Pin npx-launched packages to fixed versions

agent-compatibility/README.md

@@ -49,31 +49,31 @@ The plugin does not bundle the scanner. It runs the published npm package when n
 Default scan (compact terminal dashboard):
 
 ```bash
-npx -y agent-compatibility@latest .
+npx -y agent-compatibility@0.1.7 .
 ```
 
 JSON output:
 
 ```bash
-npx -y agent-compatibility@latest --json .
+npx -y agent-compatibility@0.1.7 --json .
 ```
 
 Markdown output:
 
 ```bash
-npx -y agent-compatibility@latest --md .
+npx -y agent-compatibility@0.1.7 --md .
 ```
 
 Plain text output:
 
 ```bash
-npx -y agent-compatibility@latest --text .
+npx -y agent-compatibility@0.1.7 --text .
 ```
 
 Config override for ignored paths or weight overrides:
 
 ```bash
-npx -y agent-compatibility@latest . --config ./agent-compatibility.config.json
+npx -y agent-compatibility@0.1.7 . --config ./agent-compatibility.config.json
 ```
 
 The scanner is heuristic. It scores repo signals and surfaces likely friction, but it is not a full quality verdict on the codebase.

agent-compatibility/agents/compatibility-scan-review.md

@@ -15,7 +15,7 @@ Use when the task is specifically to run the published `agent-compatibility` sca
 
 ## Workflow
 
-1. Try the published scanner first with `npx -y agent-compatibility@latest --json "<path>"`.
+1. Try the published scanner first with `npx -y agent-compatibility@0.1.7 --json "<path>"`.
 2. If you are clearly working inside the scanner source repo and the published package path fails for an environment reason, fall back to the local scanner entrypoint.
 3. Only say the scanner is unavailable after you have actually tried the published package, and the local fallback when it is clearly available.
 4. Prefer JSON when you need structured reasoning. Prefer Markdown when the user wants a direct report.

third_party/playwright/README.md

@@ -14,7 +14,7 @@ Or run `/add-plugin playwright` in chat.
 
 ## Requirements
 
-This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@latest`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio.
+This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@0.0.83`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio.
 
 The first run downloads Playwright's browser binaries. That can take a minute and needs network access; later runs reuse the cached browsers.
 
@@ -25,7 +25,7 @@ The first run downloads Playwright's browser binaries. That can take a minute an
   "mcpServers": {
     "playwright": {
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
+      "args": ["-y", "@playwright/mcp@0.0.83"]
     }
   }
 }

third_party/playwright/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "playwright": {
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
+      "args": ["-y", "@playwright/mcp@0.0.83"]
     }
   }
 }

third_party/xero/README.md

@@ -22,7 +22,7 @@ Or run `/add-plugin xero` in chat.
       "command": "npx",
       "args": [
         "-y",
-        "@xeroapi/xero-mcp-server@latest"
+        "@xeroapi/xero-mcp-server@0.0.17"
       ],
       "env": {
         "XERO_CLIENT_ID": "${XERO_CLIENT_ID}",

third_party/xero/mcp.json

@@ -5,7 +5,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@xeroapi/xero-mcp-server@latest"
+        "@xeroapi/xero-mcp-server@0.0.17"
       ],
       "env": {
         "XERO_CLIENT_ID": "${XERO_CLIENT_ID}",