v1.2.0 — Vendor Command, Homebrew Tap & Renovate Preset

🎯 What's New

mcp-bash vendor — embed the runtime directly in your git repo — a new first-class CLI command copies the minimal mcp-bash runtime into .mcp-bash/ inside your project, generates a run-server.sh wrapper, and writes a vendor.json lockfile with a deterministic SHA-256 hash for integrity verification.

Homebrew tap — mcp-bash is now installable via Homebrew on macOS and Linux:

brew install yaniv-golan/mcp-bash/mcp-bash

Update with brew upgrade mcp-bash. This is the recommended install method going forward. The formula is auto-bumped on each release.

Renovate preset — if you vendor the runtime, add one line to your renovate.json to get automatic upgrade PRs whenever a new version is released:

{ "extends": ["github>yaniv-golan/mcp-bash-framework//renovate-preset"] }

✅ Vendor Command Details

mcp-bash vendor — copies the runtime subset, generates run-server.sh, writes vendor.json:

cd my-mcp-server/
mcp-bash vendor
git add .mcp-bash/ run-server.sh
git commit -m "chore: vendor mcp-bash 1.2.0"

--verify — re-hashes the embedded tree and compares against vendor.json. Run this in CI to detect post-commit tampering:

mcp-bash vendor --verify
# vendor --verify: OK (version 1.2.0, sha256 ...)

--upgrade — replaces an existing .mcp-bash/ tree with a fresh copy from the current install. Without this flag, vendor refuses to overwrite, protecting against accidental re-vendoring.

--dry-run — prints exactly what would be created without writing any files.

Supply-chain integrity model — vendor.json records version, SHA-256 Merkle digest, source path, and timestamp. The hash is deterministic: same source → same hash every time. --verify exits non-zero if any file has been added, removed, or modified since vendoring. See docs/VENDORING.md and docs/SECURITY.md for the full threat model and CODEOWNERS recommendations.

🐛 Bug Fixes

Built-in resource providers now included in embedded trees — providers/ (echo.sh, file.sh, git.sh, https.sh, ui.sh) were previously omitted from both mcp-bash bundle output and vendor trees. Any bundle using file, HTTPS, git, or UI resources was silently failing to load those providers at runtime. They are now always embedded.

🔧 Internals

Shared embedding module — extracted lib/cli/embed.sh from bundle.sh to eliminate code duplication. EMBED_REQUIRED_LIBS, mcp_embed_framework(), mcp_embed_generate_wrapper(), and mcp_embed_compute_hash() are now the single authoritative source used by both bundle and vendor. BUNDLE_REQUIRED_LIBS in bundle.sh is now an alias.

📚 Documentation

• docs/VENDORING.md — new guide covering when/why to vendor, quick start, vendor.json format, CI integration, Renovate auto-update setup, upgrading, command reference, and security model
• docs/MCPB.md — updated bundle structure diagram to show providers/, added "Vendoring vs. Bundling" comparison section
• docs/SECURITY.md — added vendored runtime integrity notes with threat model and CODEOWNERS guidance
• README — Homebrew install as primary method, new "Vendoring the Runtime" section and feature guide entry

📦 Upgrading

No breaking changes. Minor release over 1.1.x.

# Homebrew (recommended)
brew upgrade mcp-bash

# Or via curl
curl -fsSL "https://raw.githubusercontent.com/yaniv-golan/mcp-bash-framework/v1.2.0/install.sh" | bash -s -- --yes --version "v1.2.0"

# Or via mcp-bash doctor
mcp-bash doctor --fix

---

Full Changelog: v1.1.5...v1.2.0