Skip to content

GuildControl MCP 2.3.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 19:55
· 4 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.3.6
40a5396

GuildControl MCP 2.3.6 is published from the protected v2.3.6 source tag at commit 40a53963bc5e855ad9a9ecc4d3272e263cccf7d8.

Release summary

Refresh the source-backed Discord MCP Registry comparison. The field-wide lead claim is suspended until the newly registered comparable release receives a complete matrix and migration audit.

Highlights

  • Dated Registry coverage and external evidence links verified by the documentation gate

Install

npx --yes guildctl@2.3.6 catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.6 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

  • npm: guildctl@2.3.6 with integrity sha512-is6cEmMJzfvgR0ru8iqYPR4a7X1MSWPcMylGcZalDd7bBoHfY4CP9PXGLkuo4sz8uA1xLVjtM7olZc5J5E7U/w==
  • OCI: ghcr.io/j-256/guildcontrol@sha256:c6f415ab26e42d9a30ce49f35d56b1ea2b456fff9992a29a1a049eb9906ae8c7
  • MCPB: guildcontrol-2.3.6.mcpb with digest sha256:a538ebdaaa57b5f150a0d1e83054f68b777f4d4d7bcaeacd80fe7cb845ccb477
  • MCP Registry: app.lasers.guildcontrol/discord@2.3.6

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.6.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.6.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.6 --repo j-256/guildcontrol
gh release download v2.3.6 --repo j-256/guildcontrol
gh release verify-asset v2.3.6 guildctl-2.3.6.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.6 guildcontrol-2.3.6.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.6 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.6.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.6.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:c6f415ab26e42d9a30ce49f35d56b1ea2b456fff9992a29a1a049eb9906ae8c7 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Assets 9
Loading