v0.27.0

What's new

Added

• The install scripts take -v (--version, -Version on Windows) to install a given release, e.g. sh -s -- -v 0.22.0.

Changelog

Features

• 6c22e17: feat(install): install a given release with -v (#71) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.27.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.26.0

What's new

Added

• The TUI exports pipelines to a file and imports them back, with their presets, through the system's file dialog (x, X and I on the pipelines screen).
• Pipelines can run Claude Code on any Anthropic- or OpenAI-compatible model API, with ready-made OpenRouter, Kimi for Coding, Z.ai, DeepSeek, MiniMax and Ollama; the key stays with ymcp.
• ymcp pipeline new --agent openai --endpoint openrouter --model M creates a pipeline on a model API; --endpoint also takes a URL.

Changelog

Features

• 838f4e6: feat(pipeline): agents on Anthropic- and OpenAI-compatible endpoints (#67) (@xlsft)
• d24e03b: feat(pipeline): export and import pipelines with their presets (#70) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.26.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.25.0

What's new

Added

• A run that ended as done reopens when its issue is moved back into review or working, with the comments written since as its feedback.
• /clear and /compact work on a run that ended as done or closed, without moving its issue.

Fixed

• A /clear or /compact on a run no runner follows any more is refused instead of being kept unseen.

Changelog

Features

• 8d37364: feat(pipeline): reopen a done run whose issue is moved back, and take /clear and /compact after a run ends (#68) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.25.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.24.0

What's new

Changed

• The pipeline wizard's discard question offers s to save the draft instead.

Changelog

Features

• ab002fc: feat(tui): save from the discard question of the wizard (#66) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.24.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.23.0

What's new

Added

• ymcp update lists what each release between your version and the new one changed, and links the changelog at ymcp.su/changelog.

Changelog

Features

• 0d7644c: feat(update): show what changed in every release since yours (#65) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.23.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.22.0

What's new

Changed

• An answer, a reply command or a cancel given in the TUI or with the CLI, and a comment the TUI posts on a run's issue, reach the run within a second instead of waiting for the runner's next poll of YouTrack.

Fixed

• A second /compact sent while the first is still writing its summary is skipped, instead of making two summaries and hiding the comments twice.

Changelog

Features

• 79c20d4: feat(pipeline): act on what the TUI asks of a run at once (#59) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.22.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.21.0

What's new

Added

• ymcp setup in a terminal opens a TUI of your profiles, in the look of ymcp pipeline, showing each one's sign-in, allowed tools, confirmations and clients; enter edits a profile, n adds one and d removes one.
• A profile wizard edits a profile in three steps: its name and connection (signed in as you type), the allowed tools chosen one by one in a tree of groups, and the MCP clients it is registered in.
• Destructive tools (deletes, unlinks, apply_command with a removing command, call_api with DELETE) can ask for your confirmation: called without confirm they change nothing and return a one-time secret, valid for ten minutes, that the model must pass back after asking you.

Changed

• Confirmation of destructive tools is on by default for every profile; turn it off per profile with ymcp setup --confirm, or per server with ymcp serve --confirm or YMCP_CONFIRM, while ymcp call and pipeline agents never ask.

Changelog

Features

• b0a9eae: feat(setup): a TUI for profiles, allowed tools and confirmed destructive operations (#53) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.21.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.20.3

What's new

Changed

• Release provenance is now made by GitHub's build attestations and can be verified with gh attestation verify; the release still carries it as ymcp.intoto.jsonl.

Fixed

• A leading ~ in workspace.worktrees now means the home directory on the host, instead of git creating a directory named ~ inside the repository on ssh hosts.

Changelog

Fixes

• 560a346: fix(pipeline): a ~ in workspace.worktrees is the home directory on the host (#54) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.20.3.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.20.2

What's new

Added

• Each release comes with SLSA build provenance, ymcp.intoto.jsonl, for every file listed in checksums.txt.

Fixed

• The note in the sign-in form now says plainly that only your login and password are needed, with nothing to set up in YouTrack.

Changelog

Fixes

• f52883f: fix(setup): pitch the login and password in the sign-in note (#47) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.20.2.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

v0.20.1

What's new

Changed

• ymcp is no longer published to winget, and no longer suggests updating through it; Homebrew, Scoop, the install scripts and Docker remain.

Fixed

• Binaries are built with an updated golang.org/x/text, fixing two known vulnerabilities on crafted input.
• A stray escape byte from a CI job log with broken UTF-8 no longer reaches the pipeline agent's prompt.

Changelog

Fixes

• 0dc031e: fix: raise the OpenSSF Scorecard (x/text, token permissions, pinned images, fuzzing) (#39) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.20.1.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).