feat(skills): read MCP source code during ecosystem absorb (#79)

3093e11a0945e20eeceb98cce7cf170280ab97a4 · 2026-03-30 17:54:30 -0700 · Matt Van Horn

Phase 1.5 already discovers MCP servers but only reads their READMEs.
MCP source code is ground-truth for which API endpoints matter — the
maintainer already proved they work. New step 1.5a.5 reads the top
1-2 MCP repos to extract actual endpoint paths, auth patterns, and
high-gravity response fields. Feeds into the absorb manifest as
high-confidence signals and into auth setup guidance.

Time-boxed at 3 minutes with README fallback.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Files touched

M skills/printing-press/SKILL.md

Diff

commit 3093e11a0945e20eeceb98cce7cf170280ab97a4
Author: Matt Van Horn <mvanhorn@users.noreply.github.com>
Date:   Mon Mar 30 17:54:30 2026 -0700

    feat(skills): read MCP source code during ecosystem absorb (#79)
    
    Phase 1.5 already discovers MCP servers but only reads their READMEs.
    MCP source code is ground-truth for which API endpoints matter — the
    maintainer already proved they work. New step 1.5a.5 reads the top
    1-2 MCP repos to extract actual endpoint paths, auth patterns, and
    high-gravity response fields. Feeds into the absorb manifest as
    high-confidence signals and into auth setup guidance.
    
    Time-boxed at 3 minutes with README fallback.
    
    Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 skills/printing-press/SKILL.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/skills/printing-press/SKILL.md b/skills/printing-press/SKILL.md
index 4289f7c9..c10e6969 100644
--- a/skills/printing-press/SKILL.md
+++ b/skills/printing-press/SKILL.md
@@ -802,6 +802,30 @@ Run these searches in parallel:
 9. **WebSearch**: `"<API name>" SDK wrapper site:npmjs.com`
 10. **WebSearch**: `"<API name>" client library site:pypi.org`
 
+### Step 1.5a.5: Read MCP source code (if found)
+
+If step 1.5a discovered MCP server repos with public source code on GitHub, read the actual source to extract ground-truth API usage — not just README feature descriptions.
+
+**Time budget:** Max 3 minutes total. If extraction is unproductive, fall back to README-only research.
+
+**For the top 1-2 MCP repos found:**
+
+1. **Identify the main source file.** WebFetch the repo root to find the entry point — typically `src/index.ts`, `server.ts`, `server.py`, `main.go`, or a `tools/` directory. MCP servers are usually small (one main file + tool definitions).
+
+2. **Extract three things:**
+   - **API endpoint paths**: Look for HTTP client calls (`fetch(`, `axios.`, `requests.`, `http.Get`, `client.`) and extract the URL paths (e.g., `GET /v1/issues`, `POST /graphql`). These are the endpoints the MCP maintainer proved work.
+   - **Auth patterns**: Look for how the MCP constructs auth headers — token format (`Bearer`, `Bot`, `Basic`), header name (`Authorization`, `X-API-Key`), environment variable names. This informs our auth setup guidance.
+   - **Response field selections**: Look for which fields are extracted from API responses — these are the high-gravity fields that power users actually need.
+
+3. **Feed into absorb manifest.** In step 1.5b, endpoints extracted from source get attributed as `<MCP name> (source)` in the "Best Source" column, distinguishing them from README-derived features. Source-extracted endpoints are high-confidence signals — the maintainer verified they work.
+
+4. **Feed auth patterns into research brief.** If the MCP source reveals token format (e.g., `xoxp-` for Slack, `sk_live_` for Stripe), credential setup steps, or required scopes, note them in the Phase 1 brief's auth section. These hints improve the generated CLI's auth onboarding.
+
+**Skip this step when:**
+- No MCP repos were found in 1.5a
+- MCP repos are private or archived
+- The MCP is a monorepo where the relevant server is hard to locate within 3 minutes
+
 ### Step 1.5b: Catalog every feature into the absorb manifest
 
 For EACH tool found, list EVERY feature/tool/command it provides. Then define how our CLI matches AND beats it:

← e1135992 feat(cli): auth onboarding UX for generated CLIs (#78) · back to Cli Printing Press · feat(cli): add crowd-sniff command for community-based API d 4a9843df →