borgmcp 5.5.0

Package

• npm: borgmcp@5.5.0
• Integrity: sha512-HwvYZ6WDPZWgK4Gk17itN3ILpVCuTBvdXhfYSxuSWVjqNLU7oTK+GKXmqTJCDkhDqE/xHmpj9ODX0ulHkus8EQ==
• Published with npm Trusted Publishing.

Source

• Tag: v5.5.0
• Commit: a207be435505ed848144abc7e393ff6b8bdc5085

News and fixes

borgmcp 5.5.0

• Adds borg representative, a client-side interface for a standard MCP host to relay a human's requests to one existing Coordinator (the agent responsible for coordinating the work) and read its replies. borg representative prepare prepares and binds the connection without launching a coding agent; borg representative status inspects it; borg representative mcp serves the connection over stdio.
• Exposes exactly four MCP tools: borg_representative-status, borg_representative-send, borg_representative-read and borg_representative-ack. Sends go only to the bound Coordinator. This narrow interface is enforced by the client, not a new server authorization boundary. Relay messages identify themselves as automated; user-authorized and model-advice are unverified assertions, not proof of human authorization.
• Enforces exclusive host-process ownership on the first send, read or acknowledgement. Other processes receive an ownership refusal; status remains read-only. A dead owner or expired lease permits takeover, and a process that loses ownership must restart. Private lease storage rejects unsafe paths and permissions; a private lease directory that is not 0700 is refused with manual recovery steps.
• Delivery remains explicit: there is no background wake or push into the host. Reads consume everything they fetch, and an acknowledgement is a receipt, not a delivery checkpoint. The host must persist read results, map request IDs to conversations, route replies by in_reply_to, and hold unmatched replies for the human. A local lease cannot cancel an in-flight request and is not distributed fencing; retry an ambiguous send with its original request_id.
• Fixes a credential-store lock turnover race: concurrent clients retry acquisition when the lock changes during inspection, while data-file identity changes still fail closed.