Windows 11: Smart App Control blocks codebase-memory-mcp.exe (binary is not Authenticode-signed)

[dani9873]

Hi, and thanks for this project.

What happens
On Windows 11 with Smart App Control (SAC) enabled, codebase-memory-mcp.exe can no longer run. PowerShell reports (translated from Spanish): "An Application Control policy has blocked this file." The MCP server also fails to start from Claude Code (spawn error), so it never connects.

Environment

• Windows 11, Smart App Control: On (HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy → VerifiedAndReputablePolicyState = 1)
• Installed with install.ps1 from the README on 2026-10-16 (~08:18 UTC): version 0.12.0, build 770597e6f088…
• Location: %LOCALAPPDATA%\Programs\codebase-memory-mcp\
• Client: Claude Code (VS Code extension)

Timeline
install.ps1 ran --version on the downloaded binary successfully (it aborts otherwise), and the daemon then started 6 times with this build (daemon.start version=0.12.0 in cbm-daemon.log). The log was last written on 2026-10-17 at 08:37 local time (UTC-6). So SAC did not block it at first; the block appeared afterwards (possibly SAC leaving evaluation mode, or a reputation change).

What I tried

• Unblock-File on the .exe: no change.
• The README's Windows note ("SmartScreen may show a warning… click More info → Run anyway") does not apply. SAC shows no such option and has no per-app exception.

Why I think this happens
The releases are verified with SHA-256, cosign and SLSA provenance, which is great for integrity. But SAC requires an Authenticode signature (or good cloud reputation) and, as far as I can tell, the Windows binaries are unsigned. Other developer tools have run into the same wall with SAC.

Request

1. Would you consider Authenticode-signing the Windows release binaries (for example with a code-signing certificate, SignPath Foundation for open source, or Microsoft's Trusted Signing)?
2. Until then, could the README mention Smart App Control and a supported workaround (for example, running the Linux build under WSL)?

For now I am going to try WSL. Happy to test a signed build or provide more details.

Thanks!

[DeusData]

Thank you for the detailed timeline and for distinguishing Smart App Control from the SmartScreen warning. The report is clear enough for triage; there is no need to repeat the same diagnostics. Authenticode signing and a documented SAC-compatible installation path need a maintainer decision, so I cannot promise a signing rollout here. Please let us know how your WSL attempt goes, including the CBM version and whether the client connects successfully.