MCP plugin: say what it can send, instead of "sends nothing"

docs/adoption/listings/mcp.md

@@ -101,7 +101,7 @@ official registry); docs.github.com "Extend Copilot Chat with MCP" (VS Code adds
   > in the GitHub MCP Registry. It is a local server for coding agents: it shows the agent what happened inside a web
   > app's pages on the developer's machine in causal order, re-runs a page with network responses delivered in
   > different orders to find race conditions, replays one exact order to prove a fix, and writes a Playwright
-  > regression test. It needs no account or API key and sends nothing off the machine. Measured so far on one page
+  > regression test. It needs no account or API key and sends nothing off the machine unless you turn that on. Measured so far on one page
   > (a stale-response race): it found the race in 5 of 6 reordered runs and reported nothing on the fixed page.
   > Install in VS Code: `code --add-mcp '{"name":"genclass","command":"npx","args":["-y","@genclass/mcp@0.2.1"]}'`.
   > Thank you.
@@ -120,9 +120,11 @@ support.claude.com "Anthropic Software Directory Policy".
   `genclass-dev/genclass-plugin`, no plugin path (the plugin is the repository root), branch `main`; Validate.
   GenClass itself cannot be submitted: the portal stops validating a repository whose GitHub archive is over
   50 MiB (pre-submission checklist), and GenClass's is 51 MiB. Listing details are read from
-  `.claude-plugin/plugin.json` and `README.md` at that root (the same files as `packages/mcp/plugin/`). Data handling: the plugin
+  `.claude-plugin/plugin.json` and `README.md` at that root (the same files as `packages/mcp/plugin/`). Data handling: by default the plugin
   collects and sends nothing; it reads and writes `.genclass/agent/` in the project and `~/.genclass/` (the bridge
-  token); the optional dashboard read is the only network request off the machine. Compliance: contact email and
+  token); what goes off the machine is opt-in: the dashboard read (`GENCLASS_DASHBOARD`), the dashboard mirror
+  (`GENCLASS_REPORT`) and `genclass_scan` with `hosted: true`; `genclass_scan` also downloads the runtime from npm when
+  the project does not have it. Compliance: contact email and
   the four acknowledgements. Updates: GitHub push webhook.
 - **What the checks will say.** Local run of `claude plugin validate --profile directory` on the assembled
   repository and on `packages/mcp/plugin` (Claude Code 2.1.311, 2026-10-28): passes with nothing to report; the
@@ -252,7 +254,7 @@ Source: cline/mcp-marketplace `README.md` and `.github/ISSUE_TEMPLATE/mcp-server
   > in a web app (stale responses that overwrite newer data, double submits, errors that happen "sometimes"): it
   > records what happened inside the app's pages on the developer's machine in causal order, re-runs a page with
   > network responses delivered in different orders, replays one exact order to confirm a bug and its fix, and
-  > writes a Playwright regression test. Local only: no API key, nothing sent off the machine. Measured so far on one
+  > writes a Playwright regression test. Runs on your machine: no API key, nothing sent off it unless you turn that on. Measured so far on one
   > page: the race was found in 5 of 6 reordered runs, with no false report on the fixed page.
 
 ## 7. mcpservers.org

llms-install.md

@@ -5,7 +5,7 @@ These are the steps for an agent (Cline or another) that is asked to install Gen
 re-runs a page with network responses delivered in different orders to find race conditions, replays one exact order,
 and writes a Playwright regression test; it also audits any page for visual bugs (`genclass_scan`). It is free, it
 needs no API key and no account, and it sends nothing off the machine (unless the agent asks `genclass_scan` for
-`hosted: true`, which sends that URL to the genclass.dev page check). (Closed-loop development as a service, with the MCP server, collector and dashboard run for a customer's
+`hosted: true`, which sends that URL to the genclass.dev page check, or you set `GENCLASS_DASHBOARD` or `GENCLASS_REPORT`, which talk to your own dashboard). (Closed-loop development as a service, with the MCP server, collector and dashboard run for a customer's
 developers by GenClass or inside their network, is an Enterprise offer: https://genclass.dev/enterprise.)
 
 ## 1. Requirements

packages/mcp/README.md

@@ -384,10 +384,10 @@ your machine (the exceptions are under Privacy). See section 6 of
 
 ## Privacy
 
-The server collects nothing and sends nothing to GenClass or anyone else. Findings stay on your machine, in
+By default the server collects nothing and sends nothing to GenClass or anyone else. Findings stay on your machine, in
 `.genclass/agent/` in the server's working directory (the project, for clients that start servers there; set
 `GENCLASS_STATE_DIR` for clients that do not, such as Claude Desktop), which the server gitignores, and in the bridge's memory; the bridge's token is in
-`~/.genclass`. The one request that leaves the machine is `genclass_analytics` `{source: "production"}`, which reads
+`~/.genclass`. `genclass_analytics` `{source: "production"}` reads
 your own GenClass dashboard when you set `GENCLASS_DASHBOARD` to its private link. `genclass_scan` loads the page the
 agent names (that is the page's own traffic) in a local browser; only with `hosted: true` is the URL sent to the
 genclass.dev page check, and when the project has no `@genclass/runtime` with `scan`, npx downloads it from npm. With `GENCLASS_REPORT` set (off by

packages/mcp/package.json

@@ -2,7 +2,7 @@
   "name": "@genclass/mcp",
   "version": "0.2.1",
   "mcpName": "io.github.genclass-dev/genclass",
-  "description": "GenClass for coding agents: an MCP server that sees what happens inside your app's pages (clicks, requests, the order responses arrived, state writes, errors), re-runs them with the network answering in different orders to find race conditions, and replays one exact order to prove a fix. Local only, no dependencies.",
+  "description": "GenClass for coding agents: an MCP server that sees what happens inside your app's pages (clicks, requests, the order responses arrived, state writes, errors), re-runs them with the network answering in different orders to find race conditions, and replays one exact order to prove a fix. Runs on your machine; anything it sends is opt-in; no dependencies.",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {

packages/mcp/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "genclass",
   "version": "0.2.1",
-  "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Local only.",
+  "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Runs on your machine; anything it sends is opt-in.",
   "author": {
     "name": "GenClass",
     "url": "https://genclass.dev"

packages/mcp/plugin/README.md

@@ -34,7 +34,7 @@ page of the dev server. The page side needs `@genclass/runtime` 0.3.0-beta.1 or
 In the plugin repository the server is vendored: `server/cli.mjs` is the published `@genclass/mcp@0.2.1` build (its
 `dist/cli.js`, byte for byte, fetched from npm by the daily sync), `server/genclass-mcp.mjs` is the package's command
 importing it, and `.mcp.json` and the hook run them with `node` from `${CLAUDE_PLUGIN_ROOT}`, so installing the plugin
-installs nothing and runs the exact release it was reviewed with; there is no `package.json` or lockfile. The copy of
+installs nothing and runs the exact release it was reviewed with (the one download is `genclass_scan`'s, below); there is no `package.json` or lockfile. The copy of
 this folder inside GenClass runs `npx -y @genclass/mcp@0.2.1` instead (nothing built is committed there).
 `plugin.json` and `mcp.json` at this folder's root are the same server in the
 [Agent Plugins](https://agent-plugins.org) format, for Cursor, Codex and other clients that read it (server and skill,
@@ -50,15 +50,18 @@ no bridge is running or nothing is new, and gives up after 0.8 seconds if the br
 of a session only sets the cursor (`genclass_findings` has the backlog).
 
 The server listens on 127.0.0.1 only and accepts pages from this machine (`localhost`, `127.0.0.1`, `*.localhost`)
-or origins you list in `GENCLASS_AGENT_ORIGINS`. Nothing leaves your machine, except `genclass_analytics`
-`{source: "production"}`, which reads your own GenClass dashboard when you set `GENCLASS_DASHBOARD` to its link, and
-`genclass_scan` with `hosted: true`, which sends the URL to the genclass.dev page check (without it, the page loads
-in a local headless browser).
+or origins you list in `GENCLASS_AGENT_ORIGINS`. Nothing leaves your machine unless you or your agent ask
+for it: `genclass_analytics` `{source: "production"}` reads your own GenClass dashboard when you set
+`GENCLASS_DASHBOARD` to its link; `genclass_scan` with `hosted: true` sends the URL to the genclass.dev page check
+(without it, the page loads in a local headless browser); and `GENCLASS_REPORT`, off by default, mirrors finding ids,
+kinds, page paths, replay verdicts and counts to that dashboard, never titles or page text. When the project has no
+`@genclass/runtime`, `genclass_scan` downloads it from npm through npx.
 Details: [AGENT.md section 6](https://github.com/genclass-dev/GenClass/blob/main/docs/runtime/AGENT.md#6-untrusted-input-and-security).
 
 ## Privacy
 
-The plugin collects nothing and sends nothing to GenClass or anyone else. Findings stay in `.genclass/agent/` in your
+By default the plugin collects nothing and sends nothing to GenClass or anyone else; the exceptions you can turn on are
+listed above. Findings stay in `.genclass/agent/` in your
 project (gitignored by the server) and in the bridge's memory. The runtime in your app has its own disclosed
 diagnostics, which `GenClass.init({ telemetry: false })` turns off ([PRIVACY.md](https://github.com/genclass-dev/GenClass/blob/main/PRIVACY.md)).
 

packages/mcp/plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "genclass",
   "version": "0.2.1",
-  "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Local only.",
+  "description": "See what happens inside your app's pages in causal order, find race conditions by replaying different response orders, reproduce a bug exactly and prove the fix with a generated Playwright test. Runs on your machine; anything it sends is opt-in.",
   "author": {
     "name": "GenClass",
     "url": "https://genclass.dev"