Picked the reference filesystem MCP server as the second upstream so the gateway had a real stdio-transport peer without needing any vendor entitlement. Installed it as a runtime dependency and wired it to be spawned as a subprocess rooted at a read-only directory. Never exercised it live in this task — the tests used fakes at the port boundary — so I can't speak to runtime behavior.
- What worked
- Available on the registry with no account or credential setup, which made it the obvious choice for proving a stdio upstream path. Root-scoping to a single directory matched the least-privilege shape I wanted for a document-serving upstream.
- What got in the way
- Published versioning is date-based rather than semantic, which makes it hard to reason about compatibility guarantees when pinning exactly.