Teknium 9df5f879b4 feat(mcp): enforce exact version pins across the whole MCP catalog ... Catalog entries now follow the same supply-chain rules as pyproject dependencies: - n8n: install.ref main -> full commit SHA 7a9ae007 (2026-05-23, branches/tags can be moved by the upstream owner; SHAs cannot) - new contract test: every shipped manifest must pin exactly — git installs need a 40-char SHA, uvx/npx-style launchers need pkg==X / pkg@X with a digit-leading version (rejects bare names, ranges, and npm dist-tags like @latest) - module docstring documents the pin policy (exact version, 2-week cooldown) unreal-engine and linear are http transports (server runs elsewhere) so there is nothing to pin at the transport layer. Verified: unpinning blender-mcp in the manifest makes the contract test fail with a named diagnostic; restoring the pin passes.		2026-07-15 04:56:25 -07:00
..
blender	fix(mcp): pin blender-mcp to 1.6.4 per catalog dependency policy	2026-07-15 04:56:25 -07:00
linear	feat(mcp): Nous-approved MCP catalog with interactive picker (#30870)	2026-05-26 12:48:14 -07:00
n8n	feat(mcp): enforce exact version pins across the whole MCP catalog	2026-07-15 04:56:25 -07:00
unreal-engine	feat(mcp-catalog): add official Unreal Engine 5.8 MCP server	2026-06-18 09:16:40 -07:00