From c878714a8a5625f32cf9d39de3fe2ed9517fe526 Mon Sep 17 00:00:00 2001
From: Mr Lyndon Williams <68136524+welshDog@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:42:08 +0100
Subject: [PATCH 1/2] Upgrade .mcp.json to 2026-07-28 MCP spec with Vercel +
 Playwright servers

---
 .mcp.json | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 52 insertions(+), 4 deletions(-)

diff --git a/.mcp.json b/.mcp.json
index 40d38821..51864919 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -1,9 +1,57 @@
 {
   "mcpServers": {
-    "hypercode": {
-      "type": "sse",
-      "url": "http://localhost:8823/sse",
-      "description": "HyperCode AI agent stack — manage agents, tasks, plans, logs and BROski$ economy"
+    "github": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-github"
+      ],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
+      }
+    },
+    "filesystem-hypercode": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem",
+        "."
+      ]
+    },
+    "docker": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-docker"
+      ]
+    },
+    "supabase": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-postgres",
+        "${SUPABASE_DB_URL}"
+      ],
+      "env": {
+        "SUPABASE_DB_URL": "${SUPABASE_DB_URL}"
+      }
+    },
+    "vercel": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@vercel/mcp"
+      ],
+      "env": {
+        "VERCEL_TOKEN": "${VERCEL_TOKEN}"
+      }
+    },
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@executeautomation/playwright-mcp-server"
+      ]
     }
   }
 }

From 753f5a83b73b81d2682ad6a959432d0a0f7de515 Mon Sep 17 00:00:00 2001
From: Lyndz Williams <lyndzwills00001@Hotmail.co.uk>
Date: Sat, 5 Sep 2026 18:18:01 +0100
Subject: [PATCH 2/2] fix(.mcp.json): pin npx MCP servers to real published
 versions, drop two nonexistent packages

Verified each of the 6 npx packages this file references against the live
npm registry. Two don't exist at all -- @modelcontextprotocol/server-docker
and @vercel/mcp both 404 -- not just unpinned, not installable. Removed both;
docker/Vercel MCP access is a separate follow-up, not blocking this fix.

Pinned the 4 real packages to their current published versions:
- @modelcontextprotocol/server-github@2025.4.8
- @modelcontextprotocol/server-filesystem@2026.8.31
- @modelcontextprotocol/server-postgres@0.6.2
- @executeautomation/playwright-mcp-server@1.0.12

Running unpinned npx packages that carry live GitHub/Supabase/Vercel
credentials was the original CodeRabbit finding on this PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zrYB2pwWuyfrGVXMjtah3
---
 .mcp.json | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/.mcp.json b/.mcp.json
index 51864919..9051ece3 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@modelcontextprotocol/server-github"
+        "@modelcontextprotocol/server-github@2025.4.8"
       ],
       "env": {
         "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
@@ -14,43 +14,26 @@
       "command": "npx",
       "args": [
         "-y",
-        "@modelcontextprotocol/server-filesystem",
+        "@modelcontextprotocol/server-filesystem@2026.8.31",
         "."
       ]
     },
-    "docker": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@modelcontextprotocol/server-docker"
-      ]
-    },
     "supabase": {
       "command": "npx",
       "args": [
         "-y",
-        "@modelcontextprotocol/server-postgres",
+        "@modelcontextprotocol/server-postgres@0.6.2",
         "${SUPABASE_DB_URL}"
       ],
       "env": {
         "SUPABASE_DB_URL": "${SUPABASE_DB_URL}"
       }
     },
-    "vercel": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@vercel/mcp"
-      ],
-      "env": {
-        "VERCEL_TOKEN": "${VERCEL_TOKEN}"
-      }
-    },
     "playwright": {
       "command": "npx",
       "args": [
         "-y",
-        "@executeautomation/playwright-mcp-server"
+        "@executeautomation/playwright-mcp-server@1.0.12"
       ]
     }
   }