Skip to content

GuildControl MCP 2.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 12:50
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.2.0
4b4c893
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.2.0 is published from the protected v2.2.0 source tag at commit 4b4c893fbe3f490429118746694ce4507942bd31.

Release summary

GuildControl MCP 2.2.0 establishes the stable version line without a new runtime, command, or configuration break from 0.4.0.

The 2.x major records the earlier package and executable rename from guildcontrol to guildctl; the 2.1 and 2.2 minor milestones carry forward the compatible policy, documentation-search, thread-conversation, host-detection, and safe short-option additions released after that clean break.

This is a forward rebaseline that preserves the project's real compatibility history without inventing retroactive published artifacts.

Highlights

  • Keep the existing 0.4.0 policy documents and guildctl commands compatible
  • Publish npm, OCI, MCPB, and MCP Registry distributions under one stable 2.2.0 identity
  • Retain the reviewed-write, least-privilege, privacy, and evidence boundaries

Install

npx --yes guildctl@2.2.0 catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.2.0 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

  • npm: guildctl@2.2.0 with integrity sha512-d3DbgH4pTm0jLjH9Fc2jhEqXgpnKqSEvkln6/eZD3aaryZFkZmcpWrbaLiVOBN7m4dlc7PZhdL17ZnBletM3Fg==
  • OCI: ghcr.io/j-256/guildcontrol@sha256:cd59abec4efd288e4cb6e2bbd2c68bf87ebca2b12a9bfa122961bc9e7becd114
  • MCPB: guildcontrol-2.2.0.mcpb with digest sha256:86c4950160c69c3e622114003530f64b4fdddfc9ebe6ceb85e7f1063eac8d562
  • MCP Registry: app.lasers.guildcontrol/discord@2.2.0

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.2.0.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.2.0.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.2.0 --repo j-256/guildcontrol
gh release download v2.2.0 --repo j-256/guildcontrol
gh release verify-asset v2.2.0 guildctl-2.2.0.tgz --repo j-256/guildcontrol
gh release verify-asset v2.2.0 guildcontrol-2.2.0.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.2.0 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.2.0.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.2.0.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:cd59abec4efd288e4cb6e2bbd2c68bf87ebca2b12a9bfa122961bc9e7becd114 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Assets 9
Loading