AgentPack 1.4.0

Cross-agent package manager for MCP servers and plugins — Claude Code, Codex and OpenCode.

Download: AgentPack-1.4.0-win-x64.exe (Windows x64, portable, unsigned). Requires Node.js 22.17+ with npm on PATH; the app bundles Electron but launches MCP servers with the machine's Node.

Run AgentPack-1.4.0-win-x64.exe --demo for a sandboxed demo with three sample agent configs and a nested Next.js + Supabase project. Without --demo it reads and writes your real agent configuration.

What changed since 1.3.0

The catalogue goes from 13 capabilities to 30, and from 2 packs to 4.

The point is not the count. The detector recognised around forty signals but only five led anywhere — it would correctly identify Postgres, MongoDB, Redis, React Native or Netlify in a project and then recommend nothing for any of them. Most of this release closes that loop.

Six new MCP servers, each launched and made to answer tools/list before being listed: Memory (9 tools), Chrome DevTools (29), Git (28), SQL Database (2), MongoDB (20) and Firecrawl (27). The SQL Database entry speaks PostgreSQL, MySQL, MariaDB, SQLite and SQL Server, so one capability covers four detection signals.

Both database servers take their connection string from the environment rather than from the command line. A DSN carries a password, and command-line inputs are substituted into arguments and exported in shareable pack manifests by design — credentials are not. Verified: the connection string reaches the agent config, where the agent needs it, and appears nowhere in the install ledger.

Eleven new plugins, all from anthropics/claude-plugins-official: GitHub, Vercel, Netlify, Sentry, Linear, Notion, Expo, Prisma, Redis, Semgrep and Figma. AgentPack already registered that marketplace, so installing all eleven adds exactly one marketplace entry and no new trust surface. Plugin names are copied from that repository's manifest rather than inferred — two of them differ from the name shown in the UI.

Two new packs. Agent Craft (Superpowers, Karpathy Skills, Taste, Plannotator) needs no credentials at all, so it installs live in a demo with nothing configured. Data & Backend covers the database story.

The GitHub entry is now honest. The pinned @modelcontextprotocol/server-github is deprecated upstream, so the official GitHub plugin is offered alongside it, and the MCP's description says plainly that it is kept because it is the one of the two that works in OpenCode. Separately: the npm package published as github-mcp-server belongs to an unrelated author and is deliberately not used — it would have received the user's personal access token.

One interface fix. At the 900px minimum window width the header overflowed and pushed the window controls off the right edge, leaving no way to close a frameless window. The step indicator now collapses first, since the current step is already the page heading.

Verification for this build

Check	Result
TypeScript	clean
Focused regressions	24 / 24
Self-check suite	75 passed
Engine acceptance	14 / 14, configs restored byte-identically
Renderer UI (real preload + IPC)	8 / 8
Packaged portable launch	exit 0

Every new MCP was probed live; every new plugin was installed into a sandbox, its written plugin@marketplace id checked against the upstream manifest by hand, and then rolled back to byte-clean configs. Both new packs were installed and rolled back the same way.

Known limits

Unchanged. A green tool list proves the server starts and answers, not that a credential is valid — MongoDB and Firecrawl list their tools even with a fake key. Plugin status reads Configured, never Verified, because a plugin loads inside the agent where we cannot see it. Context figures are tool-schema estimates (characters divided by four), not billed tokens, and apply to an agent's next session. The artifact is unsigned. Full assessment: docs/READINESS.md.

Demo script: docs/DEMO.md.

SHA-256: D80632B3CB22AA614296BD025DEC3F07FE07854A78BE36116BC43CFD34B3EC26