MCP count inflated by marketplace catalog templates (discovered_mcp)

[SatanicMechanic]

Description

SUMMARY: MCP Servers N found counts files under ~/.claude/plugins/marketplaces/**/.mcp.json and ~/.claude/plugins/cache/** as servers. These are marketplace catalog templates (available to install), not active MCP servers. On a machine with 1 active server (~/.claude.json -> mcpServers: { boostgraph }), the pretty/JSON output reports ~20 servers — 14+ are external_plugins/*/.mcp.json templates.

Steps to reproduce

1. Install Claude Code with default marketplace cache populated (~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/*/.mcp.json exists — created on first claude run, no plugin actually enabled).
2. Ensure only one active MCP: ~/.claude.json contains one mcpServers entry, claude_desktop_config.json and ~/.claude/settings.json have mcpServers: {}.
3. Run ./stepsecurity-dev-machine-guard --json | jq .mcp_configs

Actual

mcp_configs contains ~18-20 entries with config_source: "discovered_mcp" for every:

• .../plugins/marketplaces/claude-plugins-official/external_plugins/*/.mcp.json (terraform, discord, gitlab, linear, etc.)
• .../plugins/cache/** (ponytail/*/opencode.json, marketplace ghost copies)

pretty renders MCP SERVERS 20 found and lists them alongside the one real server.

Expected

Only active/configured servers should count toward the summary, or catalog hits should be separated. Suggested:

• Exclude ~/.claude/plugins/marketplaces/ and ~/.claude/plugins/cache/ from the walk (mcp_discovery.go: discoverWalkedMCPConfigs / mcpWalkExcludeDirs or ShouldSkip check), or
• Keep discovery but split output: MCP Servers: 1 active (N discovered catalog) and summary.mcp_active_count vs mcp_discovered_count.

The current JSON mixes active and catalog under the same mcp_configs array with discovered_mcp, making fleet telemetry and --json | jq .mcp_configs_count misleading.

Context

• internal/detector/mcp_discovery.go:31 mcpConfigBasenames + discoverWalkedMCPConfigs walks $HOME and matches any mcp.json/.mcp.json/opencode.json by basename — correctly finds project configs, but also marketplace cache.
• allConfigLocations() (line ~70) merges known exact paths + walked configs with no filter for marketplace paths.
• mcpVendorForPath labels many catalog hits as Anthropic/OpenCode based on substring claude/opencode, further implying they are live.

Proposed fix

Add exclusion for plugin marketplace dirs during the walk, e.g. skip **/plugins/marketplaces/** and **/plugins/cache/** (or at minimum don't count them in MCPConfigsCount/pretty summary). Happy to PR if maintainers prefer exclusion vs split counts — please advise preferred UX.