buddy-agent-harness 0.10.0 → 0.11.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/dist/cli.mjs

@@ -17876,6 +17876,13 @@ function transportOf(entry) {
 * is a string is not a timeout, and letting it into the model would report a divergence whose real
 * cause is a typo the finding does not name.
 */
+/**
+* Exported for `mcp-inventory.ts`, which reads a handful of sources this module's own `McpConfig`
+* shape cannot describe — a plugin's flat `.mcp.json`, a project entry nested inside `~/.claude.json`,
+* and hosts whose `command` is an array or an object rather than a string. Each of those normalizes
+* its raw entry into this same field shape before calling this function, so one reader still decides
+* what counts as `transport`, `args`, and the rest.
+*/
 function serverFrom(entry) {
 	const args = Array.isArray(entry["args"]) && entry["args"].every((item) => typeof item === "string");
 	const transport = transportOf(entry);

package/dist/index.d.mts

@@ -110,7 +110,7 @@ type NonstandardArtifact = {
 };
 //#endregion
 //#region src/harness-registry/harness-registry.d.ts
-type HarnessName = "claude-code" | "cursor" | "codex" | "copilot-cli" | "gemini-cli" | "devin-desktop" | "windsurf";
+type HarnessName = "claude-code" | "cursor" | "codex" | "copilot-cli" | "gemini-cli" | "devin-desktop" | "windsurf" | "vscode" | "opencode" | "zed";
 /** The two scopes a harness reads configuration at. Their roots differ; their shape does not. */
 type HarnessScopeName = "project" | "user";
 /**
@@ -599,10 +599,46 @@ type InitializeResult = {
 export declare function initializeHarnesses({ root, harnesses: preferred, copy, force }: InitializeOptions): InitializeResult;
 //#endregion
 //#region src/mcp-inventory/mcp-inventory.d.ts
+/**
+ * A public, redaction-safe inventory of configured MCP servers: what `diagnoseMcp` already knows how
+ * to read, reshaped for a consumer that wants a list rather than a drift diagnosis.
+ *
+ * This is a **different question** than `doctor` answers, not a wider version of it. `doctor`
+ * compares project-scope configuration against a golden set the user authors, and stays
+ * project-scope only by design — see `apps/web/src/content/docs/agent-configuration/mcp-servers.md`
+ * for why reading a user's home directory is a wider blast radius than diagnosis needs. An inventory
+ * has no golden set to compare against and nothing to diagnose; it answers "what MCP servers does
+ * this project, and this machine, already have configured", which is a question a consumer can only
+ * answer by reading both scopes. Adding user scope here changes nothing about what `doctor` reads:
+ * `diagnoseMcp` still touches `harness.project.mcpConfig` alone.
+ *
+ * Beyond `harnessRegistry`'s own harnesses this module also covers sources `doctor` never diagnoses
+ * at all and that carry no `harnessRegistry` entry: VS Code, Windsurf/Devin Desktop's legacy config
+ * path, OpenCode, and Zed at both scopes; Claude Code's project-local servers nested inside
+ * `~/.claude.json`; and the MCP servers an installed Claude Code plugin ships. None of this changes
+ * `selectHarnesses`, `diagnoseMcp`, or `doctor`'s project-scope-only policy — this module reads none
+ * of it through those functions.
+ *
+ * Every field that could carry a credential is reduced before it leaves this module, the same
+ * discipline `mcp-secrets.ts` documents for `doctor`'s own findings: `command` is trimmed to its
+ * basename, `args` drops any `--flag=value` pair `nonSecretArgs` flags, and `url` is trimmed to its
+ * origin and path. `env` and `headers` are not returned at all — a name alone does not say whether
+ * the value behind it is a literal or a reference, and the safe answer is not to carry the map.
+ */
+/**
+ * The two scopes `harnessRegistry` knows, plus the two this module adds on top of it.
+ *
+ * `local` is Claude Code's project-scoped entry inside the user-level `~/.claude.json` — a server
+ * declared for one project only, not visible to any other. `plugin` is a server an installed Claude
+ * Code plugin ships; `McpServerEntry.plugin` names which one. Neither fits `project` (there is no
+ * project-scope file) or `user` (the entry does not apply to every project), so both get their own
+ * name rather than being folded into the nearer of the two and read wrong.
+ */
+type McpServerScope = HarnessScopeName | "local" | "plugin";
 /** One configured MCP server, redacted of everything that could carry a credential. */
 type McpServerEntry = {
   harness: HarnessName;
-  scope: HarnessScopeName;
+  scope: McpServerScope;
   /** The absolute path of the config file this entry was read from. */
   configFile: string;
   /** The name the server is declared under. */
@@ -615,24 +651,28 @@ type McpServerEntry = {
   /** The URL's origin and path, never its query string. */
   url: string | undefined;
   enabled: boolean;
+  /** The plugin id this server came from, set only when `scope` is `'plugin'`. */
+  plugin?: string;
 };
 type ListMcpServersOptions = {
   /** The project directory to read project-scope configuration from. */
   projectDir: string;
   /** Overrides `os.homedir()`, for a test that must not touch the real one. */
   homeDir?: string;
-  /** Overrides `process.env`, for a test — read only for `CODEX_HOME` and `COPILOT_HOME`. */
+  /** Overrides `process.env`, for a test — read only for `CODEX_HOME`, `COPILOT_HOME`, and `XDG_CONFIG_HOME`. */
   env?: Readonly<Record<string, string | undefined>>;
+  /** Overrides `os.platform()`, so the VS Code user directory is testable on every OS. */
+  platform?: NodeJS.Platform;
 };
 /**
  * Every MCP server configured for a project, across every supported harness and every scope that
  * harness documents — without ever surfacing a credential.
  *
- * Reuses `diagnoseMcp`'s own parsing (`parseTarget`), model (`McpServer`), and redaction
- * (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading or
- * re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one whose
- * file does not parse, contributes no entries; this function reports an inventory, not a diagnosis,
- * so it has nothing to say about why a file is missing or broken.
+ * Reuses `diagnoseMcp`'s own parsing (`parseTarget`, `serverFrom`), model (`McpServer`), and
+ * redaction (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading
+ * or re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one
+ * whose file does not parse, contributes no entries; this function reports an inventory, not a
+ * diagnosis, so it has nothing to say about why a file is missing or broken.
  */
 export declare function listMcpServers(options: ListMcpServersOptions): McpServerEntry[];
 //#endregion

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/cli.ts","../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts","../src/mcp-inventory/mcp-inventory.ts"],"mappings":";;;;;;;;;;;;;wBAiDsB,IAAI,iBAAiB;;;;;;;;;;;;;;;KCrC/B;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAUA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;qBAuBD,0BAA0B;;;;KCzE3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;wBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCbA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;qBAyLJ,wBAAwB;qBA4CxB,6BAA6B;qBAuM7B,wBAAwB;qBAOxB;WACZ;WACA;;;;;;;;;;wBAmCe,kBAAkB;;;;KC/kBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;wBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;wBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;qBAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;wBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;qBCAC;;;qBCAA,aAAa,MAAI;qBAoDjB,gBAAgB,MAAI;wBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;wBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB;;;;KC0DX;EACX,SAAS;EACT,OAAO;;EAEP;;EAEA;EACA,WAAW;;EAEX;;EAEA;;EAEA;EACA;;KAGW;;EAEX;;EAEA;;EAEA,MAAM,SAAS;;;;;;;;;;;;wBAuCA,eAAe,SAAS,wBAAwB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/cli.ts","../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts","../src/mcp-inventory/mcp-inventory.ts"],"mappings":";;;;;;;;;;;;;wBAiDsB,IAAI,iBAAiB;;;;;;;;;;;;;;;KCrC/B;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAqBA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;qBAuBD,0BAA0B;;;;KCpF3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;wBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCbA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;qBAyLJ,wBAAwB;qBA4CxB,6BAA6B;qBAuM7B,wBAAwB;qBAOxB;WACZ;WACA;;;;;;;;;;wBAmCe,kBAAkB;;;;KC/kBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;wBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;wBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;qBAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;wBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;qBCAC;;;qBCAA,aAAa,MAAI;qBAoDjB,gBAAgB,MAAI;wBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;wBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KCmBX,iBAAiB;;KA2DjB;EACX,SAAS;EACT,OAAO;;EAEP;;EAEA;EACA,WAAW;;EAEX;;EAEA;;EAEA;EACA;;EAEA;;KAGW;;EAEX;;EAEA;;EAEA,MAAM,SAAS;;EAEf,WAAW,OAAO;;;;;;;;;;;;wBAwNH,eAAe,SAAS,wBAAwB"}

package/dist/index.mjs

@@ -1564,6 +1564,13 @@ function transportOf(entry) {
 * is a string is not a timeout, and letting it into the model would report a divergence whose real
 * cause is a typo the finding does not name.
 */
+/**
+* Exported for `mcp-inventory.ts`, which reads a handful of sources this module's own `McpConfig`
+* shape cannot describe — a plugin's flat `.mcp.json`, a project entry nested inside `~/.claude.json`,
+* and hosts whose `command` is an array or an object rather than a string. Each of those normalizes
+* its raw entry into this same field shape before calling this function, so one reader still decides
+* what counts as `transport`, `args`, and the rest.
+*/
 function serverFrom(entry) {
 	const args = Array.isArray(entry["args"]) && entry["args"].every((item) => typeof item === "string");
 	const transport = transportOf(entry);
@@ -2740,25 +2747,6 @@ async function run(argv) {
 }
 //#endregion
 //#region src/mcp-inventory/mcp-inventory.ts
-/**
-* A public, redaction-safe inventory of configured MCP servers: what `diagnoseMcp` already knows how
-* to read, reshaped for a consumer that wants a list rather than a drift diagnosis.
-*
-* This is a **different question** than `doctor` answers, not a wider version of it. `doctor`
-* compares project-scope configuration against a golden set the user authors, and stays
-* project-scope only by design — see `apps/web/src/content/docs/agent-configuration/mcp-servers.md`
-* for why reading a user's home directory is a wider blast radius than diagnosis needs. An inventory
-* has no golden set to compare against and nothing to diagnose; it answers "what MCP servers does
-* this project, and this machine, already have configured", which is a question a consumer can only
-* answer by reading both scopes. Adding user scope here changes nothing about what `doctor` reads:
-* `diagnoseMcp` still touches `harness.project.mcpConfig` alone.
-*
-* Every field that could carry a credential is reduced before it leaves this module, the same
-* discipline `mcp-secrets.ts` documents for `doctor`'s own findings: `command` is trimmed to its
-* basename, `args` drops any `--flag=value` pair `nonSecretArgs` flags, and `url` is trimmed to its
-* origin and path. `env` and `headers` are not returned at all — a name alone does not say whether
-* the value behind it is a literal or a reference, and the safe answer is not to carry the map.
-*/
 /** Where a harness keeps its **user-scope** MCP configuration, as that harness documents it.
 *
 * Unlike `harnessRegistry`, this table is read only from here: it is not wired into `doctor`, and
@@ -2826,7 +2814,7 @@ function safeUrl(value) {
 		return;
 	}
 }
-function toEntry(harness, scope, file, name, server) {
+function toEntry(harness, scope, file, name, server, plugin) {
 	return {
 		harness,
 		scope,
@@ -2836,7 +2824,8 @@ function toEntry(harness, scope, file, name, server) {
 		command: server.command ? basename(server.command) : void 0,
 		args: nonSecretArgs(server.args),
 		url: safeUrl(server.url),
-		enabled: server.enabled !== false
+		enabled: server.enabled !== false,
+		...plugin ? { plugin } : {}
 	};
 }
 function entriesFrom(harness, scope, file, config) {
@@ -2845,18 +2834,195 @@ function entriesFrom(harness, scope, file, config) {
 	return [...parsed.servers].map(([name, server]) => toEntry(harness, scope, file, name, server));
 }
 /**
+* A raw entry reshaped so `serverFrom` recognizes fields the registry-driven harnesses never write:
+* OpenCode's `command` as an array (its first element is the command, the rest are args), Zed's
+* `command` as `{ path, args }`, and Windsurf's `serverUrl` as an alias for `url`. A field none of
+* those apply to is passed through unchanged.
+*/
+function normalizeRawEntry(raw) {
+	const command = raw["command"];
+	if (Array.isArray(command)) {
+		const [first, ...rest] = command;
+		return {
+			...raw,
+			command: first,
+			args: raw["args"] ?? rest
+		};
+	}
+	if (isRecord(command)) return {
+		...raw,
+		command: command["path"],
+		args: raw["args"] ?? command["args"]
+	};
+	if (raw["url"] === void 0 && typeof raw["serverUrl"] === "string") return {
+		...raw,
+		url: raw["serverUrl"]
+	};
+	return raw;
+}
+/** Every server under `key` in an already-parsed JSON(C) document, normalized and converted. */
+function serversFromDocument(document, key) {
+	const table = isRecord(document) ? document[key] : void 0;
+	if (!isRecord(table)) return /* @__PURE__ */ new Map();
+	return new Map(Object.entries(table).filter((pair) => isRecord(pair[1])).map(([name, entry]) => [name, serverFrom(normalizeRawEntry(entry))]));
+}
+function entriesFromDocument(harness, scope, file, document, key, options = {}) {
+	return [...serversFromDocument(document, key)].map(([name, server]) => {
+		const entry = toEntry(harness, scope, file, name, server, options.plugin);
+		return options.forceDisabled ? {
+			...entry,
+			enabled: false
+		} : entry;
+	});
+}
+/** Where VS Code keeps its user-scope settings, per platform — mirrors what VS Code itself documents. */
+function vscodeUserDir(env, home, plat) {
+	if (plat === "win32") return join(env["APPDATA"] || join(home, "AppData", "Roaming"), "Code", "User");
+	if (plat === "darwin") return join(home, "Library", "Application Support", "Code", "User");
+	return join(env["XDG_CONFIG_HOME"] || join(home, ".config"), "Code", "User");
+}
+/**
+* Sources `harnessRegistry` carries no entry for at all, so they cannot be read through
+* `userScopeConfig` or a harness's `project.mcpConfig`. Each of these harnesses is either not one
+* `doctor` diagnoses (VS Code, OpenCode, Zed have no `HarnessScope.mcpConfig`) or is diagnosed under
+* a different name than the one its own vendor uses for this file: Windsurf was rebranded to Devin
+* Desktop (`.research/agentic-configuration-standards/evidence.md`, E-WS-02), and
+* `~/.codeium/windsurf/mcp_config.json` is that product's legacy config path, read here under
+* `devin-desktop` rather than under a separate `windsurf` MCP source. This is a deliberate departure
+* from `repobuddy`'s scanner, which has no such mapping and reports the file under a standalone
+* `windsurf` harness name.
+*/
+function extraSources(projectDir, home, env, plat) {
+	const xdg = env["XDG_CONFIG_HOME"] || join(home, ".config");
+	return [
+		{
+			harness: "vscode",
+			scope: "user",
+			file: join(vscodeUserDir(env, home, plat), "mcp.json"),
+			key: "servers"
+		},
+		{
+			harness: "vscode",
+			scope: "project",
+			file: join(projectDir, ".vscode", "mcp.json"),
+			key: "servers"
+		},
+		{
+			harness: "devin-desktop",
+			scope: "user",
+			file: join(home, ".codeium", "windsurf", "mcp_config.json"),
+			key: "mcpServers"
+		},
+		{
+			harness: "opencode",
+			scope: "user",
+			file: join(xdg, "opencode", "opencode.json"),
+			key: "mcp"
+		},
+		{
+			harness: "opencode",
+			scope: "project",
+			file: join(projectDir, "opencode.json"),
+			key: "mcp"
+		},
+		{
+			harness: "zed",
+			scope: "user",
+			file: join(xdg, "zed", "settings.json"),
+			key: "context_servers"
+		},
+		{
+			harness: "zed",
+			scope: "project",
+			file: join(projectDir, ".zed", "settings.json"),
+			key: "context_servers"
+		}
+	];
+}
+/**
+* Claude Code's project-local servers: `~/.claude.json`'s `projects["<absolute project dir>"]
+* .mcpServers`, a server declared for this one project rather than every project the way the file's
+* top-level `mcpServers` (read as `'user'` scope, above) is.
+*/
+function claudeLocalEntries(home, projectDir) {
+	const file = join(home, ".claude.json");
+	const text = read(file);
+	if (text === void 0) return [];
+	const document = parseJsonWithComments(text);
+	const projects = isRecord(document) ? document["projects"] : void 0;
+	const project = isRecord(projects) ? projects[resolve(projectDir)] : void 0;
+	if (!isRecord(project)) return [];
+	return entriesFromDocument("claude-code", "local", file, project, "mcpServers");
+}
+/** `enabledPlugins`, merged from global settings up through project-local settings, last write wins. */
+function enabledPlugins(home, projectDir) {
+	const enabled = {};
+	for (const file of [
+		join(home, ".claude", "settings.json"),
+		join(projectDir, ".claude", "settings.json"),
+		join(projectDir, ".claude", "settings.local.json")
+	]) {
+		const text = read(file);
+		if (text === void 0) continue;
+		const document = parseJsonWithComments(text);
+		const table = isRecord(document) ? document["enabledPlugins"] : void 0;
+		if (!isRecord(table)) continue;
+		for (const [id, value] of Object.entries(table)) if (typeof value === "boolean") enabled[id] = value;
+	}
+	return enabled;
+}
+/**
+* MCP servers shipped by installed Claude Code plugins, with `enabled` reflecting whether the plugin
+* itself is enabled for this project — a plugin not set to `true` in the merged `enabledPlugins` is
+* disabled, and every server it ships is reported disabled regardless of that server's own field. An
+* install whose `projectPath` names a different project contributes nothing: that install is not
+* this project's.
+*/
+function pluginEntries(home, projectDir) {
+	const text = read(join(home, ".claude", "plugins", "installed_plugins.json"));
+	if (text === void 0) return [];
+	const document = parseJsonWithComments(text);
+	const installed = isRecord(document) ? document["plugins"] : void 0;
+	if (!isRecord(installed)) return [];
+	const enabled = enabledPlugins(home, projectDir);
+	const absoluteProject = resolve(projectDir);
+	const entries = [];
+	for (const [id, list] of Object.entries(installed)) {
+		if (!Array.isArray(list)) continue;
+		for (const install of list) {
+			if (!isRecord(install)) continue;
+			const projectPath = install["projectPath"];
+			if (typeof projectPath === "string" && resolve(projectPath) !== absoluteProject) continue;
+			const installPath = install["installPath"];
+			if (typeof installPath !== "string") continue;
+			const mcpFile = join(installPath, ".mcp.json");
+			const mcpText = read(mcpFile);
+			if (mcpText === void 0) continue;
+			const mcpDocument = parseJsonWithComments(mcpText);
+			if (!isRecord(mcpDocument)) continue;
+			const document2 = isRecord(mcpDocument["mcpServers"]) ? mcpDocument : { mcpServers: mcpDocument };
+			entries.push(...entriesFromDocument("claude-code", "plugin", mcpFile, document2, "mcpServers", {
+				plugin: id,
+				forceDisabled: enabled[id] !== true
+			}));
+		}
+	}
+	return entries;
+}
+/**
 * Every MCP server configured for a project, across every supported harness and every scope that
 * harness documents — without ever surfacing a credential.
 *
-* Reuses `diagnoseMcp`'s own parsing (`parseTarget`), model (`McpServer`), and redaction
-* (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading or
-* re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one whose
-* file does not parse, contributes no entries; this function reports an inventory, not a diagnosis,
-* so it has nothing to say about why a file is missing or broken.
+* Reuses `diagnoseMcp`'s own parsing (`parseTarget`, `serverFrom`), model (`McpServer`), and
+* redaction (`nonSecretArgs`, and the URL/command trimming this module adds) rather than re-reading
+* or re-parsing any of the supported harnesses' MCP files. A harness with no file present, or one
+* whose file does not parse, contributes no entries; this function reports an inventory, not a
+* diagnosis, so it has nothing to say about why a file is missing or broken.
 */
 function listMcpServers(options) {
 	const home = options.homeDir ?? homedir();
 	const env = options.env ?? process.env;
+	const plat = options.platform ?? platform();
 	const entries = [];
 	for (const harness of harnessRegistry) {
 		if (harness.deprecated) continue;
@@ -2865,6 +3031,15 @@ function listMcpServers(options) {
 		const user = userScopeConfig(harness.name, home, env);
 		if (user) entries.push(...entriesFrom(harness.name, "user", user.file, user.config));
 	}
+	entries.push(...claudeLocalEntries(home, options.projectDir));
+	entries.push(...pluginEntries(home, options.projectDir));
+	for (const source of extraSources(options.projectDir, home, env, plat)) {
+		const text = read(source.file);
+		if (text === void 0) continue;
+		const document = parseJsonWithComments(text);
+		if (document === void 0) continue;
+		entries.push(...entriesFromDocument(source.harness, source.scope, source.file, document, source.key));
+	}
 	return entries;
 }
 //#endregion