vpsnet-mcp 2.3.14 → 2.3.15

package/README.md

@@ -40,6 +40,8 @@ endpoint and task skills. The npm package supplies the local MCP server;
 installable plugin bundles also carry the AI application's manifest and skills.
 
 Build all client bundles with `python3 scripts/package-distribution.py`.
+The same build creates four [self-contained skill imports](docs/STANDALONE_SKILLS.md)
+for clients that import one skill folder or ZIP at a time.
 The output includes checksums and identifies each format. Public directory
 submission materials are in [the catalog kit](distribution/catalogs/README.md).
 
@@ -337,7 +339,10 @@ Choose your environment:
 - [VS Code with GitHub Copilot](#vs-code-with-github-copilot) — Copilot agent mode
 - [Cline](#cline) / [Cursor](#cursor) / [Windsurf](#windsurf) / [Roo Code](#roo-code) / [Codex](#codex) — Other clients
 
-The standard config works across most MCP clients:
+The following local stdio example uses the `mcpServers` configuration format
+supported by several MCP clients. Use your client's native schema; VS Code's
+`.vscode/mcp.json` uses `servers` instead. For customer OAuth and the hosted
+connector, use [AI client setup](docs/CLIENTS.md).
 
 ```json
 {
@@ -495,7 +500,8 @@ Go to **Cursor Settings** > **MCP** > **Add new MCP Server**. Use command type w
 <details>
 <summary>Roo Code</summary>
 
-Open Roo Code MCP settings and add to `roo_mcp_settings.json`:
+Open Roo Code MCP settings and choose **Edit Global MCP** (currently
+`mcp_settings.json`), or **Edit Project MCP** for `.roo/mcp.json`:
 
 ```json
 {
@@ -516,24 +522,74 @@ Open Roo Code MCP settings and add to `roo_mcp_settings.json`:
 </details>
 
 <details>
-<summary>VS Code with GitHub Copilot</summary>
+<summary id="vs-code-with-github-copilot">VS Code with GitHub Copilot</summary>
 
-Install using the VS Code CLI:
+For the hosted customer OAuth connection, run **MCP: Add Server** and enter
+`https://mcp.vpsnet.com/mcp`, or merge this native VS Code entry into
+`.vscode/mcp.json`, preserving other servers:
+
+```json
+{
+  "servers": {
+    "vpsnet": {
+      "type": "http",
+      "url": "https://mcp.vpsnet.com/mcp"
+    }
+  }
+}
+```
+
+Complete the browser sign-in and consent flow when requested. Copilot's portable
+workspace `.mcp.json` and user `~/.copilot/mcp-config.json` use a top-level
+`mcpServers` object instead. These formats are distinct from the Claude Code
+extension's configuration.
+
+For the separate local stdio package with your own VPSnet API key, install using
+the VS Code CLI:
 
 ```bash
 code --add-mcp '{"name":"vpsnet","command":"npx","args":["-y","vpsnet-mcp"],"env":{"VPSNET_API_KEY":"your_api_key_here"}}'
 ```
 
-Or add to your VS Code MCP config manually using the standard config above.
+For manual native VS Code configuration, place that local server's `command`,
+`args` and private `env` under `servers.vpsnet`, rather than copying the generic
+`mcpServers` wrapper. VS Code's **MCP: Reset Cached Tools** refreshes a stale
+tool catalog. See [official MCP configuration](https://code.visualstudio.com/docs/agents/reference/mcp-configuration).
 
 > This is for **GitHub Copilot** agent mode in VS Code. For the **Claude Code** extension, see the [Claude Code for VS Code Extension](#claude-code-for-vs-code-extension) section.
 
 </details>
 
 <details>
-<summary>Windsurf</summary>
+<summary id="windsurf">Windsurf / Devin Desktop</summary>
+
+Current official Windsurf documentation redirects to Devin Desktop. Choose the
+agent you are using: legacy Cascade and the current Devin Local agent have
+different MCP setup paths.
+
+For Devin Local, add and authenticate the hosted connector with the Devin CLI:
+
+```sh
+devin mcp add vpsnet https://mcp.vpsnet.com/mcp
+devin mcp login vpsnet --scopes services:read
+```
 
-Follow the [Windsurf MCP documentation](https://docs.windsurf.com/windsurf/mcp). Use the standard config above.
+This requests a read baseline. Request the documented scopes required for other
+tasks through a new authorization flow before approving them. If authorization
+is lost, use the Desktop **Authenticate** action, or `devin mcp logout vpsnet`
+followed by the login command. Current CLI versions use dedicated
+`.devin/mcp_config.json`, `.devin/mcp_config.local.json` or user
+`~/.config/devin/mcp_config.json` files.
+
+For legacy Cascade, open the panel's **Actions → Open MCP config file** and merge
+a server under `mcpServers` with `serverUrl: "https://mcp.vpsnet.com/mcp"`.
+Complete its OAuth flow. Cascade has a 100-tool total limit, so inspect the
+enabled tools. The local stdio example above is a separate API-key connection.
+
+Follow the official [Devin Local MCP guide](https://docs.devin.ai/cli/extensibility/mcp/configuration)
+or [legacy Cascade guide](https://docs.devin.ai/desktop/cascade/mcp) for your
+surface. Client authentication and VPSnet compatibility still need verification
+on the actual client version.
 
 </details>
 

package/build/remote-policy.js

@@ -8,6 +8,7 @@ export const remoteInstructions = [
     "Firecracker VPS supports general-purpose and resource-intensive Linux workloads with substantial server resources and low virtualization overhead. MicroVM describes the lightweight design, not a small server limit. Consider it when KVM-specific features are unnecessary; match current plans to resource and availability requirements.",
     "Cloud VPS (KVM) offers Linux and BSD support, automatic Windows Server provisioning, three-copy Ceph NVMe storage on enterprise drives with power-loss protection (PLP), HA restart on another host after host failure, and live migration to another node for planned host upgrades, with migration back when appropriate.",
     "Use the connected VPSnet account and only the services and permissions it granted. Never request a model API key.",
+    "On first VPSnet use in a conversation, call get_update_info once when available. Read an installed skill's bundled plugin-version reference if accessible; otherwise omit pluginVersion rather than infer it from clientInfo.version or repository HEAD. Keep checked/dismissed state only in conversation context. If an actually observed plugin/local version is older, give one concise native update advisory and continue the task. For unknown/current versions or unavailable release facts, stay quiet unless the user asks about updates. Never force an update, change grants or treat a published runtime as proof of deployment.",
     "Tool discovery describes supported capabilities, not granted authority. Compare the scopes and selected services from get_connected_account with each tool's required scope metadata. Explain missing permissions only when relevant to the user's task. Ask the customer to approve the required permission by re-authorizing this existing VPSnet connection through the AI app's OAuth flow; never work around a denial.",
     "Inspect current capabilities and state before a change. Honor the user's existing authorization; obtain consent when a change expands the task, destroys unrelated data or adds unapproved exposure.",
     "Keep operation IDs, reason codes and idempotency keys. Accepted means pending; read the final state before claiming success.",
@@ -118,7 +119,7 @@ const permissions = new Map([
     ["get_system_status", "authenticated"],
     ["get_faq", "authenticated"],
     ["get_pricing", "authenticated"],
-    ["get_connected_account", "authenticated"],
+    ["get_connected_account", "authenticated"], ["get_update_info", "authenticated"],
     ["open_vm_session", "vm:session"], ["run_vm_command", "vm:exec"], ["read_vm_file", "vm:files:read"],
     ["write_vm_file", "vm:files:write"], ["create_vm_file", "vm:files:write"], ["inspect_vm", "vm:diagnostics"], ["get_vm_operation", "vm:session"], ["cancel_vm_operation", "vm:session"],
 ]);
@@ -227,7 +228,14 @@ export function installRemotePolicy(server, scopes, profile = 'directory') {
             return setRequestHandler(schema, handler);
         return setRequestHandler(schema, async (...args) => {
             const response = await handler(...args);
-            return { ...response, tools: response.tools.filter((tool) => !legacyAggregateTools.has(tool.name)) };
+            return { ...response, tools: response.tools
+                    .filter((tool) => !legacyAggregateTools.has(tool.name))
+                    // SDK registerTool preserves _meta but drops unknown top-level config
+                    // fields. Add the canonical declaration to the emitted descriptor,
+                    // using exactly the same scopes as its compatibility mirror.
+                    .map((tool) => ({
+                    ...tool, securitySchemes: tool._meta?.securitySchemes,
+                })) };
         });
     });
     const original = server.registerTool.bind(server);

package/build/remote-tools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { randomBytes } from 'node:crypto';
 import { apiRequest, resolveApiBase } from './api.js';
+import { getUpdateInfo, updateInfoOutput } from './update-info.js';
 const resource = { orderNo: z.string().regex(/^[A-Za-z0-9-]{1,64}$/), sessionBinding: z.string().regex(/^[a-f0-9]{32}$/, 'sessionBinding must contain exactly 32 lowercase hexadecimal characters (0-9, a-f), without hyphens. For a new open_vm_session call, omit it so VPSnet creates it; otherwise reuse the returned sessionBinding.').describe('Exactly 32 lowercase hexadecimal characters (0-9, a-f), without hyphens. Copy sessionBinding from open_vm_session and reuse it for every operation and reconnect. Not a credential.') };
 const session = { ...resource, sessionId: z.string().uuid() };
 const idempotencyKey = z.string().regex(/^[A-Za-z0-9_-]{16,128}$/).describe('Stable key for this exact operation. Reuse after a lost response; never automatically replace.');
@@ -76,9 +77,23 @@ async function operationResult(orderNo, sessionBinding, operationId, cancel = fa
     return runtime(await lease(orderNo, sessionBinding, true), cancel ? 'POST' : 'GET', `/mcp/operations/${operationId}${cancel ? '/cancel' : ''}`, cancel ? {} : undefined);
 }
 export function registerRemoteTools(server) {
+    server.registerTool('get_update_info', {
+        description: 'Read public VPSnet releases and reviewed client update guidance without changing software, credentials or permissions. On first VPSnet use in a conversation, check once when available. Pass installed versions only if actually observed or user-reported; never infer them from host clientInfo.version or the gateway runtime. Unknown installed versions stay unknown. If an observed version is older, give one concise advisory and continue; otherwise stay quiet unless the user asks about updates. Remember checks and dismissals in conversation context, not customer tracking. VPSnet maintains the hosted gateway.',
+        inputSchema: {
+            client: z.string().max(64).optional().describe('Known client identifier such as codex, claude-code or gemini-cli; omit when unknown.'),
+            pluginVersion: z.string().max(63).optional().describe('Observed or user-reported installed VPSnet plugin version, not the host application version. Omit if unknown.'),
+            localMcpVersion: z.string().max(63).optional().describe('Observed or user-reported local vpsnet-mcp npm version. Omit for remote-only connections or when unknown.'),
+        }, outputSchema: updateInfoOutput,
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (args) => { const data = await getUpdateInfo(args); return { ...result(data), structuredContent: data }; });
+    const spendingLimit = z.union([z.number().finite().nonnegative(), z.string().regex(/^\d+(?:\.\d+)?$/)]).nullable().optional();
     server.registerTool('get_connected_account', {
-        description: 'Identify the connected VPSnet account and its granted permissions and services.', inputSchema: {},
-        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, _meta: { 'openai/profile': true },
+        description: 'Identify the connected VPSnet account and its granted permissions, selected services and spending limits.', inputSchema: {},
+        outputSchema: z.object({
+            id: z.string().min(1), name: z.string(), scopes: z.array(z.string()), services: z.array(z.string()),
+            function_daily_limit_eur: spendingLimit, order_daily_limit_eur: spendingLimit, order_monthly_limit_eur: spendingLimit,
+        }).passthrough(),
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
     }, async () => { const { data } = await apiRequest('GET', '/account/mcp/profile'); return { ...result(data), structuredContent: data }; });
     server.registerTool('open_vm_session', {
         description: 'Open an authorized Linux session on a selected KVM or Firecracker service. The VPSnet guest channel works without a VM IP, SSH password or guest internet connection; choose connectionMethod="guest" for network/SSH troubleshooting or "ssh" for the independent SSH path. Auto prefers the guest channel. Requires explicit VM permission. Omit sessionBinding for a new session; VPSnet generates it and returns it with sessionId. Reuse both returned values for commands, files and reconnects. The OS user is root. Read /etc/os-release through the first operation to verify guest connectivity before choosing OS-specific commands or making changes. An empty managed-app list does not mean the server has no software.',

package/build/update-info.js

@@ -0,0 +1,135 @@
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+export const RELEASE_FEED_URL = 'https://raw.githubusercontent.com/bacarrdy/vpsnet-mcp/main/distribution/releases/published.json';
+export const MAX_FEED_BYTES = 65536;
+const stable = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const entry = z.object({
+    version: z.string().max(63).regex(stable), source_commit: z.string().regex(/^[0-9a-f]{40}$/),
+    verified_at: z.string().max(40).datetime({ offset: true }), url: z.string().max(256),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/), ci_run: z.number().int().positive().safe(),
+    ci_conclusion: z.literal('success'),
+}).strict();
+const feedSchema = z.object({ schema_version: z.literal(1), plugin: entry, mcp: entry }).strict();
+const instructions = JSON.parse(readFileSync(new URL('../scripts/update-clients.json', import.meta.url), 'utf8'));
+const runtimeVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+export function validatePublishedFeed(value) {
+    const feed = feedSchema.parse(value);
+    if (feed.plugin.url !== `https://github.com/bacarrdy/vpsnet-mcp/releases/download/plugin-${feed.plugin.version}/vpsnet-plugin-${feed.plugin.version}.zip`
+        || feed.mcp.url !== `https://registry.npmjs.org/vpsnet-mcp/-/vpsnet-mcp-${feed.mcp.version}.tgz`) {
+        throw new Error('Unexpected release artifact URL');
+    }
+    return feed;
+}
+/** Reject duplicate keys (including escaped aliases) before normal JSON parsing. */
+export function parsePublishedFeed(text) {
+    const token = /\s*("(?:[^"\\\u0000-\u001f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"|true|false|null|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|[{}\[\],:])/gy;
+    const stack = [];
+    let position = 0;
+    while (position < text.length && text.slice(position).trim()) {
+        token.lastIndex = position;
+        const match = token.exec(text);
+        if (!match)
+            throw new Error('Invalid release JSON');
+        const value = match[1], frame = stack.at(-1);
+        if (value === '{' || value === '[')
+            stack.push({ object: value === '{', key: value === '{', keys: new Set() });
+        else if (value === '}' || value === ']')
+            stack.pop();
+        else if (value === ',' && frame?.object)
+            frame.key = true;
+        else if (value.startsWith('"') && frame?.object && frame.key) {
+            const name = JSON.parse(value);
+            if (frame.keys.has(name))
+                throw new Error('Duplicate release key');
+            frame.keys.add(name);
+            frame.key = false;
+        }
+        position = token.lastIndex;
+    }
+    return validatePublishedFeed(JSON.parse(text));
+}
+export async function fetchPublishedFeed(fetcher = fetch) {
+    const response = await fetcher(RELEASE_FEED_URL, {
+        redirect: 'error', signal: AbortSignal.timeout(5000), headers: { Accept: 'application/json' },
+    });
+    if (response.status !== 200 || !response.body)
+        throw new Error('Release feed unavailable');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_FEED_BYTES)
+                throw new Error('Release feed too large');
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return parsePublishedFeed(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+}
+let cache;
+async function cachedFeed() {
+    if (!cache || cache.expires <= Date.now()) {
+        // Public facts only: never cache account data, tokens or installed versions.
+        cache = { expires: Date.now() + 300_000, value: fetchPublishedFeed() };
+    }
+    return cache.value;
+}
+const observedSchema = z.object({ version: z.string().nullable(), source: z.enum(['caller_reported', 'runtime', 'unknown']) });
+export const updateInfoOutput = {
+    schema_version: z.literal(1), checked_at: z.string(), client: z.string(),
+    published: z.object({ plugin: entry, mcp: entry }).nullable(),
+    observed: z.object({ plugin: observedSchema, local_mcp: observedSchema, server: observedSchema }),
+    update_available: z.object({ plugin: z.boolean().nullable(), local_mcp: z.boolean().nullable(), server: z.boolean().nullable() }),
+    compatibility: z.object({ status: z.literal('unknown'), reason: z.string() }),
+    distribution_status: z.object({ source_release_published: z.boolean().nullable(), npm_package_published: z.boolean().nullable(),
+        remote_deployment_status: z.literal('unknown'), official_registry: z.object({ status: z.literal('unknown'), version: z.null(), checked_at: z.null() }),
+        downstream_catalogs: z.record(z.unknown()),
+    }),
+    instructions: z.object({ reviewed_at: z.string(), source_urls: z.array(z.string()), steps: z.array(z.string()) }).nullable(),
+    server_update: z.string(), advisory: z.literal(true), reason: z.string().nullable(),
+};
+function observed(value, runtime = false) {
+    return value && value.length < 64 && stable.test(value)
+        ? { version: value, source: runtime ? 'runtime' : 'caller_reported' }
+        : { version: null, source: 'unknown' };
+}
+function older(current, latest) {
+    if (current === null)
+        return null;
+    const a = current.split('.').map(BigInt), b = latest.split('.').map(BigInt);
+    for (let i = 0; i < 3; i++)
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    return false;
+}
+export async function getUpdateInfo(args, lookup = cachedFeed) {
+    let published = null;
+    try {
+        published = validatePublishedFeed(await lookup());
+    }
+    catch { /* Do not echo untrusted errors. */ }
+    const client = args.client ?? 'generic';
+    const observations = { plugin: observed(args.pluginVersion), local_mcp: observed(args.localMcpVersion), server: observed(runtimeVersion, true) };
+    return z.object(updateInfoOutput).parse({
+        schema_version: 1, checked_at: new Date().toISOString(), client,
+        published: published ? { plugin: published.plugin, mcp: published.mcp } : null,
+        observed: observations,
+        update_available: { plugin: published ? older(observations.plugin.version, published.plugin.version) : null,
+            local_mcp: published ? older(observations.local_mcp.version, published.mcp.version) : null,
+            server: published ? older(observations.server.version, published.mcp.version) : null },
+        compatibility: { status: 'unknown', reason: 'No version-specific client acceptance evidence is supplied by this check.' },
+        distribution_status: { source_release_published: published ? true : null, npm_package_published: published ? true : null,
+            remote_deployment_status: 'unknown', official_registry: { status: 'unknown', version: null, checked_at: null }, downstream_catalogs: {} },
+        instructions: Object.hasOwn(instructions, client) ? instructions[client] : null,
+        server_update: 'The hosted gateway is maintained by VPSnet. Updating a local npm package does not update it.',
+        advisory: true,
+        reason: published ? null : 'Published release information is unavailable or invalid; installed software is unchanged.',
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vpsnet-mcp",
-  "version": "2.3.14",
+  "version": "2.3.15",
   "type": "module",
   "description": "MCP server for managing VPSnet.com services, applications, DNS, domains, billing, and server lifecycle operations",
   "bin": {
@@ -38,6 +38,8 @@
     "build/scope-catalog.js",
     "build/remote-auth-error.js",
     "build/remote-tools.js",
+    "build/update-info.js",
+    "scripts/update-clients.json",
     "build/remote-orders.js"
   ],
   "repository": "github:bacarrdy/vpsnet-mcp",

package/scripts/update-clients.json

@@ -0,0 +1,204 @@
+{
+  "claude-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://code.claude.com/docs/en/plugins/cli-reference",
+      "https://code.claude.com/docs/en/discover-plugins"
+    ],
+    "steps": [
+      "Use claude plugin list --json to check the installed VPSnet plugin and its source.",
+      "For the VPSnet marketplace installation, run claude plugin update vpsnet@vpsnet in your own terminal.",
+      "Use /reload-plugins in the running session or start a new session. For another install source, use its native update control."
+    ]
+  },
+  "claude": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://claude.com/docs/plugins/overview"
+    ],
+    "steps": [
+      "Open Customize > Plugins. For an added marketplace, use Check for updates where available.",
+      "Uploaded or organization-managed plugins follow their owner's upload, sync and review process. A GitHub release alone does not prove the account's plugin updated."
+    ]
+  },
+  "cowork": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://claude.com/docs/plugins/overview",
+      "https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization"
+    ],
+    "steps": [
+      "Manage the account plugin in Customize > Plugins using the source's native update controls.",
+      "For an organization marketplace, ask its owner to upload or re-sync and complete any required review. The served version can remain pinned or await approval."
+    ]
+  },
+  "grok": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.x.ai/grok/connectors"
+    ],
+    "steps": [
+      "Manage the custom remote connection at grok.com/connectors.",
+      "The official connector guide does not establish plugin ZIP updates or a tool-cache refresh command. A remote gateway deployment does not establish whether this conversation refreshed its tools."
+    ]
+  },
+  "codex": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://learn.chatgpt.com/docs/cli/reference",
+      "https://learn.chatgpt.com/docs/plugins"
+    ],
+    "steps": [
+      "Use codex plugin list --json to inspect installed and available plugin versions and the configured marketplace name.",
+      "For that configured marketplace, use codex plugin marketplace upgrade <marketplace-name> --json, then start a new session. Do not assume the active thread reloads plugins."
+    ]
+  },
+  "chatgpt": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://developers.openai.com/plugins/deploy/connect-chatgpt",
+      "https://developers.openai.com/plugins/deploy/submission"
+    ],
+    "steps": [
+      "For a custom MCP connection, open its plugin settings, use Refresh and start a new conversation.",
+      "Published package updates and server rescans are publisher actions, with their own review and publication state. A local ZIP or GitHub release does not prove a directory update."
+    ]
+  },
+  "gemini-cli": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://geminicli.com/docs/extensions/reference/",
+      "https://geminicli.com/docs/reference/commands/"
+    ],
+    "steps": [
+      "For a named installed extension, run gemini extensions update vpsnet in your terminal and restart the CLI.",
+      "/mcp reload re-discovers tools and /skills reload refreshes skills on host versions that support them; these do not install a new extension."
+    ]
+  },
+  "gemini-browser": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://support.google.com/gemini/answer/17209137"
+    ],
+    "steps": [
+      "Manage the custom Connected App in Gemini settings. This remote connection is not a Gemini CLI extension.",
+      "The reviewed guide does not establish a package-upgrade or tool-cache refresh command."
+    ]
+  },
+  "cursor": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://cursor.com/docs/reference/plugins",
+      "https://cursor.com/docs/plugins"
+    ],
+    "steps": [
+      "For a local plugin copy, replace it with the complete reviewed new package and reload the window or restart.",
+      "Public marketplace updates require provider review; team marketplace sync and local updates are separate. No universal public-store update command is established here."
+    ]
+  },
+  "kimi-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.kimi.com/code/docs/en/kimi-code-cli/customization/plugins.html"
+    ],
+    "steps": [
+      "For a copied local installation, reinstall the reviewed complete source with /plugins install ./vpsnet, then /reload or start a new session.",
+      "Use the plugin manager update action where available. Do not assume custom VPSnet plugins auto-update."
+    ]
+  },
+  "kimi-work": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.kimi.com/en/help/plugins-and-skills/create",
+      "https://www.kimi.com/en/help/plugins-and-skills/publish"
+    ],
+    "steps": [
+      "Use Plugin Builder in Kimi Work to convert the reviewed source update and inspect the resulting package.",
+      "Personal installation and public marketplace review are separate; no automatic source-update contract was established."
+    ]
+  },
+  "kiro": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://kiro.dev/docs/powers/installation/",
+      "https://kiro.dev/docs/mcp/configuration/"
+    ],
+    "steps": [
+      "For a repository-backed Power, use its Check for updates and Install updates controls.",
+      "Standalone MCP configuration is separate. Power OAuth scope compatibility needs client verification; installing a package does not grant additional scopes."
+    ]
+  },
+  "vscode": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://code.visualstudio.com/docs/agent-customization/agent-plugins",
+      "https://code.visualstudio.com/docs/agents/reference/mcp-configuration"
+    ],
+    "steps": [
+      "MCP: Reset Cached Tools refreshes discovery, not installed plugin files.",
+      "Use Extensions: Check for Extension Updates for the extension inventory. AgentHost /plugin update applies to its own plugin inventory; inspect which host and install source you use first."
+    ]
+  },
+  "devin": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.devin.ai/cli/extensibility/plugins/overview",
+      "https://docs.devin.ai/cli/extensibility/mcp/configuration"
+    ],
+    "steps": [
+      "For a Devin CLI plugin installation, use devin plugins update vpsnet. A linked local source reloads on a new session.",
+      "Legacy Cascade and Devin Local are different hosts; do not assume a Devin CLI action updates a legacy Cascade configuration."
+    ]
+  },
+  "qwen": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://qwenlm.github.io/qwen-code-docs/en/users/extension/introduction/"
+    ],
+    "steps": [
+      "Use qwen extensions update <installed-name> for a native installed extension, then restart after terminal changes.",
+      "Pinned exact npm versions remain pinned. Marketplace source refresh is separate from updating installed extensions."
+    ]
+  },
+  "cline": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.cline.bot/customization/plugins",
+      "https://docs.cline.bot/mcp/mcp-overview"
+    ],
+    "steps": [
+      "Inspect the actual Cline host and installed source; plugin support differs between CLI/SDK and IDE extensions.",
+      "No custom-plugin automatic upgrade or remote tool-refresh guarantee was established. Use the host-native manager and current official instructions."
+    ]
+  },
+  "mistral-work": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.mistral.ai/vibe/work/connectors/mcp-connectors"
+    ],
+    "steps": [
+      "After tools change, open the existing Vibe Work connector and use Functions > Refresh tools. This host does not support dynamic tool discovery.",
+      "Do not substitute Vibe Code CLI: direct OAuth MCP is not supported there by the reviewed documentation."
+    ]
+  },
+  "mistral-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.mistral.ai/vibe/code/cli/mcp-servers"
+    ],
+    "steps": [
+      "The reviewed Vibe Code CLI documentation explicitly excludes OAuth MCP servers. A plugin update does not fix that limitation.",
+      "Use a supported OAuth client; never substitute customer passwords or manually supplied tokens."
+    ]
+  },
+  "perplexity": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.perplexity.ai/help-center/en/articles/13915507-adding-custom-remote-connectors"
+    ],
+    "steps": [
+      "Manage the existing custom remote connector in account settings. Native skill ZIP replacement is a separate operation.",
+      "The reviewed connector guide does not establish automatic tool-list refresh, custom plugin upgrades or release notifications."
+    ]
+  }
+}