Inventory every built-in remote MCP entry for #986 Phase 1

[KristianYe]

What changed, and why

#986's plan starts with an inventory: a matrix of every built-in remote MCP entry with its auth, provenance, category, Featured flag, whether CI could exercise it, and when it was last verified. Until now the record (docs/MCP-CATALOG-STATUS.md, from #1006) covered only the 231 official OAuth, tenant and open entries the discovery probe could reach. This PR replaces that appendix with the full 288-row inventory and classifies each entry for Phase 2 (yes 12 · key-fixture 53 · oauth-manual 182 · tenant 40 · dead-suspect 1).

To fill the missing 57 rows (51 api_key, the four third-party platforms, two self-hosted templates), each was swept on 2026-09-16 with three checks: an MCP initialize with no key, the same with an invalid key attached exactly the way fleet attaches a real one, and fleet's own add-time validation (remotemcp.probeServer: initialize + tools/list over the SSRF-safe client) replayed with that key. The third-party OAuth entries went through mcpoauth.Discover; every docs_url was fetched.

Five findings are added to the audit table:

• F14 — 25 of the 51 api_key vendors accept an invalid key through the add-time check; they check the key only at the first tool call, so a mistyped key is saved with a "connected, N tools" confirmation. docs/MCP-CATALOG.md now says the check proves the key only where the vendor checks it at the handshake.
• F15 — 19 api_key entries also publish OAuth protected-resource metadata and could become one-click OAuth entries after a live add.
• C10 — Composio's documented tenant URL 307-redirects to a path ending in /mcp; fleet refuses redirects. Needs a real server id before the catalog changes.
• C11 — Synter Ads (community, hidden by default) serves an HTML page at its MCP URL: the one dead-suspect entry.
• V4 — Coda's and Leonardo.Ai's docs_url answer 403 / 500 to a plain GET (bot walls, most likely).

Docs only. No catalog data or code changes; no operator action.

How you verified it

• The 57-entry sweep ran against the live vendors on 2026-09-16 with two untracked helpers (a probe that reuses mcpoauth.CanonicalResourceURI/Discover/SafeHTTPClient, and a replay of remotemcp.probeServer through internal/mcp with a bogus key); the raw JSONL outputs are kept off-repo with the Test oauth flow with official MCPs #1006 audit. Results: all 51 api_key endpoints alive; 26 reject the bogus key at the handshake, 25 accept it; Zapier and Make discover cleanly.
• The inventory table is generated from the catalog YAML, the 2026-09-14 appendix rows and the two sweeps, then spliced in; checked that it has exactly 288 data rows with a uniform column count, that the counts in the intro sum to 288 (live 12 + probe 187 + probe 55 + not probeable 34), and git diff --check is clean.
• Nothing in make lint/make test is exercised by a docs-only diff; not run.

Scope and deviations

Shipped: the Phase 1 matrix with the columns the issue lists, plus a probe-verdict and notes column carried over from the 2026-09-14 appendix so no information from #1501 is lost. The issue's can CI hit? vocabulary (yes / oauth-manual / tenant / dead-suspect) gained one value, key-fixture, because "yes (api_key with fixture)" is not true of any entry today — no fixture exists — and saying so is more useful to Phase 2 than folding those 53 rows into yes.

Deferred, on purpose: every fix the findings point at (F14 add-time check, F15 auth re-typing, C10/C11 catalog data, V4 links) — Phase 2/4 work, each its own PR when asked. The helper tools are not committed; Phase 2's scripts/mcp-catalog-lint.sh is the place for a repo-owned checker.

---

• The title and "What changed, and why" are written for the release notes
  they become (there is no changelog file — ADR-0061): they prefill the
  squash commit message, which release.yml publishes as the release
  notes, with breaking changes and operator actions stated plainly
• A design note (docs/<FEATURE>.md) added, if this ships a feature — n/a, docs only
• An ADR added or superseded in docs/adr/, if this adds, weakens or
  reverses an invariant — required in the same PR — n/a
• The diff is scoped to one change (no unrelated refactors)

🤖 Generated with Claude Code