claude-code-kit 0.64.0__tar.gz → 0.65.0__tar.gz

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.64.0",
+      "version": "0.65.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.65.0] — 2026-07-17
+
+**Catalog-additive OSS-adoption pass — one new MCP server that fills a documented, agent-mapped
+gap.** After five convergent *prose*-adoption scans came up null (the kit's engineering-rule/agent
+layer is comprehensive, and adding near-duplicate always-loaded prose only dilutes selection), this
+pass targeted the one adoption path immune to that cost: a `catalog/mcp.yaml` entry — opt-in,
+data-driven, and installed **only when selected** (zero always-loaded context, per golden rule #7
+"extend via the catalog, not code"). An 866-repo AI/Claude/MCP scan surfaced exactly one server that
+clears the reuse-first bar (official/maintained · not already covered · maps to an existing agent's
+documented job). **0 new agents, skills, or rules; 1 new catalog entry.**
+
+### Added
+
+- **`grafana` MCP server** (official [grafana/mcp-grafana](https://github.com/grafana/mcp-grafana),
+  Apache-2.0, `uvx mcp-grafana==0.17.2`) — the **metrics / dashboards / alerts** side of
+  observability that the existing `sentry` entry (errors) doesn't cover: query Prometheus/Loki, read
+  dashboards, list alert rules, pull incidents/on-call. Fills the gap the `observability-engineer`
+  agent owns (SLOs · alerts · dashboards) and that `incident-responder` already expects — it pulls
+  "a metric" during triage. Mirrors the existing `sentry → incident-responder` and
+  `chrome-devtools → auditor` precedent exactly. Ships **read-only** (`--disable-write` turns off all
+  create/update tools; run-panel-query and admin tools are upstream-disabled by default),
+  referenced never bundled, pinned exactly, and fully toxic-flow-leg annotated. Opt-in only — never
+  in the default selection.
+
+### Not adopted (deliberately)
+
+- **Figma MCP** (GLips/Figma-Context-MCP · official Dev Mode server) — *no documented consumer.* The
+  `ui-designer` agent's inputs are the **code/markdown design system** (`.claude/rules/ui-design-system.md`,
+  `docs/references/ui/`) and existing components/tokens — it never imports from an external design
+  tool. Adding Figma would introduce a workflow no agent asks for (speculative/YAGNI).
+- **The maintained `github/github-mcp-server` (Go)** — a genuine upgrade the catalog comment already
+  tracks, but **deferred, not adopted here**: it ships as a Docker image (off-brand for the
+  container-optional kit) or a preview remote endpoint whose auth model needs verification. Changing
+  a heavily-used existing entry belongs in its own focused change, not bundled with an additive one.
+- **Notion / Cloudflare / Firecrawl / Exa MCP servers** — either no matching agent (Notion: no
+  knowledge-base role) or vendor sprawl the kit deliberately avoids (it already ships the two major
+  clouds), or covered by native Claude Code tools (web search/fetch) + `playwright`/`chrome-devtools`.
+- **Code-intelligence servers** (zilliztech/claude-context, DeusData/codebase-memory-mcp,
+  code-review-graph) — the `serena` + `semble` + `repowise` trio already covers symbolic retrieval,
+  semantic search, and churn/risk analytics. No net-new capability.
+- **MCP *frameworks*** (fastmcp, mcp-use, mcp-agent, the inspector) — the kit *consumes* MCP servers;
+  it does not build them.
+
 ## [0.64.0] — 2026-07-16
 
 **Curated engineering-writing sweep — folding widely-taught senior-engineer patterns into the

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.64.0
+Version: 0.65.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -149,7 +149,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **105** context-activated skills (57 core + 48 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **23** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
 packs decide how much of this actually installs — see

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/README.md

@@ -116,7 +116,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **105** context-activated skills (57 core + 48 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **23** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
 packs decide how much of this actually installs — see

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/catalog/mcp.yaml

@@ -195,6 +195,26 @@ servers:
     config:
       type: http
       url: "https://mcp.sentry.dev/mcp"
+  # Grafana (github.com/grafana/mcp-grafana, Apache-2.0) — official, vendor-maintained MCP for the
+  # metrics / dashboards / alerts side of observability that Sentry (errors) doesn't cover: query
+  # Prometheus/Loki, read dashboards, list alert rules, pull incidents/on-call. Fills the gap the
+  # `observability-engineer` agent owns (SLOs · alerts · dashboards) and that `incident-responder`
+  # already expects — "pull ... a metric" during triage (incident-responder.md §Gather signals). A Go
+  # server also published to PyPI, run via uvx (install `uv` first: https://docs.astral.sh/uv/); pinned
+  # exactly (snapshot 2026-07-17 — do not float). NOT bundled — claude-kit only references it. Ships
+  # RESTRICTIVE: `--disable-write` turns off all create/update tools (reads only); run-panel-query and
+  # admin tools are upstream-disabled by default too. Needs a Grafana instance + a service-account
+  # token (Viewer role suffices for reads); no credentials are generated here.
+  grafana:
+    label: "Grafana (metrics/dashboards/alerts — powers observability-engineer + incident-responder; read-only)"
+    # toxic-flow legs: private-data (dashboards/metrics/logs carry ops data + PII) · untrusted-content (log/label data) · egress (your Grafana). read-only by default — no destructive leg unless you drop --disable-write.
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "mcp-grafana==0.17.2", "mcp-grafana", "--disable-write"]
+      env:
+        GRAFANA_URL: "${GRAFANA_URL}"
+        GRAFANA_SERVICE_ACCOUNT_TOKEN: "${GRAFANA_SERVICE_ACCOUNT_TOKEN}"
   # Repowise (github.com/repowise-dev/repowise) — optional codebase-intelligence engine exposing an
   # MCP server: deterministic hotspots (churn × complexity), change-risk, co-change coupling, dead
   # code, and a dependency graph. NOT bundled (claude-kit only references it): it is AGPL-3.0, so

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/docs/influences.md

@@ -33,6 +33,7 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[Netflix](https://github.com/Netflix) · [aws](https://github.com/aws) · [apple](https://github.com/apple) org review** (all **1,214** repos) | Service-level resilience the kit lacked entirely — stability patterns (timeout/retry-budget/circuit-breaker/bulkhead) + adaptive concurrency limiting, chaos engineering, and bounded-clock distributed time; failure-domain-aware progressive rollout; deterministic simulation testing; a formal RFC process (working-backwards + API bar-raiser); continuous usage-based least-privilege | The **new `resilience-engineering` rule** (chaos + stability patterns + bounded clocks, from `Netflix/concurrency-limits` · `Netflix/chaosmonkey` · `aws/clock-bound`); plus prose extensions to `devops-observability` (failure-domain rollout, from `aws/zone-aware-controllers-for-k8s`), `testing` (deterministic simulation testing, from `apple/foundationdb`), `spec-driven-development` (RFC track, from `aws/aws-cdk-rfcs`), and `security-and-hardening` (continuous least-privilege, from `Netflix/repokid`) — **1 new rule, 0 new agents/skills** (the orgs are overwhelmingly SDKs/CLIs/services, so the survey kept only 7 of 1,214) | `0.53.0` |
 | **1,345-repo OSS adoption scan** (39 provenance-tagged searches across the AI/Claude/MCP/context ecosystem; 76 verified adoption ideas → 30-item backlog) | Agent-config supply-chain vetting + toxic-flow legs taxonomy; hidden-Unicode detection; content-type-aware **reversible** output compression (~200-token floor) + "think in code" (from Apache-2.0 `headroomlabs-ai/headroom` · `gsd-build/get-shit-done`; deterministic shell-side companion `rtk-ai/rtk`, referenced); symbol-first retrieval ladder (from MIT `oraios/serena` · `MinishLab/semble`); budget-visible statusline HUDs (`jarrodwatts/claude-hud`, referenced); tribal-standards elicitation (from `buildermethods/agent-os`); evidence-based test nagging + falsifiability eval discipline (from `maxritter/pilot-shell`); colocated skill evals (from `darkrishabh/agent-skills-eval`) | Waves across `dependency-verification` (vetting canon), `catalog/mcp.yaml` (+5 fragments → 22, all leg-annotated), `validator.py` (Unicode scan + INFO channel), **new `check_cross_references.py` CI gardener**, `context-engineering` (compression recipes · 5th primitive · retrieval ladder · budget visibility · pressure symptoms · tribal test), `tool-design`, `evals` §9–10 + `eval-harness`, `agent-guardrails` §3/§4, orchestrator VALIDATE, consolidate-learnings Promote, and ~10 more files — **0 new agents/skills, 1 new CI script** | `0.60.0`–`0.62.0` |
 | **Curated engineering-writing sweep** (a Medium "senior-engineer patterns" prompt → the freely-readable canon: Google SRE Book · AWS Builders' Library · Google API Design Guide & Eng Practices · Martin Fowler · Brendan Gregg · Dan McKinley · Sandi Metz · Stripe/Google idempotency & LRO · Dean/Norvig latency numbers) | Design-time CAP/PACELC + static-stability fallback sizing; error budgets as a release throttle; order-of-magnitude latency table; off-CPU/Amdahl/USL scalability; innovation-token budgeting; the wrong-abstraction cost; Parallel Change (expand→migrate→contract); cursor vs offset pagination; cache-stampede (single-flight + XFetch); DTO/storage decoupling + Idempotency-Key + long-running-operation API shapes; consumer-driven contract testing; "if you can't understand it, that's the finding" | Prose extensions to `resilience-engineering` & `devops-observability` rules + 9 skills (`_references/performance-checklist`, `load-testing`, `library-review`, `over-engineering-review`, `deprecation-and-migration`, `api-pagination-filtering-sorting`, `redis-caching-patterns`, `api-and-interface-design`, `testing-conventions`, `code-review-and-quality`, `notifications-and-messaging`) — **0 new agents/skills/rules; component counts unchanged** | `0.64.0` |
+| **866-repo AI/Claude/MCP scan** (catalog-additive angle — after five null *prose* passes, targeting the one adoption path with zero always-loaded-context cost: an opt-in `catalog/mcp.yaml` entry) | The metrics/dashboards/alerts side of observability the catalog lacked (`sentry` covers errors only) — maps to the `observability-engineer` + `incident-responder` agents' documented jobs, mirroring the `sentry`/`chrome-devtools` precedent | The **`grafana` MCP fragment** (official [grafana/mcp-grafana](https://github.com/grafana/mcp-grafana), Apache-2.0, read-only via `--disable-write`, pinned, referenced-not-bundled) — **0 new agents/skills/rules; 1 new catalog entry** (deliberately skipped: Figma — no agent consumer; the maintained Go `github-mcp-server` — deferred to its own change; Notion/Cloudflare — no agent / vendor sprawl; code-intel servers — already covered by serena+semble+repowise) | `0.65.0` |
 
 > Each adoption is detailed in the [CHANGELOG](../CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/docs/install.md

@@ -76,7 +76,7 @@ config — nothing else:
 3. **Backend language** (default: Python; `none` for frontend-only projects) → **backend framework** (default: FastAPI)
 4. **Database** (PostgreSQL · MongoDB · `none`)
 5. **SDLC profile** (`lean` · `standard` · `enterprise`)
-6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Chrome DevTools · Docs/MS Learn · Azure · Wassette · Sentry · Repowise · the Google security suite — full list: `claude-kit list-options`) — a
+6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Chrome DevTools · Docs/MS Learn · Azure · Wassette · Sentry · Grafana · Repowise · the Google security suite — full list: `claude-kit list-options`) — a
    project-root `.mcp.json` is written **only** if you select any (env placeholders, never secrets)
 7. **Learning capture** (`session-end-catchup` default · `session-end` · `per-task` · `off`) — how often
    the background learnings job runs. *Privacy note:* it reads your session transcript + changed files

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.64.0"
+version = "0.65.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.64.0 → claude_code_kit-0.65.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.64.0"
+__version__ = "0.65.0"