feat(mcp): add registry posture scanning

[rodboev]

Summary

SkillSpector can now inspect MCP Registry server records before a user connects to them. The new scan mode normalizes the official registry payload (server identity, version and status metadata, repository, package, and remote references) into stable hashed snapshots, then reports deterministic posture risks: unpinned packages, missing integrity hashes, missing repository references, deprecated status, and plain-http remotes, all without changing ordinary skill scans.

Refs #121

This design keeps the diffable-snapshot goal proposed in the issue discussion. Checks that depend on fields the official registry does not publish (tool manifests, declared permissions, security contacts, publisher verification flags) are left to follow-up slices against sources that publish them.

Diff Notes

• add one MCP Registry adapter and a source-independent normalized server snapshot with a canonical record hash that covers owner-official metadata
• follow paginated MCP Registry responses for full-registry and server-name scans, accept only the official registry URL, guard against repeated pagination cursors, and assess a server-name scan against the owner's latest version record rather than every historical version
• add deterministic checks for package version pinning, fileSha256 integrity, repository presence, official status, and remote transport security, and aggregate finding risk so unsafe scans cross the CLI threshold
• normalize leniently because the registry owns its schema: absent or wrong-typed optional fields become unavailable evidence with zero risk, explicitly bad values such as mutable tags, partial npm ranges, or malformed hashes are scored as asserted risk, unrecognized status values are scored rather than rejected, and {var} URL templates pass through; only structurally unusable payloads fail, with source-named errors
• add skillspector scan --mcp-registry as a thin CLI route with JSON snapshot output, rejecting unsupported non-JSON formats and skill-only flags
• add offline owner-shaped MCP Registry fixtures, adapter tests, posture boundary tests, and CLI routing coverage

Scope

This change leaves the skill graph, MCP server transport, existing LP/TP analyzers, baseline and SARIF formats, and provider credentials unchanged. Unknown registry facts remain unknown instead of being scored as confirmed risks. This first slice is MCP Registry only, so it does not add a generic registry-source selector or any Glama/Smithery adapter. Live Glama/Smithery fetchers, tool-manifest posture checks, generalized registry-verification semantics, dependency-CVE resolution, and cross-snapshot diff presentation are follow-up surfaces.

Verification

• uv run pytest tests/unit/test_mcp_registry.py tests/unit/test_cli.py -k "mcp_registry or registry" - 51 passed, 12 deselected in 1.03s
• uv run pytest tests/unit/test_cli.py -k "scan and not mcp_registry" - 11 passed, 11 deselected in 1.08s
• uv run ruff check src/ tests/ - All checks passed!
• uv run ruff format --check src/ tests/ - 146 files already formatted
• uv run mypy src/skillspector/mcp_registry.py - Success: no issues found in 1 source file

Live source checked during implementation: https://registry.modelcontextprotocol.io/v0/servers, schema https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json.

[rng1995]

[Automated SkillSpector Review]

Approved. The MCP Registry mode is well scoped: remote acquisition accepts only the exact official registry endpoint, follows pagination with a repeated-cursor guard, and normalizes owner records into stable hashes. Posture checks distinguish unavailable evidence from asserted unsafe values, and CLI routing leaves ordinary skill scans unchanged while rejecting incompatible formats and flags.

Coverage includes normalization, package pinning and hashes, official status, plain-HTTP remotes, pagination, untrusted URL rejection, malformed payloads, risk aggregation, and CLI exit behavior. No correctness, security, schema, or test blocker was found. GitHub currently reports no completed check runs for this head.