docs(mcp): record the live Cursor and OpenCode checks (#2268)

The Cursor section said "Not verified live." and the OpenCode section
recorded runs up to OpenCode 2.0.18.
Cursor 3.27.22 and OpenCode 2.2.5, both on Linux, were connected to a
local Studio with the token written into the Authorization header of
their user-level settings files (~/.cursor/mcp.json, and
~/.config/opencode/opencode.json with mcp.servers and oauth: false),
and each called list_connections, inspect_schema and run_read_query,
each answered.
Both sections now record those runs, and say that the environment
variable form their snippets show was not part of them.
Tests in tests/unit/mcp-documentation.test.ts pin the new lines.

Author: cevheri

docs/MCP.md

@@ -499,7 +499,8 @@ bearer_token_env_var = "LIBREDB_MCP_TOKEN"
 
 ### Cursor
 
-Not verified live.
+Verified live on 2026-11-06 with Cursor 3.27.22 on Linux.
+That run, against a local Studio, had the server in `~/.cursor/mcp.json` with the token written into its `Authorization` header rather than read through `${env:LIBREDB_MCP_TOKEN}`, and Cursor called `list_connections`, `inspect_schema` and `run_read_query`, each answered.
 
 In `.cursor/mcp.json`:
 
@@ -575,6 +576,8 @@ Do not commit a settings file that holds a token.
 ### OpenCode
 
 Verified live on 2026-09-26 with OpenCode 1.18.31, 1.18.32 and 2.0.18, on Linux and Windows.
+Verified live on 2026-11-06 with OpenCode 2.2.5 on Linux.
+That run, against a local Studio, had the server under `mcp.servers` with `oauth: false` in `~/.config/opencode/opencode.json` and the token written into its `Authorization` header rather than read through `{env:LIBREDB_MCP_TOKEN}`, and OpenCode called `list_connections`, `inspect_schema` and `run_read_query`, each answered.
 
 In `opencode.json`, as a remote server under `mcp.servers`, where OpenCode 2 looks for servers and OpenCode 1 reads them too ([OpenCode's MCP servers page](https://opencode.ai/docs/mcp-servers), and [the OpenCode 2 page](https://opencode.ai/v2/docs/mcp-servers)); `oauth: false` turns off the OAuth sign-in OpenCode would otherwise attempt, and `{env:...}` reads the token from the environment:
 

tests/unit/mcp-documentation.test.ts

@@ -460,6 +460,21 @@ describe("docs/MCP.md", () => {
     for (const section of sections) expect(section).toMatch(/Verified live on \S+ with |Not verified live\./);
   });
 
+  test("records the live Cursor run, and that the ${env:...} form was not part of it", () => {
+    const cursor = MCP_DOC.split(/^### /m).find((section) => section.startsWith("Cursor\n"));
+    expect(cursor).toContain(
+      "Verified live on 2026-11-06 with Cursor 3.27.22 on Linux.\nThat run, against a local Studio, had the server in `~/.cursor/mcp.json` with the token written into its `Authorization` header rather than read through `${env:LIBREDB_MCP_TOKEN}`, and Cursor called `list_connections`, `inspect_schema` and `run_read_query`, each answered.\n",
+    );
+    expect(cursor).not.toContain("Not verified live.");
+  });
+
+  test("records the live OpenCode 2.2.5 run, and that the {env:...} form was not part of it", () => {
+    const opencode = MCP_DOC.split(/^### /m).find((section) => section.startsWith("OpenCode\n"));
+    expect(opencode).toContain(
+      "Verified live on 2026-11-06 with OpenCode 2.2.5 on Linux.\nThat run, against a local Studio, had the server under `mcp.servers` with `oauth: false` in `~/.config/opencode/opencode.json` and the token written into its `Authorization` header rather than read through `{env:LIBREDB_MCP_TOKEN}`, and OpenCode called `list_connections`, `inspect_schema` and `run_read_query`, each answered.\n",
+    );
+  });
+
   test("mentions a batch only in the line that says batches are refused", () => {
     expect(MCP_DOC.split("\n").filter((line) => /batch/i.test(line))).toEqual([
       "- JSON-RPC batches are refused: a request body that is a JSON array gets 400 and `-32600`.",