feat: rebuild mcpb packaging as a self-contained bundle, publish on release - #3099
Open
enesgules wants to merge 4 commits into
Open
feat: rebuild mcpb packaging as a self-contained bundle, publish on release#3099enesgules wants to merge 4 commits into
enesgules wants to merge 4 commits into
Conversation
…elease - Bundle the server with esbuild into a single self-contained file; the old pack relied on pnpm's symlinked node_modules, which never made it into the archive, so bundles since 2.0.2 were broken/stale - Ship package.json in the archive so the runtime version read resolves - Fix manifest: real tool names (resolve-library-id, query-docs), current version, and user_config so Desktop users can enter CONTEXT7_API_KEY - Build, smoke-test, and upload context7.mcpb to the GitHub release on every @upstash/context7-mcp publish; registry publish then attaches it to server.json with its sha256 - Stop tracking the built .mcpb binary Claude-Session: https://claude.ai/code/session_013RG7wpXqUKZYsRzv7zyv6L
Without a default, hosts leave the literal ${user_config.api_key}
placeholder in CONTEXT7_API_KEY when the user provides no key
(mcpb replaceVariables only substitutes known variables), and the
server would send that garbage value as its API key. An empty-string
default resolves to an empty env var, which the server treats as
no key.
Claude-Session: https://claude.ai/code/session_013RG7wpXqUKZYsRzv7zyv6L
The MCP Registry validates mcpb URLs against the pattern /owner/repo/releases/download/tag/filename where the tag cannot contain '/'. Changesets tags (@upstash/context7-mcp@x.y.z) do, and Go's url.Parse decodes %2F back to '/', so encoding cannot help. The bundle now ships on a dedicated mcpb-vX.Y.Z release. Claude-Session: https://claude.ai/code/session_013RG7wpXqUKZYsRzv7zyv6L
Registry versions are immutable; a manual re-run for an already published version should not retry three times and fail red. Claude-Session: https://claude.ai/code/session_013RG7wpXqUKZYsRzv7zyv6L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #3097.
Problem
The
context7.mcpbbundle has been broken since 2.0.2:pnpm install --prodproducing a bundleablenode_modules, but pnpm uses symlinks, so no dependencies ever made it into the archive — the packed server could not start.Resolve Context7 Library IDinstead ofresolve-library-id) and no way for users to configure an API key.Changes
esbuildbundles the server into oneindex.mjs(960 KB packed, 3 runtime files) — nonode_modules, no.mcpbignore, no install/reinstall dance.package.jsonships in the archive root so the runtimeSERVER_VERSIONread resolves.user_config.api_key(sensitive, optional) wired toCONTEXT7_API_KEY.publish-mcpbjob builds the bundle, smoke-tests the packed artifact (extract + MCPinitializeover stdio), and uploads it to the GitHub release whenever@upstash/context7-mcpis published. The registry publish job now waits for it and attaches the mcpb package toserver.jsonwith its download URL + sha256 (skips with a warning if the asset is missing, e.g. manual dispatch for an old version)..mcpbbinary;*.mcpbis gitignored.Testing
mcpb validatepasses; packed bundle extracted outside the repo answersinitializeandtools/listwith both tools over stdio.https://claude.ai/code/session_013RG7wpXqUKZYsRzv7zyv6L