Melange CLI/MCP v0.5.0

Changelog

• 20253dd Improve image display in README.md
• 7c1e7f9 Merge pull request #11 from zetic-ai/feat/oauth-primary-login
• d1d7702 Revise installation instructions in README.md
• 3e3b5bf feat(auth): OAuth as primary auth login with PAT fallback
• c2eb3a1 feat(mcp): add Title to every tool for connector directories
• 205b31a feat: add Melange CLI logo to README
• 5fa3826 fix(auth): 3 must-fixes + coverage for OAuth primary login
• df12c46 fix(auth): harden OAuth credential lifecycle
• 4dab146 fix(ci): docs regen and race-safe flow_test buffers
• b585de1 fix(install): tolerate workflow_dispatch signature for v0.4.0
• cb9183f fix(lint): gofmt mcp Tool fields (Name align) + coverage and smoke for OAuth primary login
• 8370e7b fix(oauth): close ln before re-binding same port on invalid_target retry
• ffabe6c fix(oauth): handle bare host without scheme in normalizeHost
• e25f433 fix(oauth): stabilize loopback race with httptest and fresh port
• 3fad8c4 fix(test): make oauth loopback tests robust under -race
• 8a18f35 fix(test): make outer invalid_target retry test robust on macos
• d608056 fix(test): windows ConfigDir variants for save_extra_test

Melange CLI/MCP v0.4.0

Changelog

• afc7194 Add instructions for updating the agent skill
• 5cbd721 Add update instructions for melange-cli
• 459e0bb Enhance README with CLI update instructions
• dd72a29 Merge branch 'feat/mcp-evals' into feat/mcp-docs
• 3c89bce Merge branch 'feat/mcp-http' into feat/mcp-upload
• 2dd1f99 Merge branch 'feat/mcp-oauth' into feat/mcp-evals
• 6aa1e53 Merge branch 'feat/mcp-upload' into feat/mcp-oauth
• f1c2809 Merge feat/mcp-core: melange mcp stdio server, 17-tool catalog (#5)
• a98f593 Merge feat/mcp-docs: registry, client setup, llms.txt, connector prep (#10)
• 5f2dbd8 Merge feat/mcp-evals: eval harness, live e2e, hardening (#9)
• e2c68be Merge feat/mcp-http: Streamable HTTP transport, PAT bearer auth, rate limiting (#6)
• 91f2fc2 Merge feat/mcp-oauth: OAuth resource server, audience, RFC 9728, write scopes (#8)
• 37c1761 Merge feat/mcp-upload: uploadflow extraction + upload_model tool (#7)
• acc66fd Refactor update sections in README.md
• 77fa0e3 Revise README for clarity on installation steps
• 0abee0d Update README for clarity on Melange CLI usage
• 76475b5 Update README.md
• c0165fe ci(release): allow manual dispatch for v0.4.0
• 61c69de ci(release): checkout dispatched tag for manual release
• e8f9778 ci: add the nightly/on-demand live e2e + agent eval workflow
• 7c7d60d feat!: follow the v1 boundary change — precision and variant replace target
• faa36c3 feat(e2e): live mcp e2e script for both transports (make e2e)
• 58cfb48 feat(install): install the CLI and agent skill in one curl command
• 5c7a23f feat(mcp): add AuthHints seam for transport-specific auth remediation
• 541a26d feat(mcp): add MCP server core, stdio command, and whoami tool
• 702a82c feat(mcp): add Streamable HTTP server core (httpserver package)
• b711b86 feat(mcp): add deploy, report, library, and account read tools
• 5c8ce5e feat(mcp): add repo and model read tools
• eaa89ee feat(mcp): add repo write, model write, and download tools
• a0a52a1 feat(mcp): add the local-only upload_model tool
• 37f1c35 feat(mcp): answer scope-blocked calls with an RFC 6750 insufficient_scope 403
• 63fd75a feat(mcp): derive tool output schemas from the OpenAPI spec
• 13ec204 feat(mcp): enforce OAuth audience in the HTTP token verifier
• 10e1b1c feat(mcp): enforce the write scope per mutating tool
• fc3d686 feat(mcp): make a second stop signal close the http drain immediately
• 832cbc3 feat(mcp): real auth verifiers, WWW-Authenticate, and rate limiting for HTTP mode
• 8df804f feat(mcp): send server diagnostics to stderr
• 952ac0e feat(mcp): serve MCP over HTTP from melange mcp --transport http
• 2d1b9ce feat(mcp): serve RFC 9728 metadata and advertise it in 401 challenges
• f4eb0bc feat(mcp): throttle pre-auth request floods by source IP
• 299e31c feat(mcpeval): agent eval harness scoring real Claude agents via MCP (make eval)
• af2a7d7 feat(skill): teach agents to report conversion phases and benchmarks
• be3916f feat(tools): mcploadgen load harness and mcp-loadtest soak (make perf)
• 54b1e33 fix(ci): use dispatched tag for npm version
• e768875 fix(e2e): close the review gaps — DB locality gate, leak-proof hygiene, assertions that can fail
• a98cd82 fix(mcp): declare OpenWorldHint explicitly on every tool
• 17f2eed fix(mcp): drain the HTTP server on SIGTERM, not only SIGINT
• 4ffc019 fix(mcp): emit object-typed outputSchema unions so MCP clients accept the catalog
• 1400bbc fix(mcp): exit 0 when the client hangs up mid-request
• 0da29b6 fix(mcp): filter the SDK's per-connection log noise and align the stdio env guard
• 3977191 fix(mcp): key the pre-auth limiter on the IPv6 /64, not the address
• e84f2ad fix(mcp): path.Clean the canonical resource URL
• b45fed9 fix(mcp): refuse empty --resource values and fail closed on missing aud
• 36fede6 fix(mcp): regenerate schemas and goldens for v1 variant/precision boundary
• cc4e816 fix(mcp): reject ValidateTokens until the MeVerifier exists
• b4c9147 fix(mcp): report a failed upload session unlock instead of dropping it
• fba0e17 fix(mcp): reserve the insufficient_scope 403 for OAuth bearers
• 4f56c03 fix(mcp): retry client resolution instead of caching the failure
• dabb058 fix(mcp): state the http enforcement posture and warn on stdio-ignored resource env
• 8059618 fix(mcp): stop HTML-escaping composite envelope halves
• 37eebb4 fix(mcp): stop leaking backend host and dial detail in token-validation 500s
• 6f429db fix(skill): report the whole model, inline, not one device's slice
• 4e55b1c perf(mcp): share resolved tool schemas across per-request HTTP servers
• 5f7fd41 refactor(api): consolidate the idempotency-key helper into internal/api
• d82bec0 refactor(mcpeval): drop the tools/list schema shim now the catalog is valid
• 243c877 refactor(skill): drop the accuracy-details table from the LLM report
• f6500ab refactor(skill): template the model report, split SKILL.md to assets/
• eedb404 refactor(upload): extract the upload session state machine into internal/uploadflow
• ebcb3d1 refactor: inline the dead helpers manifestOptions and lowerState

Melange CLI v0.3.0

Changelog

• afc7194 Add instructions for updating the agent skill
• 5cbd721 Add update instructions for melange-cli
• 459e0bb Enhance README with CLI update instructions
• 48bcb2f Revert "feat: readable terminal output, /v1-scoped api, and installer/README …" (#4)
• 77fa0e3 Revise README for clarity on installation steps
• 0abee0d Update README for clarity on Melange CLI usage
• 76475b5 Update README.md
• af2a7d7 feat(skill): teach agents to report conversion phases and benchmarks
• a056a61 feat: readable terminal output, /v1-scoped api, and installer/README fixes (#3)
• 6f429db fix(skill): report the whole model, inline, not one device's slice
• 243c877 refactor(skill): drop the accuracy-details table from the LLM report
• f6500ab refactor(skill): template the model report, split SKILL.md to assets/

Melange CLI v0.2.0

Changelog

• 2eb5720 Add Homebrew and npm installation
• 349fc79 Refactor installation and usage instructions
• a757136 Revise README
• 6b6c609 Update README with link to PAT settings
• 658b725 Update contact email for reporting vulnerabilities
• 5e57ac8 Update copyright year and owner in LICENSE file
• 08b1f7e Update security contact email in SECURITY.md
• 15311dd feat: add melange plan, plan-aware auth status, quota remaining

Melange CLI v0.1.0

Melange CLI v0.1.0

The first public release of melange, the agent-first command-line interface for the Zetic.ai Melange platform.

Highlights

• Browse the public model library and inspect benchmark reports.
• Generate credential-safe deployment guides for:
  • Android/Kotlin
  • Android/Java
  • iOS/Swift
  • Flutter
• Create and manage repositories and model versions.
• Upload models with dry-run validation, resumable transfers, progress reporting, and terminal-state waiting.
• Import models, inspect converted targets, select defaults, and download artifacts.
• View usage and account quota information before performing restricted operations.
• Call any public-v1 endpoint through the melange api escape hatch.

Built for agents

• Structured --json, --jq, and Go-template output.
• Stable exit codes for success, usage, authentication, interruption, and runtime failures.
• Data on stdout; progress and diagnostics on stderr.
• Non-interactive operation through --no-input and explicit confirmation flags.
• No implicit model imports or mutations during library and benchmark discovery.
• Entitlement-aware benchmark and upload guidance.
• A dedicated Melange CLI skill for Claude Code, Codex, Cursor, and compatible agents.

Install

macOS and Linux

The verified installer requires cosign:

curl -fsSL https://raw.githubusercontent.com/zetic-ai/melange-cli/main/script/install.sh | sh

Go

Requires Go 1.26 or newer:

go install github.com/zetic-ai/melange-cli/cmd/melange@v0.1.0

Windows

Download the appropriate archive from this release, or use the Go installation command above.

Authenticate

Create a Personal Access Token in Melange → Settings → Personal Access Tokens, then run:

melange auth login
melange auth status

Install the agent skill

The agent skill is installed separately from the binary:

npx skills add zetic-ai/melange-cli --skill melange-cli --global

Restart your coding agent after installation.

Release artifacts

This release provides signed archives for:

• macOS: AMD64 and ARM64
• Linux: AMD64 and ARM64
• Windows: AMD64 and ARM64

Each release includes SHA-256 checksums, a keyless Sigstore verification bundle, and SBOMs.

Rollout note

melange v0.1.0 targets Melange Public API v1 at https://api.zetic.ai. Server-backed commands require the corresponding production public-v1 deployment. Account plan and report entitlements continue to determine upload availability and benchmark coverage.