[jshorwitz]

Summary

This draft supersedes #25, #26, and #27. It does not submit anything to the Claude or Anthropic directory, and it does not redirect or take down https://mcp.syntermedia.ai.

Head for the 42-tool and pricing follow-up: bbd608ea30ff26c62ee379903a9ae81d56456203.

34 vs 42

The full plugin keeps tools/directory-tools.json as the 34-name instruction allowlist. Shared skills are still checked against that list.

The Claude directory bundle ships a different file, config/claude-directory/directory-tools.json, copied into packages/claude-directory/tools/directory-tools.json. That list is the 34 names plus the eight tools the packet says the 34-file omits:

get_workspaces, update_active_workspace, google_ads_manage_custom_goals, angstrom_verify_output, run_gaql_query, add_negative_keywords, add_keywords, get_ad_readback.

That is the 42-tool curated surface for /mcp/directory. The private mcp_directory_client source was not readable from this token, so the packet's omission list is the allowlist used here. The builder rejects any other split.

Endpoints and pricing

• Directory bundle URL stays https://mcp.synterai.com/mcp/directory.
• Other new package files stay on https://mcp.synterai.com.
• https://mcp.syntermedia.ai remains the live pending connector origin (submitted 2026-09-04, plugin ID f802a044-fa2c-4a98-8c82-26a2870ca6b3).
• Directory listing copy no longer states plan prices. It points at https://synterai.com/pricing.

No directory submission was made.

Validation

• node scripts/check-directory-tools.js reports the 34-tool full-plugin allowlist and the 42-tool curated surface.
• node --test scripts/*.test.js (30 tests) and python3 -m unittest scripts/test_build_packages.py passed.
• npx -y @anthropic-ai/claude-code@2.1.263 plugin validate packages/claude-directory --strict passed.

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[jshorwitz]

Independent directory-readiness review of head bbd608ea30ff26c62ee379903a9ae81d56456203.

Coverage/reconciliation:

• The 28 changed paths are exactly the union of paths changed by #25, #26, and #27 (with intentional generated-file additions/removals). #28 preserves the Cursor listing/opaque logos and domain cleanup, hosted-tool CI guard and tests, and curated directory URL/30+ copy/build enforcement. The legacy mcp.syntermedia.ai origin is not redirected or removed.
• packages/claude-directory/.mcp.json is HTTP plus https://mcp.synterai.com/mcp/directory; manifest has synter, author, version 1.3.0, license; README is >40 words and links privacy/support/pricing; bundled/config tool lists both contain the intended 42 names (34 + eight).
• GitHub tree at this head has no symlinks, submodules, .gitattributes, oversized/non-text policy flags, or unexpected bundle executable artifacts; repo is public and small.
• Action check runs Validate manifests, skills, and authentication guards and directory-tools succeeded. Logs show 30/30 JS tests, three local plugin-validation passes, 63 instruction files against 34 names, and the 42-name curated surface. CodeRabbit was skipped because this is a draft; this comment is not an approval or portal validation.

Live acceptance result at 2026-11-05 20:14 PT is NOT READY:

• Canonical root and /mcp authorization-server metadata are 200 and advertise S256/DCR/grants, but /.well-known/oauth-protected-resource/mcp/directory and directory server-card.json?profile=directory remain 401. The unauthenticated /mcp/directory 401 points only at root PRM, which does not establish exact-resource discovery.
• review.synterai.com serves Cloud Run placeholder JSON (including service: synter-review-app), not Synter OAuth/MCP. Therefore reviewer sandbox, populate-data, and every-tool claims remain unproven.
• No short-lived authorized MCP token was available, so authenticated initialize/tools/list and raw title/readOnlyHint/destructiveHint checks remain PENDING. No ad writes were attempted.

Validator finding (not a reconciliation coverage gap):

• scripts/check-directory-tools.js live mode currently checks only missing names. An unexpected tool, forbidden catch-all/media tool, or missing raw annotations would not fail --live. Strengthen this gate to require exact set equality on /mcp/directory, ≤64-character names, and per-tool title plus correct boolean readOnlyHint/destructiveHint. The acceptance runner already asserts these independently once a token is provided.

Remaining official-review gates before merge/Change URL: deploy/prove #13357 and directory route on prod; make the real reviewer service healthy with isolated populated sandbox; complete authenticated initialize + exact 42-tool annotation checks; run all 42 valid/invalid tools in MCP Inspector and Claude; reconcile public docs from static X-Synter-Key/full-catalog/43-platform copy to OAuth, /mcp/directory, and 30+; run plugin evals and target-surface tests; validate this exact final commit in the portal and complete owner attestations. Public docs were fetched this turn and still fail those content requirements.

This review supports using #28 as the one reconciliation branch, not merging or submitting it while these blockers remain.

[jshorwitz]

Concrete engineering follow-up for Synter Development (after independent review):

In scripts/check-directory-tools.js, the --live gate currently checks only names missing from the server list. Before using it as release evidence, make it validate the complete raw results for /mcp/directory: exact set equality against the 42-name curated list (reject every unexpected tool and duplicates), names <=64 characters, nonempty title/annotations.title, boolean readOnlyHint/destructiveHint on every tool, correct 29-read/13-write mapping, and fail closed for catch-all or generative-media/payment tools. Preserve initialize/session/SSE/pagination behavior and add unit coverage for extra tools and missing/incorrect annotations. Rerun CI on the resulting head, then continue with authenticated live checks when the short-lived token is supplied through the secure operator workflow.

Live probes at 8:14–8:16 PM PT show this branch must not merge as directory-ready yet: canonical directory PRM and server card are 401; review host is still Cloud Run placeholder; authenticated tools/list is pending. Superseded #25–#27 are closed. No production ad writes or portal changes are authorized from this comment.