hermes - 💡(How to fix) Fix [mcp_lazy] HIGH: synthetic mcp_server_<name> stub collides with a real MCP server named 'server'

Severity: HIGH (correctness, namespace collision)

The synthetic mcp_server_<name> discovery-stub namespace collides byte-for-byte with a real MCP server literally named server.

Evidence

• plugins/mcp_lazy/server_stubs.py:18 — server stub name pattern is mcp_server_<name>.
• plugins/mcp_lazy/stubs.py:218-220, 230-249 — probe confirms _extract_server('mcp_server_trek', None) → 'server' and _server_in_set('mcp_server_list', {'server'}) → True.

A real MCP server named server exposes tools mcp_server_* indistinguishable from the synthetic discovery-stub namespace. Server-mode stubbing and the #18 retirement logic in pre_tool_call (hook_impl.py:227) will misclassify those real tools.

Impact

Any MCP server named server breaks lazy classification and stub retirement — real tools treated as discovery stubs.

Fix

Disambiguate synthetic stubs by sentinel/metadata, not name prefix. In pre_tool_call, confirm mcp_server_* is NOT in agent.valid_tool_names before treating it as a discovery stub. Add a regression test for the collision.

Filed from opus-4.8 plugin audit (mcp_lazy) vs upstream NousResearch plugin conventions.