Generated host configs target wrong npm identity and unsupported MCP commands

Finding

Generated MCP registrations cannot resolve the maintained package or start the advertised command.

• Severity: Medium functionality, Low supply-chain exposure
• Confidence: High
• Estimated effort: 1–2 days
• Expected impact: restore the advertised MCP/agent integrations and prevent generated configuration from resolving an unintended npm identity.

Confirmed evidence

• package.json publishes the package and CLI as worldgraphs.
• The README explicitly notes that the bare worldgraph npm name is unavailable.
• trust.json nevertheless authorizes npm:worldgraph.
• Eight registrations across these generated host files invoke worldgraph@latest mcp start or worldgraph@latest mcp index:
  • optional-mcps/worldgraph.json
  • .claude/settings.json
  • .codex/config.toml
  • .opencode/opencode.json
  • .openclaw/openclaw.json
  • .vscode/mcp.json
• bin/cli.js implements only init, doctor, version, and help. The mcp command follows the unknown-command path and exits nonzero.
• __tests__/smoke.test.ts explicitly asserts that unknown commands fail.
• No matching WorldGraph issue or pull request was open when checked.

The upstream generator class is already tracked in ruvnet/metaharness#154; this issue is the repository-specific identity migration and generated-artifact repair.

Reproduction

1. Inspect the package name/bin in package.json.
2. Inspect each generated host registration listed above.
3. Run npx worldgraphs mcp start; the current CLI has no mcp handler and exits with status 2.
4. Independently note that the generated command uses worldgraph@latest, not the maintained worldgraphs package.

Acceptance test

• Every distribution/package reference resolves worldgraphs.
• Either implement functioning stdio mcp start and mcp index commands, or stop emitting registrations that invoke them.
• Add a host-matrix process/handshake test covering all generated host configurations.
• npm test, build, package dry-run, and doctor pass.
• Preserve the internal harness identifier worldgraph where it is not an npm identity.
• A repository-wide check finds zero unintended npm:worldgraph or worldgraph@latest references.

Dream verdict

The defect is confirmed, but no runnable checkout was available to validate a patch.

INCONCLUSIVE

Start with package.json and bin/cli.js, then inspect the generated registrations in optional-mcps/worldgraph.json, .claude/settings.json, .codex/config.toml, .opencode/opencode.json, .openclaw/openclaw.json, and .vscode/mcp.json. Run the listed npx command and tests/smoke.test.ts, then use the acceptance test as the completion checklist: consistent package identity, valid or removed MCP commands, host-matrix coverage, and passing npm test, build, package dry-run, and doctor.