Completed the high-priority findings from the gpt-5.5 architecture review. Development plugins are opt-in and production defaults are safer.
Completed Changes
- MISC_MCP_DEV_MODE enables external plugin directories and /home/john/py/mcp-tools; production loads built-in tools only.
- MISC_MCP_DEBUG_TRACEBACKS enables full client-visible tracebacks; full traces are logged server-side by default.
- Plugin discovery caches content versions and keeps the last-known-good export after changed-module syntax/import failures.
- Mailbox scans have MAX_SCAN_RECORDS bounds and raw email reads have a 5 MiB MAX_EMAIL_BYTES bound.
- misc_mcp_rc.sh runs the server as john with HOME=/home/john, production mode, PID tracking, and logging.
- The substantive dev_file implementation is tracked in dev_plugins/dev_file_tools.py; /home/john/py/mcp-tools/dev_file_tools.py is only its runtime wrapper.
Validation
python -m unittest -q test_mcp_tool_plugins.py passed all 30 tests on 2026-09-05. Python compilation, shell syntax, and git diff checks passed.
Install The rc Child
The rc child was installed successfully at /etc/rcs/misc-mcp with root:root ownership and mode 0755. Its status check reports not running when stopped; it is ready for rc.local startup.
Remaining Boundary
Development plugins execute in the MCP process when enabled. The operator has explicitly accepted supervised development execution: enable MISC_MCP_DEV_MODE=1 manually, observe logs, and stop the process when finished. Production rc.local startup keeps MISC_MCP_DEV_MODE=0.