Manager summary

This replaces source-specific additive keyword scoring with one dependency-free lexical ranker for the full Den capability corpus. REST, administrator, External MCP, marketplace, and skill candidates are merged and ranked on the same 0–100 response scale.

The public contract is unchanged: /mcp/agent still exposes only search_capabilities and execute_capability, and execution/authentication rules remain owned by each source.

What changed

• Shared tokenization, conservative stemming, stopword handling, synonym expansion, rarity, coverage, adjacency, noise filtering, and near-match suggestions.
• Candidate builders for REST, administrator, External MCP, marketplace, and skills, followed by one global rerank.
• Actionable needs_connection and error rows remain discoverable even when ordinary noisy matches are suppressed.
• Source metadata is preserved so results remain explainable.
• All-stopword queries short-circuit without unnecessary provider work.

Safety and runtime behavior

• No embeddings, vectors, LLM calls, or new dependencies.
• Execute paths, grants, tenant boundaries, credentials, and connection health behavior are unchanged.
• Current upstream limits remain authoritative: at most 16 external connections, concurrency 4, lifecycle deadline, and structured diagnostics.
• Network discovery cost is unchanged; this PR only ranks the candidates returned by the existing sources.

Evidence

• Quality benchmark improved the checked corpus from 10/13 (77%) to 11/13 (85%), including invite a teammate and store a note vocabulary gaps.
• REST-catalog benchmark: 35,000 searches over 127 capabilities averaged about 0.61 ms per search.
• 48 focused ranking, catalog, marketplace, External MCP, administrator, organization, and route tests passed.
• Den API typecheck passed.
• GitHub Linux/macOS tests, Den/inference artifact builds, i18n, and Helm validation passed on the current head; there are no review threads or requested changes.

Reviewer focus

1. Ranking weights/noise floor and the small curated synonym map.
2. Global ordering across sources, especially needs_connection rows.
3. Preservation of authorization, diagnostics, fanout limits, and execute behavior.