30-min poll since run #24 (16:38Z). Bilale: no new chat messages since 15:07:48Z; he's still hitting /agent occasionally from 46.255.205.219. GH notifications 0. Approval queue empty. focus.md unchanged. waiting_on_bilale still 4 items, no resolutions. Two non-trivial external observations:
Run #23 logged a single 14-path sweep from 49.47.199.109 at 16:08:38-49Z (11s). At 16:50:20-30Z the same IP fired the exact same sweep again — same 14 paths, same ordering, same 10s duration. So this is the same IP/operator doing periodic ecosystem cataloguing, not a one-shot scan. The 42-min interval is too short for a daily cron but consistent with either (a) hourly-or-faster scheduling on their side, (b) re-runs as they iterate on the scanner code. State so far:
Both still return 404 on all 14 OAuth-discovery paths and 200 on /mcp/sse (correct behavior; we don't do MCP-OAuth). Promote-to-lesson threshold is N=3 distinct IPs OR (downgraded by same-IP return) we now have strong evidence of an active periodic scanner even at N=2 IPs. Bilale-relevant per focus.md ("ecosystem-research-grade scan" = the kind of meta-activity that drives mindshare in a not-yet-existing category). Promoting watch from 48h → ongoing. Still NOT promoting to lesson yet — need either 3rd distinct IP, or any UA variation, or a follow-up probe targeting /api/* paths after the 404 reconnaissance.
At 16:43:36-37Z (1 second), a brand-new IP (72.154.68.130, never seen before on this server per grep of access.log + access.log.1) fired a textbook MCP lifecycle from python-httpx/0.28.1:
16:43:36 POST /mcp 200 1182 initialize response
16:43:37 POST /mcp 202 0 notifications/initialized accepted
16:43:37 POST /mcp 200 41557 tools/list full response
16:43:37 DELETE /mcp 200 0 session terminated cleanly
16:43:37 GET /mcp 200 5 health/probe ping after close
Why this is novel: every other MCP client we've logged (54.67.34.241 stuck, ke/JS via Cloudflare, 143.198.151.210 DigitalOcean node, the 52.151.23.248 Azure python-httpx, the 146.190.153.30 trio) does init+tools/list and then either disconnects ungracefully (TCP RST) or keeps the session open. 72.154.68.130 is the first IP to emit DELETE /mcp — that's the MCP-spec-correct session-termination call. Combined with the post-close GET probe, this looks like a client written to spec rather than a quick-and-dirty integration. python-httpx is the same library Anthropic ships in mcp-cli and mcp-inspector test harnesses, but those typically use longer-lived sessions; this looks more like an automated test runner or CI integration probe.
N=1, no return yet. Not lesson-worthy alone. Adds to the pattern that multiple distinct python-httpx clients are testing our MCP layer this week — Azure (52.151), AWS (146.190 trio per run #20), and now this US IP (72.154). If a 4th python-httpx IP appears with the DELETE pattern, that's likely a published-tool fingerprint and worth tracking which tool.
{"ts": "2026-05-15T17:07:43Z", "action": "run #25: mcp-dcr-hunter/2.0 from 49.47.199.109 RETURNED at 16:50:20Z with identical 14-path OAuth-discovery sweep — 42min after first hit (16:08Z) — confirming this is a periodic ecosystem cataloguer not a one-shot scan; SEPARATELY a brand-new IP 72.154.68.130 fired a textbook clean MCP lifecycle init→tools/list→DELETE→GET at 16:43:37Z (first time we've ever logged DELETE /mcp — spec-correct session termination, python-httpx/0.28.1, US IP, no return yet); both observation-only", "outcome": "0 commits, 0 approval cards, 0 lesson updates; advances 2 watch items — mcp-dcr-hunter promoted to confirmed periodic scanner pattern (still N=2 distinct IPs, need 3rd or UA variation for full lesson promote), and python-httpx-clean-session adds to the pattern of multiple cloud python-httpx integrators testing our MCP this week (Azure run #23, AWS trio run #20, US now); chat-notified Bilale in French", "next_focus_suggestion": "next run: (1) check if mcp-dcr-hunter fires again at ~17:32Z (would confirm ~42min cadence); (2) check if 72.154.68.130 returns or if another python-httpx IP fires the same DELETE-/mcp pattern (would suggest published tool); (3) /aip-1 short-URL ask from run #21 still pending — don't pile on"}