The vendor catalog this site generalizes
This repo already tracks its own dependency ecosystem as durable warehouse facts, not just lockfiles: migrations/postgres/006_ecosystem_catalog.sql defines fact_orgs (GitHub orgs: a2aproject, modelcontextprotocol, redis-rs, microsoft), fact_repositories (repos with stars/language/archived status, FK'd to dim_vendor for cloned repos), and dim_packages (npm + crates packages including last_updated_at, is_archived, is_deprecated).
The .vendors.toml file at the repo root lists 11 entries, all cloned to vendors/. This site's 4 rows correspond to exactly the 2 of those 11 vendor repos this repo has real, compiling/deployed code depending on:
| vendors/ path | org/repo | this repo's real dependency |
|---|---|---|
vendors/modelcontextprotocol/rust-sdk | modelcontextprotocol/rust-sdk | rmcp = "1" in crates/mcp-server/Cargo.toml |
vendors/modelcontextprotocol/typescript-sdk | modelcontextprotocol/typescript-sdk | reference clone only -- no workers/*/package.json in this repo currently imports @modelcontextprotocol/sdk |
vendors/a2aproject/a2a-js | a2aproject/a2a-js | @a2a-js/sdk: "^0.3.13" in workers/web/package.json |
vendors/a2aproject/a2a-rs | a2aproject/a2a-rs | a2a-lf / a2a-server-lf git dependencies in crates/a2a-bridge/Cargo.toml |
The other 7 .vendors.toml entries (Kuberwastaken/claurst, modelcontextprotocol/servers, opencoworkers/subagentjobs itself, microsoft/pg_durable, microsoft/duroxide, microsoft/duroxide-pg, redis-rs/redis-rs) are cloned for indexing/reference but are not SDK dependencies this repo's own code imports, so they are deliberately out of scope for this catalog.
Source: this repo's own CLAUDE.md "Vendor catalog" and ".vendors.toml repos" sections, plus a live directory listing of vendors/ confirming all 4 relevant clones exist.