chore(mcp-servers): move module to coder-labs namespace

[DevelopmentCats]

Why

mcp-servers landed in the coder namespace in #1083, but it fits coder-labs better. Moving it now while it is still at 0.0.1 and unreleased, so no published module source has to change.

Changes

Relocates registry/coder/modules/mcp-servers to registry/coder-labs/modules/mcp-servers and updates every namespace-derived path:

• module_directory → $HOME/.coder-modules/coder-labs/mcp-servers, matching the coder-labs/pool convention
• Runtime paths derived from it: the Node bootstrap dependencies dir and the github-headers.sh helper
• Registry source address in the README examples → registry.coder.com/coder-labs/mcp-servers/coder
• coder exp sync script names in main.tftest.hcl, which coder-utils derives from module_directory (coder-mcp-servers-* → coder-labs-mcp-servers-*)
• Helper path assertions in auth.test.ts

No behaviour changes. The icon path (../../../../.icons/mcp.svg) is unchanged because the namespace sits at the same depth.

Validation

• terraform fmt -check — passed
• terraform validate — passed
• terraform test — 10 passed, 0 failed

The main.tftest.hcl sync-name assertions failed on the first run and caught the coder-utils caller_name derivation, which is included above. Container-based tests were not run locally; CI covers those.

[github-actions]

Module Scorecard Check

coder-labs/mcp-servers: first scorecard, 57 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	15 / 25	18 / 20	5 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows basic usage and GitHub authentication modes (token-env, external-auth, native-oauth) with examples. However, the examples do not demonstrate all major configuration combinations (e.g., no example showing multiple clients with different auth modes, no example showing preselect with different client sets). Each auth mode is documented but not as complete standalone examples with sensible defaults.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	README documents Coder External Auth integration for GitHub MCP authentication, which provides auth governance. No mention of AI Gateway or Agent Firewall for routing or policy enforcement. Only one governance mechanism documented earns half.
Dashboard entry point	5	5	Module uses coder_parameter for server selection, which creates a workspace creation form field. This provides a dashboard entry point for configuration.
Session continuity	5	0	No documentation of resuming existing agent sessions across reconnects or relaunches. No mention of session managers like tmux, screen, or native resume support.
Managed configuration	5	5	Module manages MCP server configuration through mcp-add, writing to client-specific config files (.claude.json, .cursor/mcp.json, .codex/config.toml). Authentication configuration is also managed. Fully documented.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The github_auth variable contains token_env_var which references environment variables rather than accepting token values directly. README examples consistently avoid inline secrets, using environment variable references and external auth. No examples show literal tokens.
Non-hardcoded auth path	4	2	README documents Coder External Auth (external-auth mode) which avoids pasting raw keys. However, this is only one of multiple auth modes; the primary documented approach is token-env which still requires the user to provide a token (via User Secret or template env var). External auth is documented but presented as one option among several, not the primary path.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the download URLs for Node.js (hardcoded to nodejs.org), mcp-add (hardcoded via npx), or Playwright MCP (hardcoded via npx). The local_server_image variable only applies to native-oauth mode and is for a Docker image, not the primary tool downloads.
Bring-your-own binary	10	0	No documented way to disable Node.js bootstrap when already present. The module checks for Node.js 18+ and skips download if found, but this is automatic detection, not a documented bring-your-own-binary mode. No way to skip mcp-add or Playwright MCP downloads.
Egress transparency	3	1.5	Endpoints are scattered across examples: nodejs.org for Node.js, api.githubcopilot.com for GitHub MCP, npm registry for mcp-add and Playwright MCP, ghcr.io for native OAuth image. No dedicated README section enumerating all external endpoints. Mentions scattered across unrelated examples earn at most half per rubric.
Runs without sudo	2	2	Scripts in install.sh.tftpl and auth.sh.tftpl never invoke sudo. All operations use user home directory paths. Full credit from code verification.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults (e.g., default = [], mode = "none"), and comprehensive validation blocks. Validation covers client names, server names, auth modes, version formats, port ranges, and image pinning.
Test coverage	4	2	.tftest.hcl covers parameter validation, defaults, and auth mode logic. TypeScript tests in auth.test.ts and main.test.ts cover authentication flows and install behavior end-to-end. However, test coverage is incomplete: no tests for Playwright server configuration, no tests for native-oauth mode execution, no tests for multiple server selection. Business logic coverage is partial.

Overall — 57 / 100

Raw 52 / 92 → round(52 / 92 × 100) = 57

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.

[Copilot]

Pull request overview

This PR relocates the mcp-servers Terraform module from the coder namespace to coder-labs, aligning it with the intended ownership/organization before the module is released, and updates all namespace-derived runtime paths and test expectations accordingly.

Changes:

• Update module_directory and runtime helper/cache paths to $HOME/.coder-modules/coder-labs/mcp-servers/....
• Update README examples to use the new registry source address registry.coder.com/coder-labs/mcp-servers/coder.
• Update Terraform and Bun/Docker-based tests to reflect the new coder-utils derived script names and helper paths.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
registry/coder-labs/modules/mcp-servers/scripts/install.sh.tftpl	Moves Node bootstrap dependency cache path under the coder-labs module directory.
registry/coder-labs/modules/mcp-servers/scripts/auth.sh.tftpl	Updates the generated GitHub headers helper path to the new module directory.
registry/coder-labs/modules/mcp-servers/README.md	Updates module source address examples and documented runtime paths for coder-labs.
registry/coder-labs/modules/mcp-servers/main.tftest.hcl	Updates coder-utils script-name assertions to the new coder-labs-* prefix.
registry/coder-labs/modules/mcp-servers/main.tf	Updates coder_utils.module_directory to the new coder-labs root.
registry/coder-labs/modules/mcp-servers/main.test.ts	Adds container-executed install-script coverage for selection/no-selection and failure modes under the relocated module.
registry/coder-labs/modules/mcp-servers/auth.test.ts	Updates helper path assertions to the new coder-labs module directory.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.