From 824fcbeb1780a17e79abfd194832509a97d17148 Mon Sep 17 00:00:00 2001 From: Karan Date: Wed, 4 Nov 2026 15:11:38 -0500 Subject: [PATCH] MCP plugin: say what it can send, instead of "sends nothing" The plugin README and manifests said it sends nothing to anyone and is "Local only", while hosted: true sends a URL to genclass.dev, GENCLASS_REPORT mirrors finding ids and verdicts to the dashboard, and genclass_scan can download the runtime from npm. Everything that leaves the machine is opt-in, so say that, and list all of it in one place. No code changes. Co-Authored-By: Claude Opus 5.5 --- docs/adoption/listings/mcp.md | 10 ++++++---- llms-install.md | 2 +- packages/mcp/README.md | 4 ++-- packages/mcp/package.json | 2 +- packages/mcp/plugin/.claude-plugin/plugin.json | 2 +- packages/mcp/plugin/README.md | 15 +++++++++------ packages/mcp/plugin/plugin.json | 2 +- 7 files changed, 21 insertions(+), 16 deletions(-) diff --git a/docs/adoption/listings/mcp.md b/docs/adoption/listings/mcp.md index 2610a91a..6260f74d 100644 --- a/docs/adoption/listings/mcp.md +++ b/docs/adoption/listings/mcp.md @@ -101,7 +101,7 @@ official registry); docs.github.com "Extend Copilot Chat with MCP" (VS Code adds > in the GitHub MCP Registry. It is a local server for coding agents: it shows the agent what happened inside a web > app's pages on the developer's machine in causal order, re-runs a page with network responses delivered in > different orders to find race conditions, replays one exact order to prove a fix, and writes a Playwright - > regression test. It needs no account or API key and sends nothing off the machine. Measured so far on one page + > regression test. It needs no account or API key and sends nothing off the machine unless you turn that on. Measured so far on one page > (a stale-response race): it found the race in 5 of 6 reordered runs and reported nothing on the fixed page. > Install in VS Code: `code --add-mcp '{"name":"genclass","command":"npx","args":["-y","@genclass/mcp@0.2.1"]}'`. > Thank you. @@ -120,9 +120,11 @@ support.claude.com "Anthropic Software Directory Policy". `genclass-dev/genclass-plugin`, no plugin path (the plugin is the repository root), branch `main`; Validate. GenClass itself cannot be submitted: the portal stops validating a repository whose GitHub archive is over 50 MiB (pre-submission checklist), and GenClass's is 51 MiB. Listing details are read from - `.claude-plugin/plugin.json` and `README.md` at that root (the same files as `packages/mcp/plugin/`). Data handling: the plugin + `.claude-plugin/plugin.json` and `README.md` at that root (the same files as `packages/mcp/plugin/`). Data handling: by default the plugin collects and sends nothing; it reads and writes `.genclass/agent/` in the project and `~/.genclass/` (the bridge - token); the optional dashboard read is the only network request off the machine. Compliance: contact email and + token); what goes off the machine is opt-in: the dashboard read (`GENCLASS_DASHBOARD`), the dashboard mirror + (`GENCLASS_REPORT`) and `genclass_scan` with `hosted: true`; `genclass_scan` also downloads the runtime from npm when + the project does not have it. Compliance: contact email and the four acknowledgements. Updates: GitHub push webhook. - **What the checks will say.** Local run of `claude plugin validate --profile directory` on the assembled repository and on `packages/mcp/plugin` (Claude Code 2.1.311, 2026-10-28): passes with nothing to report; the @@ -252,7 +254,7 @@ Source: cline/mcp-marketplace `README.md` and `.github/ISSUE_TEMPLATE/mcp-server > in a web app (stale responses that overwrite newer data, double submits, errors that happen "sometimes"): it > records what happened inside the app's pages on the developer's machine in causal order, re-runs a page with > network responses delivered in different orders, replays one exact order to confirm a bug and its fix, and - > writes a Playwright regression test. Local only: no API key, nothing sent off the machine. Measured so far on one + > writes a Playwright regression test. Runs on your machine: no API key, nothing sent off it unless you turn that on. Measured so far on one > page: the race was found in 5 of 6 reordered runs, with no false report on the fixed page. ## 7. mcpservers.org diff --git a/llms-install.md b/llms-install.md index e8f974ed..26f08d96 100644 --- a/llms-install.md +++ b/llms-install.md @@ -5,7 +5,7 @@ These are the steps for an agent (Cline or another) that is asked to install Gen re-runs a page with network responses delivered in different orders to find race conditions, replays one exact order, and writes a Playwright regression test; it also audits any page for visual bugs (`genclass_scan`). It is free, it needs no API key and no account, and it sends nothing off the machine (unless the agent asks `genclass_scan` for -`hosted: true`, which sends that URL to the genclass.dev page check). (Closed-loop development as a service, with the MCP server, collector and dashboard run for a customer's +`hosted: true`, which sends that URL to the genclass.dev page check, or you set `GENCLASS_DASHBOARD` or `GENCLASS_REPORT`, which talk to your own dashboard). (Closed-loop development as a service, with the MCP server, collector and dashboard run for a customer's developers by GenClass or inside their network, is an Enterprise offer: https://genclass.dev/enterprise.) ## 1. Requirements diff --git a/packages/mcp/README.md b/packages/mcp/README.md index baf016c8..2baceaa8 100644 --- a/packages/mcp/README.md +++ b/packages/mcp/README.md @@ -384,10 +384,10 @@ your machine (the exceptions are under Privacy). See section 6 of ## Privacy -The server collects nothing and sends nothing to GenClass or anyone else. Findings stay on your machine, in +By default the server collects nothing and sends nothing to GenClass or anyone else. Findings stay on your machine, in `.genclass/agent/` in the server's working directory (the project, for clients that start servers there; set `GENCLASS_STATE_DIR` for clients that do not, such as Claude Desktop), which the server gitignores, and in the bridge's memory; the bridge's token is in -`~/.genclass`. The one request that leaves the machine is `genclass_analytics` `{source: "production"}`, which reads +`~/.genclass`. `genclass_analytics` `{source: "production"}` reads your own GenClass dashboard when you set `GENCLASS_DASHBOARD` to its private link. `genclass_scan` loads the page the agent names (that is the page's own traffic) in a local browser; only with `hosted: true` is the URL sent to the genclass.dev page check, and when the project has no `@genclass/runtime` with `scan`, npx downloads it from npm. With `GENCLASS_REPORT` set (off by diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 7f13a96a..5e12416c 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -2,7 +2,7 @@ "name": "@genclass/mcp", "version": "0.2.1", "mcpName": "io.github.genclass-dev/genclass", - "description": "GenClass for coding agents: an MCP server that sees what happens inside your app's pages (clicks, requests, the order responses arrived, state writes, errors), re-runs them with the network answering in different orders to find race conditions, and replays one exact order to prove a fix. Local only, no dependencies.", + "description": "GenClass for coding agents: an MCP server that sees what happens inside your app's pages (clicks, requests, the order responses arrived, state writes, errors), re-runs them with the network answering in different orders to find race conditions, and replays one exact order to prove a fix. Runs on your machine; anything it sends is opt-in; no dependencies.", "type": "module", "license": "Apache-2.0", "repository": { diff --git a/packages/mcp/plugin/.claude-plugin/plugin.json b/packages/mcp/plugin/.claude-plugin/plugin.json index 99567832..55df1a30 100644 --- a/packages/mcp/plugin/.claude-plugin/plugin.json +++ b/packages/mcp/plugin/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "genclass", "version": "0.2.1", - "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Local only.", + "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Runs on your machine; anything it sends is opt-in.", "author": { "name": "GenClass", "url": "https://genclass.dev" diff --git a/packages/mcp/plugin/README.md b/packages/mcp/plugin/README.md index f7f77864..56145325 100644 --- a/packages/mcp/plugin/README.md +++ b/packages/mcp/plugin/README.md @@ -34,7 +34,7 @@ page of the dev server. The page side needs `@genclass/runtime` 0.3.0-beta.1 or In the plugin repository the server is vendored: `server/cli.mjs` is the published `@genclass/mcp@0.2.1` build (its `dist/cli.js`, byte for byte, fetched from npm by the daily sync), `server/genclass-mcp.mjs` is the package's command importing it, and `.mcp.json` and the hook run them with `node` from `${CLAUDE_PLUGIN_ROOT}`, so installing the plugin -installs nothing and runs the exact release it was reviewed with; there is no `package.json` or lockfile. The copy of +installs nothing and runs the exact release it was reviewed with (the one download is `genclass_scan`'s, below); there is no `package.json` or lockfile. The copy of this folder inside GenClass runs `npx -y @genclass/mcp@0.2.1` instead (nothing built is committed there). `plugin.json` and `mcp.json` at this folder's root are the same server in the [Agent Plugins](https://agent-plugins.org) format, for Cursor, Codex and other clients that read it (server and skill, @@ -50,15 +50,18 @@ no bridge is running or nothing is new, and gives up after 0.8 seconds if the br of a session only sets the cursor (`genclass_findings` has the backlog). The server listens on 127.0.0.1 only and accepts pages from this machine (`localhost`, `127.0.0.1`, `*.localhost`) -or origins you list in `GENCLASS_AGENT_ORIGINS`. Nothing leaves your machine, except `genclass_analytics` -`{source: "production"}`, which reads your own GenClass dashboard when you set `GENCLASS_DASHBOARD` to its link, and -`genclass_scan` with `hosted: true`, which sends the URL to the genclass.dev page check (without it, the page loads -in a local headless browser). +or origins you list in `GENCLASS_AGENT_ORIGINS`. Nothing leaves your machine unless you or your agent ask +for it: `genclass_analytics` `{source: "production"}` reads your own GenClass dashboard when you set +`GENCLASS_DASHBOARD` to its link; `genclass_scan` with `hosted: true` sends the URL to the genclass.dev page check +(without it, the page loads in a local headless browser); and `GENCLASS_REPORT`, off by default, mirrors finding ids, +kinds, page paths, replay verdicts and counts to that dashboard, never titles or page text. When the project has no +`@genclass/runtime`, `genclass_scan` downloads it from npm through npx. Details: [AGENT.md section 6](https://github.com/genclass-dev/GenClass/blob/main/docs/runtime/AGENT.md#6-untrusted-input-and-security). ## Privacy -The plugin collects nothing and sends nothing to GenClass or anyone else. Findings stay in `.genclass/agent/` in your +By default the plugin collects nothing and sends nothing to GenClass or anyone else; the exceptions you can turn on are +listed above. Findings stay in `.genclass/agent/` in your project (gitignored by the server) and in the bridge's memory. The runtime in your app has its own disclosed diagnostics, which `GenClass.init({ telemetry: false })` turns off ([PRIVACY.md](https://github.com/genclass-dev/GenClass/blob/main/PRIVACY.md)). diff --git a/packages/mcp/plugin/plugin.json b/packages/mcp/plugin/plugin.json index 6f44cb8a..e7806c73 100644 --- a/packages/mcp/plugin/plugin.json +++ b/packages/mcp/plugin/plugin.json @@ -2,7 +2,7 @@ "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "genclass", "version": "0.2.1", - "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Local only.", + "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Runs on your machine; anything it sends is opt-in.", "author": { "name": "GenClass", "url": "https://genclass.dev"