Security fix: the long-lived org:agent token no longer enters the agent chat.
The dashboard at /dashboard/integrations/mm-mcp now generates a single-use INSTALL CODE (mmi_…, 10-minute TTL). The mm-mcp binary exchanges it locally via TLS for the actual token, then writes the MCP client configs — UTF-8 without BOM, Microsoft Store (MSIX) path on Windows, atomic temp-file+rename with 0600 permissions on Unix.
New: `mm-mcp setup`
```
mm-mcp setup --code mmi_… --api-url https://.t.mothershipmethod.cloud
```
Detects every installed MCP client (Claude Desktop, Claude Code, Cursor), writes the config from a durable per-user path, validates the token via /v1/auth/me. No PowerShell BOM trap, no MSIX virtualized-path miss, no token in argv/chat.
Install
The dashboard renders the per-OS install command directly — usually one line in your terminal. If you prefer manual install:
| OS / arch | Asset |
|---|---|
| macOS Apple Silicon | mm-mcp-darwin-arm64 |
| macOS Intel | mm-mcp-darwin-amd64 |
| Linux x86_64 | mm-mcp-linux-amd64 |
| Linux arm64 | mm-mcp-linux-arm64 |
| Windows x86_64 | mm-mcp-windows-amd64.exe |
SHA256SUMS attached. Verify with `sha256sum -c SHA256SUMS`.
Upgrading
If you already had a previous mm-mcp installed via a 30-day token: it still works. To migrate, generate a new install code from the dashboard and re-run `mm-mcp setup` — the binary will overwrite the relevant config entries in place, preserving any other MCP servers you have configured.
Built from
`mothership-method@42ff7d6` — design review GO, code review GO (0 P0/P1, 3 P2 + 4 P3 remediated), remediation review GO.