Publish versioned MCPB release assets

[thisrohangupta]

Summary

• publish a versioned cross-platform MCPB asset after each existing v*.. release
• support exact-tag manual backfills without rerunning npm publication
• package through the pinned official MCPB CLI with a relocatable server path and 512x512 icon

Verification

• exact-tag v3.2.20 bundle validated and packed at 127 MB
• unpacked bundle completed an MCP stdio initialize handshake as server version 3.2.20
• pnpm test: 134 files, 3093 tests
• pnpm standards:check: 77 tests
• pnpm typecheck
• pnpm docs:check
• pnpm npm-shrinkwrap:check

[cursor]

Automation check — no inline review comments to address

Triggered on ready_for_review for PR #846 (chore/publish-mcpb-release-assets).

Checked GitHub review data:

• 0 pull review comments
• 0 review threads
• 0 submitted reviews

No inline reviewer feedback was present in the trigger payload or on the PR, so no code changes were made. This run will pick up inline comments once reviewers leave them on the diff.

  

_{Sent by Cursor Automation: Autofix PR review comments}

[cursor]

PR Risk Assessment

Risk level: Low

Decision: Approved — no additional reviewers required.

Evidence (from diff, not PR description)

Area	Assessment
Runtime server (src/)	No changes
Auth / security model	No changes
Production logic	No changes
Scope	Release/packaging pipeline only

Changes reviewed

• .github/workflows/release.yml — Adds an mcpb job (tag-triggered + workflow_dispatch backfill) that builds and uploads a versioned MCPB asset to GitHub Releases. Existing release job is gated to push events only.
• scripts/prepare-mcpb.js — Refactors internal packaging: relocatable server/ layout, production package.json + shrinkwrap handling, pinned @anthropic-ai/mcpb@2.1.2 validate/pack/info.
• manifest.json / mcp-directory/manifest.json — Entry point updated to server/index.js (bundle layout change only).
• icon.png — Updated to 512×512 (distribution metadata).
• Docs + tests — README updates, release-metadata.test.ts and release-workflow.test.ts cover manifest shape, icon size, and workflow structure.

Why Low (not Medium)

• Isolated to internal release tooling and distribution artifacts; no shared runtime codepaths.
• Additive CI with safeguards (semver tag validation, package-version match, MCPB CLI validation).
• Comprehensive structural tests added.
• No CODEOWNERS file; no domain-ownership ambiguity.

Reviewers

None assigned — Low risk PRs do not require additional reviewers per policy.

  

_{Sent by Cursor Automation: Assign PR reviewers}