feat: surface registry repository and packages on catalog entries

[daviddanialy]

Completes the registry-parsing slice of AIS-468. The registry client parsed only remotes, silently dropping the linked source repository and published packages a registry declares for a server — the two fields the approval evidence surface and the artifact pin-and-fetch work (AIS-479) both need.

What it does

ExternalMCPServerEntry gains two optional fields, parsed from the standard MCP registry server.json shape (verified against the live registry):

• repository — URL, hosting source, and monorepo subfolder.
• packages — registry type, identifier, version, runtime hint, and artifact digest when the registry publishes one.

Framing

Both are registry declarations: nothing ties a linked repository or package to what a remote endpoint actually runs. The API descriptions say so explicitly, because these feed an approval surface that must not present a repo link as attestation.

Absence stays meaningful: a registry that links nothing surfaces as absent rather than as empty links, and a package entry too incomplete to identify an artifact is dropped rather than surfaced as an empty declaration.

Cache

The registry cache schema version bumps (v2 → v3): previously cached catalog pages lack the new fields, and serving them would read as "the registry declared nothing" for every server until natural expiry.

Not in this PR

The server detail endpoint (getServerDetails) keeps its current shape — the catalog list is what the approval evidence reads. License is deliberately absent: verified earlier that registry responses carry no license field anywhere; package licenses come from the registry-metadata lookups that already exist in the approval evidence packages.

Testing

New list-parse test covering both fields, the incomplete-package drop, and the nothing-linked case; 63 externalmcp tests green. mise run lint:server, mise run gen:sdk, and pnpm -F dashboard type-check all pass.

AIS-468

🤖 Generated with Claude Code

---

Summary by cubic

Expose registry-linked source repository and published packages on catalog entries, including package transport and demanded environment variables, so admins see provenance and install/auth requirements. Supports AIS-468’s evidence panel and prepares for artifact pin-and-fetch.

• New Features

  • Parse and surface repository and packages from registry server.json on ExternalMCPServerEntry.
  • Added ExternalMCPRepository and ExternalMCPPackage to API/OpenAPI/SDK, plus ExternalMCPPackageEnvironmentVariable.
  • Package fields include registry_type, identifier, version, runtime_hint, transport_type, file_sha256, registry_base_url, and environment_variables (name, is_secret, is_required, description). Nameless variables and incomplete package entries are dropped.
  • Absence is meaningful: omit empty links. API descriptions frame these as registry declarations, not verified runtime state.

• Migration

  • Registry cache schema bumped to v3; older cached pages will refetch automatically.

^{Written for commit 04a0a9b. Summary will update on new commits.}

[linear-code]

AIS-468

[changeset-bot]

🦋 Changeset detected

Latest commit: 04a0a9b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

cubic analysis

All reported issues were addressed across 18 files

Linked issue analysis

Linked issue: AIS-468: feat: assemble every known signal about an MCP server

Status	Acceptance criteria	Notes
✅	Parse and expose the registry's `repository` declaration on ExternalMCPServerEntry (as a repository object)	The registry JSON -> types mapping and API schemas now include ExternalMCPRepository and ExternalMCPServerEntry.repository; marshalling/unmarshalling and generated types were added.
✅	Parse and expose declared `packages` from the registry on ExternalMCPServerEntry	New ExternalMCPPackage type and packages field are added to the server entry schema and types; conversion from registry package JSON is implemented and surfaced.
✅	Drop package entries that are too incomplete to identify an artifact rather than surfacing empty declarations	Conversion function explicitly skips entries missing required registry_type, identifier, or version; tests assert incomplete entries are dropped.
✅	Represent absent repository/packages as absent (nil/empty) rather than as empty links	toExternalMCPRepository returns nil when repository is absent or URL empty; packages returns an empty slice when none; tests assert repository is nil and packages empty for the 'bare' case.
✅	Bump registry cache schema so previously cached listings don't falsely show absence of the new fields	registryCacheSchemaVersion was incremented (v2 -> v3) to ensure old cached entries don't read back as missing the new fields.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>