v1.0.1

• VS Code Marketplace extension — "Rhizome MCP" (publisher odrin) bundles a platform-specific binary and registers the MCP server automatically via mcpServerDefinitionProviders; no separate install or .vscode/mcp.json editing needed. Covers darwin-x64/arm64, linux-x64/arm64, alpine-x64/arm64, and win32-x64/arm64. Published automatically from tagged releases, with a pre-release channel for beta tags.
• npm distribution (npx rhizome-mcp) — a dependency-free Node launcher package plus six per-platform binary packages (@rhizome-mcp/<platform>), so any MCP client can run the server via npx with no Go toolchain or manual binary install.
• Official MCP Registry listing — io.github.Odrin/rhizome-mcp is published to registry.modelcontextprotocol.io and kept current automatically on every tagged release.

Full Changelog: v1.0.0...v1.0.1

v1.0.1-beta.5

docs(security): document OVSX_PAT ownership and rotation

Mirrors the existing VSCE_PAT entry, now that the odrin Open VSX
namespace and OVSX_PAT secret exist (ISSUE-97).

ISSUE-97

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v1.0.1-beta.4

fix(release): grant publish-vscode-extension write access to attach a…

v1.0.1-beta.3

feat(release): publish VS Code extension VSIXes from release.yml

Adds a publish-vscode-extension job: fetches the tagged release's own
archives (not the ephemeral build-release-assets artifacts, so a
workflow_dispatch re-publish works long after the original run's 1-day
artifact retention expires), packages all 8 platform VSIXes via the
existing package-platforms.mjs version policy, publishes them with
vsce --skip-duplicate for idempotent re-runs, and attaches the VSIXes
plus checksums to the GitHub release. Isolated with
continue-on-error: true, same as publish-npm/publish-mcp-registry.

Adds a workflow_dispatch fallback (tag input) scoped to just this job;
build-release-assets (and everything that transitively needs it) is
gated to the release event only, so a manual dispatch never re-runs
the binary build/upload path.

ISSUE-78

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v1.0.1-beta.2

fix(npm): publish with a single dist-tag, no follow-up dist-tag add

npm's OIDC Trusted Publishing only authenticates the `npm publish`
command itself — it does not extend to other authenticated registry
writes run afterward in the same job. Confirmed against a real CI
failure: `npm publish --provenance --tag beta` succeeded via OIDC, the
follow-up `npm dist-tag add ... latest` immediately failed with a 401.

Folds the "should this land on latest" decision into the one publish
call instead: beta versions publish straight to `--tag latest` until a
real stable version has ever shipped for that package, then switch to
`--tag beta` only, matching the prior policy's intent without a second
authenticated call.

Verified via `npm publish --dry-run` against the real registry,
including against the live partially-published 1.0.1-beta.1 state left
by the failed run (darwin-x64 correctly skipped via the idempotency
check; the remaining packages publish with the new single-tag logic).

ISSUE-88

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v1.0.1-beta.1

feat(npm): publish npm packages from tagged releases

Adds a publish-npm job to release.yml (needs: build-release-assets,
continue-on-error: true, isolated from upload-release-assets so a
publish failure never breaks the binary release) that extracts the 6
release archives into raw binaries and hands off to a new dedicated
script, packages/npm/scripts/publish.mjs.

The script stages each binary into its platform package, stamps all 7
package.json versions from the tag (npm accepts prerelease suffixes
directly, so version == tag verbatim, no remapping needed) including
the main package's optionalDependencies pins on the 6 platform
packages, publishes platform packages before the main package with
`npm publish --provenance` (OIDC trusted publishing, no stored token),
and skips any package/version already on the registry for idempotent
re-runs.

Dist-tag policy: stable tags publish to `latest`; beta tags publish to
`beta` and, while no real stable version has ever shipped for a
package, also move `latest` to track the newest beta (otherwise `npx
rhizome-mcp` would stay pointed at the non-functional 0.0.1 bootstrap
placeholder indefinitely, since this project is pre-1.0). Documented
in packages/npm/README.md alongside the script's full CLI contract.

Verified end-to-end via `npm publish --dry-run` and read-only `npm
view` calls against the real, live registry (all 7 packages currently
at 0.0.1/latest, no stable version) - confirmed correct staging,
version/optionalDependencies stamping, publish ordering, the
idempotency skip against a genuinely-published version, and the
latest-follows-beta dist-tag decision. Never ran a real npm publish.

ISSUE-88

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v1.0.0

rhizome-mcp is a local-first MCP server for task tracking and coordination of autonomous AI coding agents: one static Go binary, one SQLite database per project, no accounts, no Docker, no network dependency. This is the first stable release — the MCP tool contract, the domain model, and the logical interchange format are now covered by semantic versioning.

Highlights

Coordination built for how agents actually fail. Issues are claimed atomically with renewable leases; in_progress is derived from an active lease, never stored, so a crashed or vanished agent can't lock an issue forever. At most one active attempt per issue is guaranteed at the database level. Checkpoints, supersedable decision records, and an append-only event history let a fresh session resume from the last known-good state.

A 31-tool MCP surface with token budgets as part of the contract. Compact list projections (a 100-issue page stays under 64 KB, enforced by an integration test), graph nodes that exclude free-text bodies at the SQL layer, snippet-only search (SQLite FTS5), delta sync via event IDs, and a bounded single-call work-context package. Optimistic versioning, replay-safe idempotency keys, and 19 stable machine-readable error codes throughout.

Planning, dependencies, and review. Epics, labels, cycle-checked blocks relations, claimable entry-point highlighting, and atomic batch planning (up to 50 issues, 100 relations, 20 decisions in one transaction). Review requests pin an exact issue version and event position — stale targets are superseded automatically.

One-command client setup. rhizome-mcp connect <target> generates and applies the MCP registration for claude, codex, vscode, or generic json — idempotent, with --print for a dry run.

Human observability without a server. rhizome-mcp board shows status counts, active leases with expiry, blockers, and the open review queue — as a terminal table, JSON, or a fully self-contained HTML snapshot (--output board.html) including the planning graph. Plus issue list, search, graph --format mermaid, doctor, and WAL-safe backup.

Portability. Pure-Go SQLite (modernc.org/sqlite, CGO-free), stdio as the primary transport, opt-in loopback-only HTTP with strict Host/Origin validation, and a versioned JSON interchange format for moving projects between installations.

Install

curl -fsSL https://raw.githubusercontent.com/Odrin/rhizome-mcp/main/scripts/install.sh | sh

irm https://raw.githubusercontent.com/Odrin/rhizome-mcp/main/scripts/install.ps1 | iex

The installers detect OS/architecture, verify the SHA-256 checksum, and install to ~/.local/bin by default. Manual downloads: pick the matching asset below (rhizome-mcp_<version>_<os>_<arch>.tar.gz, .zip on Windows) and verify it against the adjacent .sha256 file.

Then, inside your repository:

rhizome-mcp init
rhizome-mcp connect claude   # or: codex | vscode | json

Supported platforms: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64.

By-design constraints

Local single-developer tool: no web UI, no authentication, no multi-user permissions, no permanent agent identities, single-writer SQLite (not for multi-node deployment). Deferred features are documented in docs/06-deferred-and-open.md.

Documentation

• README — overview and quick start
• MCP tool catalog — the full 31-tool contract
• Specification index — nine modular spec documents
• CHANGELOG

Full Changelog: v1.0.0-beta.2...v1.0.0

v1.0.0-beta.2

Full Changelog: v1.0.0-beta.1...v1.0.0-beta.2

v1.0.0-beta.1

Full Changelog: https://github.com/Odrin/rhizome-mcp/commits/v1.0.0-beta.1