v0.2.3

sbl-mcp 0.2.3

Release identity

• Private merge commit: 7baeb99e65c7f619ad13c4f734e6c7e224c4f455
• Private merge tree: b9d68f629ad9806eb1a5eedc177c319b66a0445d
• Reviewed public sbl-stack commit: a40784b7f788361a14c9bbe307b9c29a0ff5168c
• Reviewed public sbl-stack tree: 3230e0cf957004890ea51dba1c436bf150121266
• Public release target: SecondBrainLabs-SBL/sbl-stack at a40784b

Highlights

• Complete exact 30-tool sbl.so MCP catalog.
• Adds two tools over v0.2.2: sbl_list_linkedin_channels and sbl_bind_linkedin_channel.
• Canonical remote MCP endpoint: https://mcp.sbl.so/mcp.
• Canonical API-key page: https://app.secondbrainlabs.com/mcp-server.
• Current MCPB manifest and packaging, plus a byte-identical legacy .dxt
  filename for clients that still expect it.
• Exactly one reviewed sbl prompt with controlled launch, replay,
  credential-handling, and human-intervention safety guidance.
• The bundled public skill source is materialized only from the pinned public
  commit; ignored or untracked working-tree content cannot enter the archive.

Safety limits

• Executable orchestration is LinkedIn-only. WhatsApp and iMessage are deferred,
  and the workflow stops before writes for either channel.
• Each run is limited to one run-owned campaign in CREATED state, one explicitly
  chosen sender, and one approved recipient.
• Sender binding uses revision compare-and-set protection.
• Launch requires literal LAUNCH, followed by at most six read-only
  reconciliation checks over no more than two minutes.
• There is no automatic retry. A same-key replay requires unchanged state and a
  fresh literal REPLAY.
• Ending requires a separate literal END; ending cannot recall accepted or
  delivered messages.
• Human-intervention replies use durable sbl_reply_and_resolve, never a
  standalone-send fallback.
• The bearer key is secret. The non-secret idempotency key remains in protected
  state, and only its fingerprint is user-visible.

Install, upgrade, and revoke

• Install sbl-mcp-0.2.3.mcpb through Claude Desktop's extension install UI.
• Use sbl-mcp-0.2.3.dxt only for clients that require the legacy filename.
• To upgrade from v0.2.2, install the v0.2.3 asset and verify 30 tools plus the
  sole sbl prompt. Do not rename or reuse the old artifact.
• Create or revoke keys at https://app.secondbrainlabs.com/mcp-server.
• Enter keys only in sensitive client configuration; never paste them into chat
  or logs.
• Connect LinkedIn at
  https://app.secondbrainlabs.com/settings?tab=communication.
• Remote clients continue using https://mcp.sbl.so/mcp.

Artifacts

• sbl-mcp-0.2.3.mcpb
  • SHA-256: 01073bdaf2596efa1ca22e7b20aef176e641a3dbd8eea4dbb0913eba4dda514e
  • Size: 587392 bytes
• sbl-mcp-0.2.3.dxt
  • SHA-256: 01073bdaf2596efa1ca22e7b20aef176e641a3dbd8eea4dbb0913eba4dda514e
  • Size: 587392 bytes

The two files are byte-identical. Repeated clean builds from the exact private
merge and public source commits reproduced the same hash.

Validation summary

• Locked dependency installation, typecheck, stdio build, and HTTP build passed.
• Focused LinkedIn channel contract and P0-P5 aggregate contracts passed.
• P6 harness passed 19/19 tests.
• Full package contract passed 13/13 tests, including real prompts/list and
  prompts/get, exact 30-tool identity, public-source provenance, deterministic
  rebuilding, and MCPB/DXT byte equality.
• Exact-30 offline stdio smoke passed with the sole sbl prompt.
• Official MCPB manifest validation and bundle inspection passed.

Transparency

This release is unsigned; MCPB inspection reports that state. Verify either asset
using the SHA-256 above before installation. The hosted service is already live at
https://mcp.sbl.so/mcp with version 0.2.3 and 30 tools, so publishing these
local-client assets does not redeploy it.