mcp-ecosystem-replication1.0

Replication package: the MCP server ecosystem Code, samples, generated tables and human validation material for: What a registry settles and what it does not: observability and enforceability in the Model Context Protocol ecosystem — Jun'an Chen, University of Electronic Science and Technology of China. What is here Directory Contents src/, scripts/ The pipeline: harvest, analysis, enrichment, validation, packaging config/config.yaml Every run parameter, including the freeze date results/tables/ The 34 result tables the manuscript reports results/validation/ Coding worksheets, evidence packs, agreement statistics, the T1 test results/figures/ Figures 1–4 as generated docs/ Research plan, all four codebook versions, threats to validity, venue decision paper/ Manuscript source, fact sheet, style and compliance tooling data/interim/ Seeded sample records and the harvest cursor data/raw/ The frozen registry harvest the census was computed from THIRD_PARTY.md What third-party material the package reproduces, and on what basis What is not here, and why The raw registry harvest (data/raw/registry.jsonl, 131 MB) is included: it is the population the census counts, and shipping it lets the analysis be recomputed without re-harvesting a registry that has since grown. MANIFEST.csv records its SHA-256, so the snapshot analysed can be identified exactly; the upstream registry remains its authoritative copy. One consequence is worth knowing before you clone. The GitHub mirror of this package cannot carry a 131 MB file, so .gitignore excludes the harvest there. verify_manifest.py reports it as OMITTED rather than MISSING in that case. The DOI deposit contains it in full. The package also reproduces, verbatim, third-party text that the human coding was performed on: the READMEs of the sample repositories and the tool descriptions of the sample packages. Those remain under their originating projects' licences and are not covered by this package's licence. THIRD_PARTY.md itemises them. The HTTP cache under data/cache/ is also omitted: it is a performance artefact, and every entry can be regenerated from the public sources. Elsevier's CAS document class is not redistributed either. paper/latex/ contains the manuscript source and its bibliography, but the class files (cas-dc.cls, cas-common.sty, cas-model2-names.bst) belong to the publisher and carry its copyright. To rebuild the PDF, obtain them from the journal's author template download and place them beside mcp-ecosystem.tex, then run paper/build.ps1. Nothing in the analysis depends on them. Reproducing the study cd mcp-ecosystem-replication python -m pip install -r requirements.txt python scripts/01_harvest_registry.py # data/raw/registry.jsonl python scripts/02_analyze_registry.py # results/tables python scripts/03_enrich_packages.py --workers 8 python scripts/04_extract_tools.py --sample 1200 --seed 20260924 python scripts/05_enrich_github.py --releases --sample 800 --seed 20260927 python scripts/06_cross_analysis.py python scripts/10_ingest_part_a.py --codes results/validation/T1.txt python scripts/11_ingest_part_b.py python scripts/12_ingest_part_c.py python scripts/13_interrater.py python scripts/16_version_vs_release.py python scripts/17_build_facts.py Steps 1–7 rebuild every raw input from public sources and need network access. Steps 8–18 run offline against what those produce. Every step is resumable and caches its HTTP responses, so an interrupted run continues where it stopped. The reproduce GitHub workflow runs the offline steps and verifies MANIFEST.csv on every push. Verifying the package python scripts/verify_manifest.py This recomputes the SHA-256 of every file listed in MANIFEST.csv and fails on any mismatch. Line endings matter: .gitattributes normalises the repository to LF, and the manifest was generated on a check-out in that state. Determinism Both sampling steps use recorded seeds (20260924 for tool extraction, 20260927 for repository enrichment), and the drawn sets are stored under data/interim/. Re-running with the same registry snapshot reproduces the same samples. Re-running against a newer snapshot will not, which is why the freeze date is a configuration value rather than a constant in the code. Licence Code under MIT (LICENSE); data, tables and documents under CC-BY-4.0 (LICENSE-DATA.md). Building the manuscript PDF paper/latex/mcp-ecosystem.tex compiles with Elsevier's CAS bundle (cas-dc.cls, cas-common.sty, cas-model2-names.bst). Those files are the publisher's copyrighted material and are deliberately not redistributed here; download them from the journal's own template page and place them beside the .tex before running: powershell -ExecutionPolicy Bypass -File paper/build.ps1 The build also runs the journal-compliance audit, the citation check and the style metrics, so a clean run confirms the manuscript still meets the requirements the paper reports.