FirstCall v0.4.0

Downloads for macOS (Apple Silicon and Intel), Windows and Linux.

FirstCall v0.3.1 — Verified native MCP tools

FirstCall turns a verified API request into a local MCP tool that runs from the included native executable.

This release completes the native handoff: verify a request, export its tool package, connect it to an MCP client, and call the API again without generating code or installing npm dependencies. Optional query and header values can be omitted during verification and later tool calls. Required values and unknown placeholders still fail before HTTP.

The companion CLI now includes package-native and connect. connect --package /path/to/tool validates a relocated package and prints current connection paths without sending a request or changing its files. Authentication values stay out of exported packages; responses retain the runtime's redaction and bounded request policy.

Download either archive below for Apple Silicon macOS. It contains FirstCall.app, its companion CLI, and installation instructions. Move the application to its intended location before exporting tools. The bundle is ad-hoc signed for integrity and is not Apple notarized.

The archives were built and smoke-tested by the final main CI. release-manifest.json identifies the source commit and file hashes; SHA256SUMS.txt lets you check the download. The source CI runs Linux CLI and macOS desktop tests, real loopback API verification, actual MCP calls, relocation, redaction, and error-path checks. Both the debug executable and the executable inside the packaged app are exercised.

Get started · CLI workflow · Reproducible FastMCP comparison

FirstCall v0.3.0 — API to MCP

FirstCall now completes the API-to-MCP workflow inside the desktop app: bring a curl or OpenAPI request, verify it against the API, describe the tool and its inputs, then export a connection your local AI client can run.

The exported package uses the included native runtime. No Node.js installation, npm setup, or generated-code build is needed.

• Editable tool name, purpose, and typed input descriptions.
• Actual structured JSON response data, with redaction and explicit HTTP, transport, input, and size-limit errors.
• Fixed endpoint and authentication boundaries, environment-only runtime credentials, package integrity checks, and atomic exports.
• GET/HEAD by default; other methods need explicit opt-in. Verification and exported runtime both refuse redirects.
• Readable desktop layout, guided starting example, and direct connection configuration export.

Download the Apple Silicon macOS ZIP, unzip it, and move FirstCall.app to Applications before exporting tools. The companion runtime is inside the app. Keep the app and exported package at their selected locations; export new connection settings if either moves.

This release provides Apple Silicon macOS artifacts only. It is ad-hoc signed for bundle integrity and is not Apple notarized. Intel Mac, Windows, and Linux binaries are not included. Previous releases remain available.

Validated with the Rust test suite, formatting and strict Clippy checks, archive extraction and checksums, the actual desktop API verification/export flow, and an independent official MCP SDK client calling the exported GitHub repository tool successfully. SHA256SUMS.txt covers both archives.

FirstCall v0.2.1

FirstCall v0.2.1 adds a verifiable desktop GUI launch path and refreshes the public demos from the released Windows archive.

Highlights:

• Desktop GUI now supports --data-dir, --config-dir, --screen, and --sample for repeatable validation and demos.
• README now includes both CLI/MCP and desktop GUI demos.
• The former non-goal framing was replaced with positive support-boundary documentation.
• Package/runtime hardening from v0.2.0 remains: body-kind preservation, request fingerprint recomputation, stricter package validation, generated MCP stdio roundtrip in CI, and release archive checks.

Verification performed for this release:

• GitHub Actions CI passed on Windows, Linux, and macOS.
• CLI lifecycle, Loopback verify, Security audit, and Release binaries workflows passed.
• The Windows v0.2.1 release zip was downloaded locally and checked against SHA256SUMS.txt.
• The downloaded firstcall.exe reported firstcall 0.2.1 and accepted the GUI validation flags.
• The downloaded firstcall-cli.exe reported firstcall-cli 0.2.1.
• The downloaded CLI verified GitHub GET /user with HTTP 200, exported a package, inspected it as ready, installed generated MCP dependencies, built the TypeScript server, and called the generated MCP tool successfully over stdio.
• The downloaded GUI was launched against an isolated SQLite store created by the downloaded CLI, captured showing sample request parsing and recipe storage rendering, and used to refresh the README GUI GIF.

Download the archive for your OS, extract it, and run:

• firstcall --screen new --sample curl for the desktop GUI workbench.
• firstcall-cli version for the automation CLI.

CLI verification remains environment-first. Do not put real secrets in command history, scripts, or exported artifacts.

FirstCall v0.2.0

FirstCall v0.2.0 hardens the agent-package path from verified HTTP request to generated MCP server.

Highlights:

• Preserves imported body kinds (none, json, text, form, multipart) in agent packages.
• Recomputes request fingerprints during package inspection/import readiness checks.
• Validates generated package metadata more strictly before import.
• Adds a real generated MCP stdio roundtrip to the CLI lifecycle workflow.
• Adds release-archive checks that extract each uploaded package and run the packaged CLI.
• Shortens the README and refreshes the main demo GIF from a downloaded v0.2.0 Windows release asset.

Verification performed for this release:

• GitHub Actions CI passed on Windows, Linux, and macOS.
• Security audit passed.
• CLI lifecycle passed with npm install, npm run build, and a generated MCP tool call.
• The Windows release zip was downloaded locally, checked against SHA256SUMS.txt, extracted, and used to verify GitHub GET /user, package the verified recipe, build the generated MCP server, and call it successfully over stdio.

Download the archive for your OS, extract it, and run:

• firstcall for the desktop GUI workbench.
• firstcall-cli version for the automation CLI.

CLI verification remains environment-first. Do not put real secrets in command history, scripts, or exported artifacts.

FirstCall v0.1.0

FirstCall v0.1.0

FirstCall is a Rust 2024 local-first verified API recipe workbench for turning request sources into verified, reusable recipes and redacted agent-ready API tool packages.

Highlights

• Desktop GUI workbench for request-source intake, parser notes, draft candidate review, runtime slot/auth entry, local execution, attempts, recipes, and settings.
• firstcall-cli automation surface for verify, package, validate-package, inspect-package, import-package, recipe-list, recipe-show, and JSON reports.
• Static source adapters for curl, docs, OpenAPI, Postman Collection, HAR, .http / .rest, Hurl, Bruno/OpenCollection, and GraphQL-over-HTTP JSON body detection.
• OpenAPI local relative JSON/YAML $ref support with safe handling for remote refs, cycles, depth limits, malformed files, and resolver-root boundaries.
• Redacted agent package export with manifest validation, inspect-gated import, and storage-backed re-verification.
• Optional MCP compile smoke through validate-package --mcp-compile-smoke.
• Optional native keyring backend for GUI credential UX, with session-memory fallback.
• Desktop feature split: default builds include the GUI, while firstcall-cli supports --no-default-features CLI-only builds.
• Native save dialogs for GUI Markdown/JSON recipe exports.
• CI coverage for cross-platform builds, CLI-only builds, security audit, and local loopback lifecycle verification.

Safety Boundaries

• Local-first only: no cloud backend or marketplace.
• CLI verification remains environment-first and does not read GUI keyring/session-memory secrets.
• Imported scripts/tests/runtime hooks from source tools are not executed.
• Remote OpenAPI refs are not fetched.
• Generated mcp-server/ files are package artifacts, not import source of truth.
• Raw secrets are not intentionally written to SQLite, exports, package files, logs, CLI reports, recipe-list, or recipe-show output.
• Mutating HTTP methods require the existing --allow-mutating guard.

Validation

This release is expected to pass:

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --locked
• cargo build --locked
• cargo build --locked --bin firstcall-cli --no-default-features
• cargo build --locked --features "desktop native-keyring"