name: forge-scout description: Query external sources (MCP Registry, anthropics/skills, installed marketplaces) for candidate implementations of a specified capability. Applies the 6-rule trust heuristic to each candidate and returns ranked recommendations. Use when forge-gap has identified a gap and forge-lead needs to decide whether to install an existing implementation or author a new one. Only use for single-query bounded lookups — for competitive cross-roster analysis, forge-lead must delegate to research-github-miner instead. disable-model-invocation: true allowed-tools: Bash(gh api *) Bash(gh search *) Read Glob WebFetch

Forge scout

Primary data sources

1. MCP Registry (STRONG-PRIMARY): https://registry.modelcontextprotocol.io/v0/servers

   • Endpoint: GET /v0/servers?search=<keyword>&limit=100
   • Cursor pagination: metadata.nextCursor opaque string
   • Recent-updates: ?updated_since=<RFC3339>
   • Public read, no auth.

2. anthropics/skills (STRONG-PRIMARY): gh api repos/anthropics/skills/contents/skills

   • Returns the 17 official Anthropic skill directories.
   • For each match: gh api repos/anthropics/skills/contents/skills/<name>/SKILL.md to pull the frontmatter.

3. Installed marketplaces (STRONG-PRIMARY, on disk): ~/.claude/plugins/marketplaces/*/

   • huggingface-skills/skills/<name>/SKILL.md
   • ai-research-skills/NN-<topic>/<name>/SKILL.md
   • claude-code-skills/engineering-team/<name>/SKILL.md
   • claude-plugins-official/<plugin>/ via installed_plugins.json

4. Installed plugins (~/.claude/plugins/installed_plugins.json).

The 6-rule trust heuristic for MCP Registry entries

Before recommending any MCP server, apply these checks (ALL must pass for HIGH trust):

1. Package registry preference: packages[].registryType must be npm | pypi | oci | nuget. Reject smithery-only remote unless the Forge has a smithery API key.
2. Github repository: server.repository.url must be populated with a github.com URL. Reject opaque entries.
3. Version maturity: server.version >= 1.0.0 OR multiple iterations in the version history. Reject single one-shot 0.1.x unless no alternative exists.
4. Description stability: if multiple versions exist, descriptions must be consistent across versions. Flag description churn.
5. Transport availability: packages[].transport.type must include stdio for local runnability. Accept streamable-http only if stdio is also available.
6. Auth profile: prefer authorization: none for read-only tools. Accept auth-required only if the server is load-bearing.

Servers passing >=5 rules: HIGH trust. >=3: MEDIUM. <3: REJECTED.

Query protocol

Input: capability description (e.g., "Semantic Scholar paper search") from forge-gap or forge-lead.

Steps:

1. MCP Registry: gh api "https://registry.modelcontextprotocol.io/v0/servers?search=<keyword>&limit=50". If nothing found, broaden to synonyms.
2. anthropics/skills: check if one of the 17 official skills already covers the capability (use the name + description match).
3. Installed marketplaces: Glob for SKILL.md matching keywords in their description.
4. Apply trust heuristic to each candidate.
5. Cross-validate high-value candidates by fetching the candidate's README or SKILL.md (via WebFetch or on-disk Read).

Output format

Write to ~/.claude/forge/scout-reports/<timestamp>-<capability>.md:

# Scout report — <capability>

## HIGH-trust candidates
1. <name> (<registry>/<identifier> v<version>, <stars>*)
   - URL: <repo_url>
   - Trust rules passed: 1,2,3,4,5,6
   - Install command: <exact command>
   - Why adopt: <1-sentence>

## MEDIUM-trust candidates
...

## REJECTED
...

## Recommendation for forge-lead
<INSTALL|ADOPT|AUTHOR|DEFER> — <rationale>

Hard rules

• Never recommend INSTALL without verifying the trust heuristic passes >=5 rules.
• Never rank by stars alone — the 6-rule heuristic is binding.
• If no HIGH-trust candidate exists, recommend AUTHOR or DEFER, not a MEDIUM adoption.
• If the capability needs cross-roster competitive analysis, recommend forge-lead delegate to research-github-miner via a research-request drop-file.