Feature/package mcp bundle - #45
Merged
Merged
Conversation
- New `retyc mcp manifest` command: prints the complete MCPB manifest.json (static metadata embedded via go:embed, version from ldflags with leading "v" stripped, tools from the live MCP registry) - Remove `retyc mcp tools` (redundant with `mcp manifest | jq .tools`) - Add title annotations to all 24 MCP tools and a missing readOnlyHint on dataroom_user_rm (Anthropic directory review requirements) - Tests: manifest required fields, exact tool count, annotation coverage
Older MCPB clients inject the literal ${user_config.token} when the optional
token field is left empty in the extension settings. New auth.EnvToken()
helper centralizes the check; used by GetValidToken, auth status, and
mustGetToken (also fixes token persistence being wrongly disabled in that case).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- scripts/build-mcpb.sh: stages binaries from goreleaser dist/ (via artifacts.json + jq), generates the manifest with the built binary, asserts manifest command paths exist in the stage, zips to dist/retyc-<version>.mcpb. Optional --expect-version guard. Requires jq + zip only — no Node.js. - goreleaser: build a macOS universal binary (MCPB platform selection is per-OS only, no architecture dimension) - Single fat bundle: darwin universal + linux amd64 + windows amd64, selected at install time via manifest platform_overrides
After goreleaser on v* tags: build the bundle with
--expect-version "${GITHUB_REF_NAME#v}" (fails the release if the manifest
version does not match the tag), validate with npx @anthropic-ai/mcpb,
upload to the GitHub release.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds first-class support for packaging and releasing a Claude Desktop “MCPB” extension bundle for retyc-cli, including manifest generation directly from the Go tool registry to prevent drift.
Changes:
- Add
retyc mcp manifest(base manifest embedded + runtime-injected version/tools) with tests enforcing tool annotations and tool-list consistency. - Add MCPB build tooling (
make mcpb,scripts/build-mcpb.sh) plus release CI steps to build/validate/upload the.mcpb. - Add/extend documentation and policies (MCPB docs, README privacy section, SECURITY policy), and harden env token handling for older MCPB placeholder injection.
Reviewed changes
Copilot reviewed 16 out of 17 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| SECURITY.md | Adds security policy + known MCP server mode limitations. |
| scripts/build-mcpb.sh | Builds dist/retyc-<version>.mcpb from goreleaser artifacts and validates staged commands. |
| README.md | Documents MCPB availability and adds a Privacy Policy section. |
| Makefile | Adds mcpb target (depends on goreleaser) and extends .PHONY. |
| internal/auth/oidc.go | Adds EnvToken() to treat unsubstituted MCPB placeholders as unset. |
| internal/auth/oidc_test.go | Adds unit test coverage for EnvToken(). |
| doc/mcpb.md | New MCPB install/build/release documentation and directory submission checklist. |
| cmd/mcpb_manifest_base.json | New embedded base manifest used by retyc mcp manifest. |
| cmd/mcp.go | Adds tool title annotations; replaces mcp tools with mcp manifest; adjusts instructions text. |
| cmd/mcp_manifest.go | Implements retyc mcp manifest (embed + inject version/tools). |
| cmd/mcp_manifest_test.go | Verifies manifest required fields, injected version/tools, and tool annotations. |
| cmd/common.go | Switches token persistence logic to use auth.EnvToken(). |
| cmd/auth.go | Uses auth.EnvToken() in auth status output logic. |
| CLAUDE.md | Updates repository structure docs to include MCPB-related files. |
| .goreleaser.yaml | Adds macOS universal binary output needed by MCPB packaging. |
| .github/workflows/release.yml | Builds, validates, and uploads MCPB bundle on tagged releases. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
HanXHX
added a commit
that referenced
this pull request
Jun 11, 2026
Copilot review on #45: the previous wording overclaimed ("no data is sent to third parties", "plaintext never leaves your machine") while SECURITY.md documents that decrypted metadata transits the MCP client and model context. Reworded README and manifest long_description around the actual design: the bundled binary runs the entire encryption layer locally, file contents never appear in tool responses, tool responses carry metadata only. Also clarify in doc/mcpb.md that the manifest uses a darwin default command with linux/win32 platform_overrides. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- doc/mcpb.md: bundle layout, manifest generation, build/CI process, Anthropic directory submission checklist - README.md: Privacy Policy section (directory submission requirement) + MCPB install pointer - CLAUDE.md: structure + MCPB section Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot review on #45: the previous wording overclaimed ("no data is sent to third parties", "plaintext never leaves your machine") while SECURITY.md documents that decrypted metadata transits the MCP client and model context. Reworded README and manifest long_description around the actual design: the bundled binary runs the entire encryption layer locally, file contents never appear in tool responses, tool responses carry metadata only. Also clarify in doc/mcpb.md that the manifest uses a darwin default command with linux/win32 platform_overrides. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
HanXHX
force-pushed
the
feature/package-mcp-bundle
branch
from
June 11, 2026 17:32
cbc0322 to
edaa2c8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.