nightly

This is not a release. It is the head of main, rebuilt on every push,
and it is replaced without warning. For something that stays put, use the
latest release.

Built from 47f93bd62bcc398f54737f1fd59485c59db20295.

Downloads

• tf2ap.exe for Windows
• tf2ap-linux-amd64 for Linux

Since v1.18.3

• fix(bridge): wait for the client to stop before a test's TempDir goes
• fix(installer): say to retry later when a download site fails
• fix(bridge): refuse a seed whose community missions are not installed
• fix(plugin): name the mission once SigMod's vote guard is over
• fix(launcher): refuse a Linux start with no steamclient.so link
• chore(deploy): pin floating image tags
• chore(deps): tf2-mvm-bots-go v0.18.8
• chore(deps): tf2-mvm-bots-go v0.18.7
• fix(plugin): stop the minus button paying the bundle ledger again
• test(docker): refuse an image that drops the plugin's gamedata
• docs(readme): keep the README to downloads and install links

v1.18.3

Changes

Added

• !ap loadout equips weapons you don't own. Pick a slot, then any weapon
  your class can hold in it. The list puts the weapons with the most
  Archipelago buffs first and shows how many each one has. Stock weapons are
  not listed, since you already have them: Reset at the end of the list puts
  your own weapon back. The choice lasts until you leave the server. It
  applies at once in the spawn room or between waves, otherwise at your next
  resupply. Slots the run has not unlocked stay locked. Upgrades you buy for
  the chosen weapon stay on it, the same as for a weapon from your backpack. We
  tested the weapon swaps and the upgrades on a server with a scripted player,
  but no real player has opened the menu yet.
• Nuke, next to Repair in Settings. It deletes the game server, SteamCMD
  and the downloads, and the next start installs them again from nothing, 14 GB
  included. Repair keeps the game files; Nuke does not. The run and its checks,
  your settings, the player file and your community content folder stay. It
  asks before it does anything.

Fixed

• Servers work on the TF2 update of 16 October 2026. Windows SigMod
  servers no longer refuse to start or crash on every community mission, and
  the defender bots read item and attribute data correctly again on Windows
  and Linux.
• Windows SigMod servers play every community mission to the end. The
  test servers now clear all 532 waves of the SigMod community missions.
• Spy stabs alert nearby robots on Linux SigMod servers.
• The Your Eternal Reward unnerf works again on Linux. The last TF2 update
  had broken it.
• More SigMod mods work on Windows servers: 254 of the 309 mods now load
  in full.
• Caliginous Caper wave 666 no longer ends when the 64 Spies die. Valve
  lists the tanks that wait for the Spies ahead of them, and the game ends the
  wave on the tick the last Spy dies, before the tanks, the crit robots and the
  Uber Medics that follow. The repaired file now lists each group after the
  ones it waits for. The server writes it again at start.
• Weapon buffs no longer pile up on Windows servers. Each time the game
  rebuilt your buffs, the reserve ammo and the health you were holding went up
  by the buff again, and switching weapons rebuilds them twice. A +25% reserve
  ammo buff read 511, 797, 1243 and kept going, and a max health buff added its
  amount to your health every time. The buffs themselves were right. The plugin
  now puts back the ammo and health a rebuild raised. It does not top up your
  ammo or health when you first earn a buff; the next resupply does that. The
  Linux server we measured did not do this. We ran ten rebuilds in a row on a
  Windows and a Linux server with scripted defender bots, but no real player
  has checked it yet.
• Windows servers run on the 2026-10-14 TF2 update. The update moved the
  game code SigMod patches, and a SigMod built for the old game refuses to
  load on the new one. The Windows launcher now installs a SigMod built for TF2
  11117211. Missions that need SigMod load again.
• Windows SigMod servers no longer crash when bots use items or when a
  mission is cleared. A bot using an item (a canteen, say) could crash the
  server, and so could clearing a mission with a thousand robots or more. Both
  came from game functions the Windows SigMod had not found. We played the
  missions on a Windows server with scripted defender bots; all but one mission
  played through, and that one still stops at its first wave.
• More SigMod mods work on a Windows server. Weapon effects, death yells
  and entity limits did nothing there, because the Windows SigMod had not found
  the game functions they hook. They now run. We played the missions on a
  Windows server with scripted defender bots: five of eight groups played
  through. Three missions still lose waves (Dismal Devilry, Dust to Dust and
  Trespasser Remaster) and are being looked at.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(ci): hand the release and the nightly the extensions they now need by @m-this in #221
• chore(release): 1.18.3 by @m-this in #222

Full Changelog: v1.18.2...v1.18.3

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.18.1

Changes

Fixed

• Servers work again on the 2026-10-05 TF2 update. The update changed how
  the game finds an item attribute by its name, and three things broke:

  • On Windows, TF2Attributes did not find that function and refused to load.
    The Archipelago plugin and the defender bots need it, so the server started
    with neither.
  • On both platforms, TF Econ Data read part of the item list 36 bytes off,
    which gave the bots wrong cosmetic slots and unusual effects. This release
    patches it until TF Econ Data ships its own fix.
  • SigMod crashed the server the first time somebody drew a weapon, on both
    platforms. Its list of custom attributes named one attribute twice, and the
    game now refuses that. SigMod linux-20261006 and 20261006 drop the
    duplicate, and the Windows build has the addresses for the new TF2 build.

  We played SigMod missions with defender bots on the new TF2 build. The team
  won all 12 waves on Windows and 11 of 12 on Linux. The other Linux wave
  stalls the same way it did before the update. The bots bought their upgrades
  on both platforms.

• Bot Surge adds its extra support robots on Windows. The plugin never
  found a function that this part of Bot Surge needs on Windows, so it did
  nothing there.

• Bot Surge no longer crashes the server on Brain Taker's last wave. Some
  community missions leave a pickup behind for every robot that dies, and it
  stays until somebody on RED walks over it. At Bot Surge's spawn rate those
  pickups filled the server's entity limit within about ten minutes and the
  server crashed. Bot Surge now slows down to the mission's own pace when the
  server gets close to the limit, and speeds back up once there is room again.

• A room going down no longer wipes the run. When an archipelago.gg room
  closes, its port can be handed to a different multiworld. The bridge
  reconnected to that one, took it for a new run and started your progress over,
  even though that room then refused to let it in. The bridge now only switches
  runs once a room has accepted your slot. And if you go back to a room you
  played here before, its run comes back as you left it instead of starting
  empty.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(plugin): pause Bot Surge before the map runs out of edicts by @m-this in #190
• fix(bridge): bind the seed once the room accepts the slot by @m-this in #191
• fix(bots): gamedata for TF2 11087207 by @m-this in #194

Full Changelog: v1.18.0...v1.18.1

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.18.0

Changes

Fixed

• The bots can buy upgrades again, and an existing server gets SourceMod's
  fix for the upgrade station crash. The 2026-10-02 TF2 update changed how
  the game stores the messages the upgrade station sends, and the SourceMod we
  shipped read them the old way. A player opening the station crashed the
  server, and the game refused every upgrade a bot asked for. SourceMod
  1.12.0-git7255 reads the new layout, and the launcher and the Docker image
  now upgrade a server that already has an older SourceMod at its next start.
  Your own edits to SourceMod's configs are kept. We measured the bots: 35 of
  35 purchases refused before, 44 bought after, and a player confirmed the
  station no longer crashes their server.
• The debug bundle stops pointing at the wrong thing when SigMod cannot find
  the game. When SigMod was made for the TF2 build your server reports and
  still finds none of the game's addresses, the game files are usually half
  updated, and summary.txt now says so and tells you to press Repair, which
  checks every game file on the next start. It used to tell you to compare two
  version numbers that already matched. And when every bot purchase is refused
  on a SourceMod that already has the fix, it no longer blames SourceMod.

Changed

• The debug bundle names the TF2 build the server is running. It listed
  every version the launcher installs and not the one they are all built
  against, which is the version that matters most on the evening TF2 updates.
• The debug bundle says when two of those versions cannot work together.
  Above the logs it now names, in plain words, a SigMod built for a different
  TF2 build, a SourceMod too old for the upgrade station on this one, and a run
  where the game refused every upgrade the bots tried to buy. It compares what
  the file already said; it still does not claim to have found your bug.
• The debug bundle stops sending you after a crash dump that does not
  exist. When SigMod catches the fault and closes the server itself, Windows
  writes no dump, and the summary now says so and points at the two stacks
  SigMod printed into the log instead. When a dump should exist it names the
  folders it looked in.
• The debug bundle lists what it could not collect. Two bundles from the
  same evening held different files and there was no way to tell a missing file
  from a file that never existed. collected.txt in the zip now says which it
  was, and why.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• feat(ci): alert on a new TF2 build before players do by @m-this in #181
• fix(versions): pin the defender mod's compiler once, and record the TF2 build by @m-this in #182
• fix(deploy): pin SourceMod 1.12.0-git7255 by @m-this in #183
• feat(debugbundle): record the TF2 build and cross-check the pins against it by @m-this in #184
• chore(deps): tf2-mvm-bots-go v0.18.4, and drop SM_Stock_OfficerSpy from the build by @m-this in #185
• fix(install): bring an installed SourceMod and Metamod to the pins by @m-this in #186
• fix(debugbundle): point at the game files when SigMod fails on its own build by @m-this in #187

Full Changelog: v1.17.9...v1.18.0

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.9

Changes

Fixed

• A Windows server with SigMod runs again after the second 2026-10-02 TF2
  update. Valve shipped another update the same evening. SigMod for Windows
  only knows the TF2 build it was made for, so on the new one the server
  crashed at start, when anybody bought an upgrade (bots included), or when a
  player inspected a weapon. The launcher now installs a SigMod build made for
  the new TF2.
• The debug bundle no longer carries your RCON password. It promised it
  did not, but the server's crash log repeats its command line, password
  included, and server.cfg sets it. Every text file in the bundle now has the
  passwords taken out. If you posted a bundle before, change your RCON password
  in the launcher.
• The first server start after updating the launcher uses the new
  launcher. A launcher from before the update, still running in the
  background, kept its connection to the room, and the server spent that start
  unable to read what the room had unlocked. The new launcher now closes the
  old one's connection before the server starts.
• A bot's upgrade the game refused is no longer announced as bought. The
  chat and the log said a bot bought an upgrade even when the game turned the
  purchase down. They now only report the purchases that happened, and the log
  names the ones the game refused.
• Defender bots no longer take down a busy server in four ways we caught in
  testing. A bot leaving in the middle of shopping, a bot asked what it sees
  before it had finished spawning, a check that treated any bot-controlled
  player as a robot, and a few route searches with no limit could each crash
  or freeze the server, most often on missions with many robots.

Changed

• After a TF2 update, SigMod for Windows switches itself off instead of
  crashing the server. Until a launcher release brings a SigMod build for the
  new TF2, the server runs without it: missions that need SigMod are refused
  and the run moves on, and the debug bundle says why.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(sigmod): Windows build 20261005 for TF2 build 11076587 by @m-this in #180

Full Changelog: v1.17.8...v1.17.9

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.8

Changes

Fixed

• Caliginous Caper plays on a server started from the Windows or Linux
  launcher. The server now makes the mission's file from the game's own files
  when it starts.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(launcher): make Caliginous Caper's mission on every launcher start by @m-this in #178

Full Changelog: v1.17.7...v1.17.8

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.7

Changes

Fixed

• SigMod missions run again on a Windows server after the 2026-10-02 TF2
  update. The Windows build of SigMod crashed the server at every start on
  the new game. The launcher now installs a build made for it. One mission,
  Trespasser Remaster, still loses its first wave in our tests.
• Buying an upgrade with SigMod on a Windows server no longer stops it. The
  Windows build asked the game for an upgrade's name through a function it had
  never found, and every purchase crashed the server. It now reads the name
  itself.

Changed

• Windows labels SigMod as unstable instead of beta. The Windows build of
  SigMod is this project's own port, and it has crashed servers. The word says
  that plainly.

Added

• Update TF2 from the Game server settings page. The page shows the TF2
  build the server has, and says when Steam has a newer one. Update TF2 stops
  the server if it is running, updates TF2, and starts the server again, so you
  no longer have to press Stop and Start to get the new build.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(sigmod): Windows build 20261004 for TF2 build 11068238 by @m-this in #177

Full Changelog: v1.17.6...v1.17.7

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.6

Changes

Fixed

• A TF2 update no longer keeps players out of a launcher server. The
  launcher installed the TF2 server once and never updated it, so after a TF2
  update the server refused every player on the new game. It now updates the
  server each time you press Start, and gets past an update SteamCMD left
  stuck.
• A Docker server whose TF2 update got stuck starts again by itself. After
  a failed update, SteamCMD refused every later one, and the server restarted
  in a loop. It now sets the stuck update aside, keeps a copy of it, and
  updates again once. If that fails too, the log says which file to look at.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(launcher): update the TF2 server on every Start by @m-this in #176

Full Changelog: v1.17.5...v1.17.6

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.5

Changes

Fixed

• SigMod missions run again on a Linux or Docker server after the
  2026-10-02 TF2 update. The update changed how the game stores its key and
  value data, and the SigMod build the server used crashed it on every start.
  The server now installs a SigMod rebuilt for the new game. SigMod on a Windows
  server still crashes on this TF2 update: leave SigMod missions out of the run
  there until a Windows build follows.
• A run generated with v1.11 to v1.13 keeps going on this release. The
  server refused it at connect, so updating meant losing the run. It now plays
  it with the options it was generated with, and every check counts.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• fix(sigmod): a Linux build for the 2026-10-02 TF2 update by @m-this in #175

Full Changelog: v1.17.4...v1.17.5

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64

v1.17.4

Changes

Added

• Bot cards: named defender bots you unlock during the run. Turn on
  Unlockable Bot Cards and the item pool holds cards for 15 bots. Each bot
  has a class, a loadout and a buff of its own. A card rolls a rarity, which
  sets its health and buff stacks, and a form: human, robot or Giant robot.
  Starting Bot Cards gives some at the start, or one stock card per class.
  Cards are useful items and never lock a mission. Off by default. By kelly-cs.
• The Bots page shows your cards as a deck. Recruit cards into your six
  seats, drag them to set who stays when a player joins, and choose the form.
  Apply swaps the bots on the running server, with no restart. The tracker
  shows the cards the run has found. In test mode every card is there.
• Shop where they stand, a Bots page option. Every bot buys its upgrades
  where it is instead of walking back to the station. A bot that shops during a
  wave stays in the fight. Off by default. A Giant card always shops where it
  stands, because it no longer fits through the spawn door.

Fixed

• A tank SigMod keeps off the network no longer breaks Mental. On some
  community missions Mental threw an error for such a tank every tick, tens of
  thousands a run.
• Make it Count works on a Windows server. It switched itself off there,
  because the plugin could not find the dispenser's ammo function on Windows.
• A server whose bridge stops answering no longer runs out of memory. The
  plugin sent every check it was still holding again every five seconds, so
  each giant and tank killed while the bridge was down made the traffic grow,
  until the server stopped with "Out of memory" a few missions later. It now
  retries the oldest check alone until the bridge answers, then sends the rest.
• Bots are no longer put back on the hatch over and over. The rescue for a
  bot that is slow to leave spawn puts it on the hatch. On most maps the hatch
  sits next to RED's spawn, so a few seconds later the rescue moved it again.
  An engineer that built near the hatch lost its nest before it finished.
• Weapon buffs no longer climb on their own. The server counted the same
  grants again each time it asked the bridge. A buff you had twice then showed
  as x44 in the weapon buffs menu until the next mission. By kelly-cs.
• Repair fixes a community pack that fails its hash check. Repair left the
  old download in place, so the next install stopped on the same "SHA-256
  mismatch". It now downloads the pack again and keeps the old file until the
  new one checks out. A mismatch you chose to ignore is left alone. By kelly-cs.
• Repair on Windows also throws away the downloaded SigMod package. It
  only ever looked for the Linux file, so a broken download stayed in place.
• Every SigMod mission plays to the end on a Windows server. The Windows
  build of SigMod is updated, and all 95 community missions that need it now
  play every wave, where about ten used to stop the server mid-mission. Robots
  that change attributes, map-scripted events, bosses with several phases, bots'
  dropped items and swords all behave as they do on a Linux server. A squad
  with a gray robot in it no longer stalls its wave (Dust to Dust, wave 5).
  Linux and Docker servers keep the regular SigMod release.

Windows

Download tf2ap.exe above. Run it. It installs everything else.

Windows will warn you, and it is a false positive. The exe unpacks archives and
starts a game server without a code signature, which looks like a virus to a
scanner. Click More info, then Run anyway, or check it below first.

Full guide

Linux

Download tf2ap-linux-amd64. Run it. It installs everything else.

chmod +x tf2ap-linux-amd64
./tf2ap-linux-amd64

Full guide

Docker

Download compose.yaml and env.example:

mkdir mann-vs-archipelago && cd mann-vs-archipelago
base=https://github.com/m-this/tf2-archipelago/releases/latest/download
curl -fsSLO "$base/compose.yaml"
curl -fsSL -o .env "$base/env.example"

Set SRCDS_RCONPW in .env, then:

docker compose --profile seed run --rm seed   # writes ./seed
docker compose up -d

Upload the file from seed/ at
archipelago.gg/uploads and put the room's
port into AP_PORT.

Full guide

Other assets

File	For
tf2_mvm.apworld	The official Archipelago app.
tf2_archipelago.smx	A SourceMod server the launcher and compose file don't manage.
tf2-defender-bots.zip	The bots for that same server. Unzip into tf/.
meta.json, items.json, missions.json	The item and check tables, for reference.

Checking what you downloaded

SHA256SUMS is attached to this release. It holds the hash of every file
here, computed by the workflow that built them.

Get-FileHash tf2ap.exe -Algorithm SHA256    # Windows

sha256sum -c SHA256SUMS --ignore-missing    # Linux

Each binary carries a signed record of the commit and the workflow that built
it:

gh attestation verify tf2ap.exe --repo m-this/tf2-archipelago

The binaries are scanned on VirusTotal, and the reports are linked at the end of
these notes. Expect a few heuristic detections and no named malware family. The
source is all in the repository, and make launcher rebuilds the exe on your
own machine.

Code signing policy

Free code signing for open source projects, provided by
SignPath.org, with a certificate from the
SignPath Foundation.

Warning

The application is open, not granted. Nothing is signed yet: tf2ap.exe ships
unsigned, and Windows warns about it until that changes.

What's Changed

• Honor the selected wave when playing or replaying a mission by @kelly-cs in #141
• Label Villa missions as Medic only by @kelly-cs in #144
• Prevent Cow Mangler bonus shots colliding with shooter by @kelly-cs in #145
• Link admin tracker and clarify per-class loadout order by @kelly-cs in #148
• Handle Villa defender orders and final boss transfer by @kelly-cs in #142
• Preserve explosive-jump force with no-self-blast buff by @kelly-cs in #146
• feat(waveprobe): a Windows bed for the SigMod missions by @m-this in #166
• chore(deps): tf2-mvm-bots-go v0.18.1 by @m-this in #169
• feat(waveprobe): measure how the defender bots move by @m-this in #149
• Prevent replayed weapon buffs from increasing levels by @kelly-cs in #168
• Repair redownloads community packs after a hash mismatch by @kelly-cs in #151
• chore(deps): tf2-mvm-bots-go v0.18.2 by @m-this in #170
• docs(changelog): bot cards, shop where they stand, and Kelly's two fixes by @m-this in #171
• SigMod for Windows 20260930, and the wave probe plays every SigMod mission to the end by @m-this in #172

Full Changelog: v1.17.3...v1.17.4

VirusTotal

• tf2ap.exe
• tf2ap-linux-amd64