Tracker: Triage the open issue and PR backlog

[cliffhall]

Goal

Triage this repo's open backlog: 258 open issues and 317 open PRs as of 2026-09-26. Everything still relevant gets labelled and put on the Servers V2 board. Everything else is closed with a respectful, labelled, queryable audit trail.

This follows the Inspector's v2 go-live triage:

• inspector#1819: triage and bulk-close the v1 PR backlog
• inspector#1872: triage the issue backlog, backfill version labels, close legacy items, put the rest on the board

When

After both of these are done:

• Tracker: 2026-07-28 Spec Refactor #4857, the 2026-07-28 Spec Refactor: most open PRs target the pre-refactor code and SDK v1 APIs, and most bug reports describe pre-refactor behavior. Triage needs the new baseline to decide what still applies.
• Tracker: Agentic software factory (AGENTS.md, skills, quality gates, v2/main release flow) #4858, the agentic software factory: AGENTS.md, the issue-create / issue-triage / board-ops skills, and the contribution policy they set should exist first, so triage follows the rules and close notes can link to them.

Sub-issues

• Triage the open issue backlog #4876 Triage the open issue backlog
• Triage the open PR backlog #4877 Triage the open PR backlog

The two can run in either order. The Inspector did PRs first, and a merged or ported PR can resolve issues, which shrinks the issue pass.

Shared conventions (both sub-issues)

• Close labels: create a small set, used for both issues and PRs so the two can be queried together. The exact set is decided in the first sub-issue worked. Likely candidates:
  • a closed-* label for items superseded by the v2/2026-07-28 refactor
  • one for archived servers (these belong in servers-archived)
  • one for out-of-scope requests (new server submissions and README listing requests go to the MCP Registry)
  • one for proposals declined on security grounds, applied in addition to the main close label
• Close notes:
  • Adapt the Inspector's notes. Thank the author, apologise for the wait, state the policy, make clear it is not a judgment on the problem or the person, and invite a fresh issue if the problem persists after v2.
  • Reference this tracker in the original comment, not in a later edit, so every closed item appears in the tracker's timeline.
• Never close a vulnerability report as a declined proposal. Security reports go through GitHub Security Advisories.
• Script it, and throttle (about 3–4 seconds between closes) to avoid GitHub's secondary rate limits. Don't lock threads.
• Use --limit 1000 on gh list commands. The default of 30 badly understates a backlog this size.
• Anything kept gets the v2 label, the right server-* label, a place on the Servers V2 board with a Status, and a milestone, following the AGENTS.md / board-ops rules from Tracker: Agentic software factory (AGENTS.md, skills, quality gates, v2/main release flow) #4858.