Skip to content

GuildControl MCP 0.1.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Aug 20:33
Immutable release. Only release title and notes can be modified.
v0.1.2
6025749
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 0.1.2 is published from the protected v0.1.2 source tag at commit 6025749df8902315a5fc4c639c0c926263999ec8.

Install

npx --yes guildcontrol@0.1.2 catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:0.1.2 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

  • npm: guildcontrol@0.1.2 with integrity sha512-4hc3ScGFX8eBIm+/3isF+HpntJGRjPsm2D7g/Udlcri4LmIc152795H/dbhQ1Gi3570LjMFnANx/Zf1LYbsWFQ==
  • OCI: ghcr.io/j-256/guildcontrol@sha256:615f420546aa773130240f752bddbad929680afbb11e690cf17f8a440c80d416
  • MCPB: guildcontrol-0.1.2.mcpb with digest sha256:9e619fdd71ebe5a73f341f7234458bef0fb3a7f2a8b0c37ab017f81832ffe7ab
  • MCP Registry: io.github.j-256/guildcontrol@0.1.2

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildcontrol-0.1.2.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-0.1.2.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v0.1.2 --repo j-256/guildcontrol
gh release download v0.1.2 --repo j-256/guildcontrol
gh release verify-asset v0.1.2 guildcontrol-0.1.2.tgz --repo j-256/guildcontrol
gh release verify-asset v0.1.2 guildcontrol-0.1.2.mcpb --repo j-256/guildcontrol
gh release verify-asset v0.1.2 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildcontrol-0.1.2.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v0.1.2 --deny-self-hosted-runners
gh attestation verify guildcontrol-0.1.2.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v0.1.2 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:615f420546aa773130240f752bddbad929680afbb11e690cf17f8a440c80d416 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v0.1.2 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Assets 9
Loading