Repository navigation
Triage the open PR backlog #4877
Description
Part of the triage tracker #4875. Blocked by #4857 (2026-07-28 Spec Refactor) and #4858 (agentic software factory). The shared conventions (close labels, close notes, throttling) are in #4875.
Goal
Triage every open PR: about 317 as of 2026-09-26. Each one ends up either carried forward (ported to the refactored code, or used as the reference for a tracked issue) or closed with a labelled note. Modeled on inspector#1819.
Why this comes after the refactor
Almost every open PR targets main and the pre-refactor code: SDK v1 APIs and the 2025-era protocol. Once #4857 lands, most of them no longer apply cleanly. Triage then asks "is the idea still wanted on the new code?", not "does this diff merge?".
Buckets
- Server submissions and README listing PRs: close as out of scope and point to the MCP Registry.
- PRs against archived servers: close and point to
servers-archived. - Superseded by the refactor: the change is already covered by Tracker: 2026-07-28 Spec Refactor #4857 (e.g. SDK bumps, v2 ports such as fix(fetch): port to mcp SDK v2 #4565 and feat: MCP v2 (draft) #4452), or the code no longer exists. Close with thanks. Where a PR was used as a reference, credit it.
- Still valuable: a real bug fix or an in-scope enhancement. Don't merge the stale diff. Open or link a
v2issue on the board that references the PR as the reference implementation, and credit the author. Then close the PR with a note pointing to that issue, or ask the author to rebase ontov2/main, depending on the contribution policy set in Tracker: Agentic software factory (AGENTS.md, skills, quality gates, v2/main release flow) #4858. - Dependency and automation PRs (e.g. Dependabot): close if superseded by the refactor's dependency set or the factory's dependency sweeps.
- Security-weakening proposals: close with the security-declined label, in addition to the main close label, using the Inspector's three-condition test adapted to these servers. Never apply it to a PR that fixes a vulnerability; those get handled as security fixes.
Tasks
- Take a full snapshot of open PRs (
gh pr list --state open --limit 1000 --json …) and record the counts per bucket in a comment here before closing anything. - Create the shared close labels, if the issue pass hasn't already.
- Finalize the close notes, one per bucket. Each one references Tracker: Triage the open issue and PR backlog #4875 in the original comment.
- Hand-review buckets 4 and 6 before closing anything in bulk.
- Run the scripted, throttled closes. Don't lock threads, so authors can reply.
- Post a final summary here: counts per label, and the list of PRs carried forward as issues.
Acceptance criteria
- No open PR predates the refactor unless it was deliberately kept, with the reason recorded here.
- Every closed PR carries a close label and a note that references Tracker: Triage the open issue and PR backlog #4875.
Activity
cliffhall commentedon Oct 20, 2026
Snapshot and bucket counts (2026-10-20)
Snapshot taken at
origin/v2/mainf18beb7: 272 open PRs, matching the repository's total. 7 are maintainer-authored and are left to their authors: #3163, #3175, #3353, #4497, #4498 and #4528 still targetmain, and #4551 targetsv2/main. No Dependabot PRs remain open, and #3260 (decided under #4860) is no longer open.The other 265 outside PRs were each read, with their diffs, linked issues and discussion, and checked against the current code by static reading. A few bug claims were also reproduced against
v2/main's own code with local fixtures. No PR's code was run.closed-out-of-scope, Registry pointerclosed-archived-serverclosed-superseded-v2closed-superseded-v2, naming the tracking issueclosed-out-of-scopeclosed-security-declined, alongside their main label (#3179, #3218, #3616, #3678)Bucket 4 is carried forward through issues, not by merging the stale diffs:
v2+ type + scope and boardedIncomingwith no milestone and a posted score. Pass 2 (milestoning) stays with a maintainer.Every close comment references #4875 in the original comment. Closes are paced at 8 seconds per write and stop on the first failure.
cliffhall commentedon Oct 20, 2026
Final summary (2026-10-20)
The PR backlog pass is complete. Of the 265 outside PRs in the snapshot, 249 are closed and 16 are held open for the maintainers. Every closed PR was checked afterwards: each is closed, carries at least one close label, and has exactly one close note that references #4875. No thread was locked.
Closes per label
closed-superseded-v2closed-out-of-scopeclosed-archived-serverclosed-security-declinedCarried forward as issues (95 PRs)
Correction to the snapshot comment above: the 55 PRs in the first group went to 32 existing open issues, not 25.
55 PRs credited on 32 existing issues. Each issue got a comment naming its PRs as prototypes and crediting their authors:
search_filesfunction description leads to misunderstanding of its purpose #896 ← fix(filesystem): clarify that search_files matches names, not contents #3716remotesupport #1611 ← feat(git): add git_current_branch, git_default_branch, and git_remote tools #3396sequentialthinking's tool definition costs ~921 tokens/session; about half duplicates the schema's own parameter descriptions #4507 ← fix(sequentialthinking): trim duplicative description sections #4508appuser (since #2205) but never switch to it; all seven images run as root #4741 ← fix(docker): switch to non-root user in all MCP server Dockerfiles #4742 fix(docker): switch to non-root user in container images #4745 fix(docker): actually run all seven servers as their non-root user #4783fetchinstalls npm packages during a tool call, which is worth stating for deployments #4830 ← docs(fetch): note runtime npm downloads and egress requirements (#4830) #483340 PRs harvested into 31 new issues. Each is labelled
v2+ type + scope and boardedIncomingwith no milestone, a Priority and a posted score comment. Each body has a "Prior work" section crediting the PRs' authors.context_serversconfig snippets #4231Still open, deliberately kept
main, and their author should retarget or close them. feat(everything): serve both protocol eras on SDK v2 (2026-07-28 + legacy) #4551 targetsv2/main.Left for a maintainer
Incomingissues (filesystem: a client Root is allowed only in its realpath form, unlike command-line directories #5183 to git, time: the Zed configuration snippets are invalid JSON #5213): assign milestones or close.main.This issue stays open until the security PRs are decided, as the acceptance criteria require each kept PR's reason to be recorded here.