sdk-v1.sh runs it on the real tree in the shell suite. Every first-party server is already on v2, so the gate is global.

Vendored third-party bundles (*/.obsidian/plugins/*) are not scanned as source: a bundle embedding the v1 monolith is refused, and one embedding the v2 packages prints a NOTE that its exact version is unknown. Externally configured servers (npx, hosted, .mcp.json) are not scanned; the gate prints a NOTE saying so. Neither is ever reported as compliant.

Slice 1 does not complete the migration. Exact unknown external/bundled versions are not silently counted as compliant.

Reproduce the inventory

From the repository root, inspect git grep -n @modelcontextprotocol/ and git ls-files '*package.json' '*bun.lock' '*package-lock.json' '*mcp*'. Read the embedded bundle’s node_modules/@modelcontextprotocol/… comments, this.tool registrations, and HTTP transport construction; do not execute it outside Obsidian. Cross-check .mcp.json, .claude/mcp-profiles/profiles.json, scripts/mcp/build-mcp-profiles.mjs, scripts/lanes/plugin-profiles.json and scripts/guardrails/mcp-policy.json. There are no tracked production TS SDK client imports at this snapshot.

Run the pilot through bash scripts/plugin-test.sh luna-correlate, which bootstraps dependencies before bun test. Record actual RED/GREEN evidence in the PR/handover; this inventory is not a claim that an unrun test passed.

References: official v1-to-v2 migration guide, server package registry, MCP specification 2025-11-25.