v0.1.0 — MCP server on npm + drop-in skill

First production release of the xerant DevOps skill + MCP server.

Highlights

• npm package live: xerant-mcp-server@0.1.0 — 22 tools over stdio MCP, 43 kB unpacked.
• Drop-in skill at .agents/skills/xerant/ — ships a bundled MCP binary, installer, security scripts, Dockerfile / compose templates. Works offline.
• One-line install (live today):

  curl -fsSL https://raw.githubusercontent.com/sanchaymittal/buildathon/main/.agents/skills/xerant/install-remote.sh | bash

  …and https://xerant.cloud/install once the redirect lands on the marketing site (Next.js config snippet in the skill README).

What you get after install

• /xerant command in OpenCode that deploys any project end-to-end.
• Two flows, auto-detected:
  • Compose (MVP): docker compose up -d on the internal server's host from a local project path. Triggered when a compose.yml is present.
  • Legacy GitHub: repo+branch clone-and-build on the internal server. Used when no compose file, just a Dockerfile + origin remote.
• Pre-flight security gates on every deploy:
  • .dockerignore coverage
  • ARG → ENV leak detection
  • Secret pattern scan (AWS / GitHub / Slack / Google / OpenAI / private-key headers / heuristic assignments)
  • Compose-specific: sensitive bind-mounts, privileged: true, low-port bindings, .env env_file references
  • hadolint (advisory, if installed)
• 22 MCP tools callable directly by any MCP client: xerant_health, xerant_compose_up/down/status/logs/ping, xerant_deploy, xerant_get_deployment, xerant_deployment_logs, xerant_stop/start/restart_deployment, xerant_redeploy, xerant_remove_deployment, xerant_list_containers/get_container/container_logs, xerant_github_get_repo/list_branches/get_file.

Installation paths (in increasing order of production-polish)

1. curl | bash (ships today, zero infra)

curl -fsSL https://raw.githubusercontent.com/sanchaymittal/buildathon/main/.agents/skills/xerant/install-remote.sh | bash

Drops the skill into ./.agents/skills/xerant/ and wires ./opencode.json. Supports XERANT_REF, XERANT_REPO, XERANT_TARGET, XERANT_FORCE env overrides.

2. Tarball download (this release)

curl -fsSL https://github.com/sanchaymittal/buildathon/releases/download/v0.1.0/xerant-skill-v0.1.0.tar.gz | tar -xz
bash .agents/skills/xerant/install.sh

3. Vanity URL (after marketing-site redirect lands)

curl -fsSL https://xerant.cloud/install | sh

4. Direct MCP-only (no skill, just the tools)

If all you want is the MCP server in your OpenCode config:

```json
{
"mcp": {
"xerant": {
"type": "local",
"command": ["npx", "-y", "xerant-mcp-server@latest"],
"environment": {
"XERANT_API_URL": "{env:XERANT_API_URL}",
"XERANT_API_KEY": "{env:XERANT_API_KEY}"
}
}
}
}
```

Requirements

• Node.js ≥ 20 on the client (only for the installer + bundled binary).
• A reachable internal-server (see internal-server/ in this repo). Default URL http://localhost:8000, override via XERANT_API_URL.
• Docker daemon on the internal-server host — not on the client.

Environment

• XERANT_API_KEY — optional bearer, forwarded as Authorization: Bearer. Never written to disk.
• XERANT_API_URL — override the internal-server URL.

Assets

• xerant-skill-v0.1.0.tar.gz — the full skill folder (~160 kB gzipped, ~750 kB unpacked including the bundled MCP binary).

Coming in the next release

• xerant-cli npm package so the one-liner becomes npx -y xerant-cli install (no curl | bash, no tarball fetch).
• @xerant npm org creation + republish of both packages under the scope.
• Auth middleware on the internal-server so XERANT_API_KEY starts being enforced.
• Compose v2 healthcheck integration surfaced in xerant_compose_status.

Full commit history

See 72b3a13..3b7b000 for everything that went into this release.