bump(lumen): cce63058 → 80396366 (#5077)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/bump-tracking.json

@@ -0,0 +1,6 @@
+{
+  "releases-only": [
+    "crowdstrike-falcon-foundry",
+    "crowdstrike-falcon-fusion"
+  ]
+}

.github/workflows/bump-plugin-shas.yml

@@ -57,13 +57,18 @@ jobs:
 
       # createCommitOnBranch-based bump so commits are signed by GitHub and
       # satisfy the org-level required_signatures ruleset on main.
-      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@426e469f322952061102b286b378c0c9733a0934
+      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@9247660a88cf3f49456a2f6464d66fe4ea4f4a77
         id: bump
         with:
           marketplace-path: .claude-plugin/marketplace.json
           max-bumps: ${{ inputs.max_bumps || '30' }}
           only: ${{ inputs.plugin }}
           pr-mode: per-entry
+          # Entries listed in .github/bump-tracking.json {"releases-only": [...]}
+          # bump to the latest published release tag's commit instead of HEAD
+          # (no release / not-ahead / lookup failure -> pin held; see the action
+          # README). All other entries HEAD-track exactly as before.
+          tracking-config: .github/bump-tracking.json
           claude-cli-version: latest
 
       # Per-entry fan-out: dispatch the three required checks against each bump

.github/workflows/validate-licenses.yml

@@ -21,12 +21,18 @@ jobs:
       - name: Check every plugin has an Apache 2.0 LICENSE file
         run: |
           set -euo pipefail
+          # Plugins that intentionally ship a non-Apache LICENSE. claude-security
+          # is deliberately proprietary (see #4427 — replacement rejected); it is
+          # exempt from the Apache 2.0 content check but must still ship a LICENSE.
+          exempt=("plugins/claude-security")
           missing=()
           wrong_content=()
           for plugin_dir in plugins/*/; do
             plugin="${plugin_dir%/}"
             if [[ ! -f "$plugin/LICENSE" ]]; then
               missing+=("$plugin")
+            elif [[ " ${exempt[*]} " == *" $plugin "* ]]; then
+              :  # intentionally non-Apache — LICENSE presence already verified
             elif ! grep -q "Apache License" "$plugin/LICENSE" || \
                  ! grep -q "Version 2.0" "$plugin/LICENSE"; then
               wrong_content+=("$plugin")
@@ -46,4 +52,4 @@ jobs:
             done
             exit 1
           fi
-          echo "All $(ls -d plugins/*/ | wc -l) plugins have an Apache 2.0 LICENSE file."
+          echo "All $(ls -d plugins/*/ | wc -l) plugins have a LICENSE file (Apache 2.0 except documented exemptions)."

external_plugins/asana/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "asana",
-  "description": "Asana project management integration. Create and manage tasks, search projects, update assignments, track progress, and integrate your development workflow with Asana's work management platform.",
+  "description": "Asana project management integration. Connects Claude Code to Asana's V2 MCP server (https://mcp.asana.com/v2/mcp) to create and manage tasks, search projects, update assignments, and track progress. Requires a one-time setup of your own Asana OAuth app — run /asana-setup after installing.",
   "author": {
     "name": "Asana"
   }

external_plugins/asana/.mcp.json

@@ -1,6 +0,0 @@
-{
-  "asana": {
-    "type": "sse",
-    "url": "https://mcp.asana.com/sse"
-  }
-}

external_plugins/asana/README.md

@@ -0,0 +1,68 @@
+# Asana
+
+[Asana](https://asana.com) is a work management platform for tasks, projects, and goals. This plugin connects Claude Code to Asana's **V2 MCP server** so you can create and manage tasks, search projects, update assignments, and track progress directly from your terminal.
+
+> **Migrating from V1?** The V1 beta server (`https://mcp.asana.com/sse`) is deprecated and shuts down on **Wed 5 Aug 2026**. The V2 server requires each user to bring their own Asana OAuth app — Dynamic Client Registration is **not** supported on V2, so there is no zero-config connect. Follow the setup below (or run `/asana-setup`).
+
+## Setup
+
+You only need to do this once. The fastest path is to run **`/asana-setup`** inside Claude Code and follow the printed steps, or do it manually:
+
+### 1. Create an Asana OAuth app
+
+1. Go to the [Asana developer console](https://app.asana.com/0/my-apps).
+2. Create a new app.
+3. Under **OAuth**, add this exact **Redirect URL**:
+
+   ```
+   http://localhost:8080/callback
+   ```
+
+   (This is Claude Code's local OAuth callback. It is `localhost` by design — Claude Code runs on your machine and catches the authorization code on a local listener. It must match the `--callback-port` you use below.)
+4. Copy your **Client ID** and **Client Secret**.
+
+### 2. Add the Asana V2 server to Claude Code
+
+Run this in your terminal (not inside a Claude prompt — the secret is entered at a hidden prompt):
+
+```bash
+claude mcp add --transport http \
+  --client-id YOUR_CLIENT_ID --client-secret \
+  --callback-port 8080 \
+  asana https://mcp.asana.com/v2/mcp
+```
+
+- Replace `YOUR_CLIENT_ID` with the Client ID from step 1.
+- `--client-secret` with no value makes Claude Code prompt for the secret and store it securely in your OS keychain (never on disk).
+- `--callback-port 8080` must match the port in the redirect URL you registered.
+
+### 3. Authenticate and verify
+
+1. The next time the `asana` server is used, Claude Code opens your browser for Asana consent. Approve it.
+2. Confirm the connection:
+
+   ```
+   /mcp
+   ```
+
+   You should see `asana` listed as **connected**.
+3. Try it: ask Claude Code to "list my Asana workspaces" or "show my assigned tasks."
+
+## Example usage
+
+Ask Claude Code to:
+
+- "Create an Asana task in the Backend project titled 'Fix login bug' assigned to me."
+- "What are my Asana tasks due this week?"
+- "Search Asana for projects about onboarding."
+
+## Troubleshooting
+
+- **`invalid_redirect_uri`** — the redirect URL in your Asana app must be exactly `http://localhost:8080/callback`, and the `--callback-port` must be `8080`. If you use a different port, register `http://localhost:<PORT>/callback` to match.
+- **`invalid_client`** — double-check the Client ID and re-enter the Client Secret (`claude mcp remove asana`, then re-run the add command).
+- **Auth server / DCR errors** — V2 does not support Dynamic Client Registration; you must supply a pre-registered `--client-id` and `--client-secret` as shown above.
+
+## Documentation
+
+- [Integrating with Asana's MCP server](https://developers.asana.com/docs/integrating-with-asanas-mcp-server)
+- [Connecting MCP clients to Asana's V2 server (Claude Code)](https://developers.asana.com/docs/connecting-mcp-clients-to-asanas-v2-server)

external_plugins/asana/commands/asana-setup.md

@@ -0,0 +1,42 @@
+---
+description: Set up the Asana V2 MCP server connection (one-time OAuth app + claude mcp add)
+argument-hint: "[client_id]"
+---
+
+The user wants to connect Claude Code to Asana's V2 MCP server. Guide them through the one-time setup below. Do NOT run `claude mcp add` yourself — the `--client-secret` prompt needs a real terminal (a hidden TTY prompt), so the user must run it in their own terminal.
+
+Their Asana OAuth Client ID (if provided): `$1`
+
+Print these steps clearly, substituting the Client ID into the command if `$1` is non-empty (otherwise leave the `YOUR_CLIENT_ID` placeholder):
+
+## Step 1 — Create an Asana OAuth app (one time)
+
+1. Open the Asana developer console: https://app.asana.com/0/my-apps
+2. Create a new app.
+3. Under **OAuth**, add this exact **Redirect URL**:
+   ```
+   http://localhost:8080/callback
+   ```
+4. Copy the **Client ID** and **Client Secret**.
+
+Note: `localhost` is correct — Claude Code is a local client and catches the OAuth callback on your own machine. Asana's V2 server does not support Dynamic Client Registration, so you must bring your own client_id + client_secret.
+
+## Step 2 — Add the server (run this in YOUR terminal)
+
+```bash
+claude mcp add --transport http \
+  --client-id YOUR_CLIENT_ID --client-secret \
+  --callback-port 8080 \
+  asana https://mcp.asana.com/v2/mcp
+```
+
+- `--client-secret` (no value) triggers a hidden prompt; paste the Client Secret there. It is stored in your OS keychain.
+- The port in `--callback-port` must match the `http://localhost:8080/callback` redirect you registered.
+
+## Step 3 — Authenticate & verify
+
+1. On first use, Claude Code opens your browser for Asana consent — approve it.
+2. Run `/mcp` and confirm `asana` shows as **connected**.
+3. Test it: ask "list my Asana workspaces".
+
+After printing the steps, offer to help troubleshoot if they hit `invalid_redirect_uri` (redirect/port mismatch) or `invalid_client` (wrong id/secret).

external_plugins/context7/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context7",
-  "description": "Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.",
+  "description": "Upstash Context7 MCP server for up-to-date documentation lookup. Connects to Context7's hosted remote MCP server (https://mcp.context7.com/mcp) — no local Node.js or npx required — to pull version-specific documentation and code examples directly from source repositories into your LLM context. Works anonymously out of the box; set CONTEXT7_API_KEY for higher rate limits.",
   "author": {
     "name": "Upstash"
   }

external_plugins/context7/.mcp.json

@@ -1,6 +1,11 @@
 {
-  "context7": {
-    "command": "npx",
-    "args": ["-y", "@upstash/context7-mcp"]
+  "mcpServers": {
+    "context7": {
+      "type": "http",
+      "url": "https://mcp.context7.com/mcp",
+      "headers": {
+        "Authorization": "${CONTEXT7_API_KEY:-}"
+      }
+    }
   }
 }

external_plugins/context7/README.md

@@ -0,0 +1,35 @@
+# Context7
+
+[Context7](https://context7.com) solves a common problem with AI coding assistants: outdated training data and hallucinated APIs. Instead of relying on stale knowledge, Context7 fetches current documentation and code examples directly from source repositories.
+
+This plugin connects Claude Code to Context7's hosted remote MCP server (`https://mcp.context7.com/mcp`) — no local Node.js, npm, or npx required.
+
+## Available Tools
+
+- **`resolve-library-id`** — searches for libraries and returns Context7-compatible identifiers (e.g. `/vercel/next.js`) plus available versions.
+- **`query-docs`** — fetches documentation for a specific library, ranked by relevance to your question.
+
+## API Key (optional)
+
+Without an API key the plugin connects anonymously and shares the anonymous rate limits. To use your own plan, create an API key in the [Context7 dashboard](https://context7.com/dashboard) and export it as an environment variable before launching Claude Code:
+
+```bash
+# e.g. in ~/.zshrc or ~/.bashrc
+export CONTEXT7_API_KEY="your-api-key"
+```
+
+The plugin's MCP server configuration picks up `CONTEXT7_API_KEY` automatically. Restart Claude Code after setting it, then verify usage in the [dashboard](https://context7.com/dashboard).
+
+## Usage
+
+The plugin works automatically when you ask about libraries:
+
+- "How do I set up authentication in Next.js 15?"
+- "Show me React Server Components examples"
+- "What's the Prisma syntax for relations?"
+
+To get documentation for a specific version, include the version in the library ID (e.g. `/vercel/next.js/v15.1.8`). The `resolve-library-id` tool returns available versions, so you can pick the one that matches your project.
+
+---
+
+Maintained by [Upstash](https://upstash.com). Source and full plugin (with skills, agents, and commands): [upstash/context7](https://github.com/upstash/context7).

plugins/plugin-dev/skills/mcp-integration/SKILL.md

@@ -99,9 +99,9 @@ Connect to hosted MCP servers with OAuth support. Best for cloud services.
 **Configuration:**
 ```json
 {
-  "asana": {
+  "hosted-service": {
     "type": "sse",
-    "url": "https://mcp.asana.com/sse"
+    "url": "https://mcp.example.com/sse"
   }
 }
 ```

plugins/plugin-dev/skills/mcp-integration/examples/sse-server.json

@@ -1,9 +1,5 @@
 {
   "_comment": "Example SSE MCP server configuration for hosted cloud services",
-  "asana": {
-    "type": "sse",
-    "url": "https://mcp.asana.com/sse"
-  },
   "github": {
     "type": "sse",
     "url": "https://mcp.github.com/sse"

plugins/plugin-dev/skills/mcp-integration/references/authentication.md

@@ -35,7 +35,6 @@ No additional auth configuration needed! Claude Code handles everything.
 ### Supported Services
 
 **Known OAuth-enabled MCP servers:**
-- Asana: `https://mcp.asana.com/sse`
 - GitHub (when available)
 - Google services (when available)
 - Custom OAuth servers

plugins/plugin-dev/skills/mcp-integration/references/server-types.md

@@ -143,9 +143,9 @@ Connect to hosted MCP servers via HTTP with server-sent events for streaming. Be
 **OAuth (Automatic):**
 ```json
 {
-  "asana": {
+  "hosted-service": {
     "type": "sse",
-    "url": "https://mcp.asana.com/sse"
+    "url": "https://mcp.example.com/sse"
   }
 }
 ```
@@ -172,7 +172,6 @@ Claude Code handles OAuth flow:
 ### Use Cases
 
 **Official Services:**
-- Asana: `https://mcp.asana.com/sse`
 - GitHub: `https://mcp.github.com/sse`
 - Other hosted MCP servers