@cejel/cejel 0.1.5 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +30 -1
- package/package.json +3 -1
package/README.md
CHANGED
|
@@ -79,7 +79,32 @@ node dist/index.js .
|
|
|
79
79
|
|
|
80
80
|
Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`, and
|
|
81
81
|
`cejel-Linux-x86_64`. The release also carries `SHA256SUMS`; each binary is executed against
|
|
82
|
-
the source build and with networking denied before attachment.
|
|
82
|
+
the source build and with networking denied before attachment. Releases from v0.1.6 also
|
|
83
|
+
carry a Sigstore bundle containing GitHub's signed build-provenance attestation for all four
|
|
84
|
+
binaries. Verify a downloaded binary with:
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
gh attestation verify ./cejel-Darwin-arm64 -R BargLabs/cejel
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
This is cryptographically signed provenance. It is distinct from Apple Developer ID or
|
|
91
|
+
Microsoft Authenticode code-signing.
|
|
92
|
+
|
|
93
|
+
**Docker / OCI.** The same MCP server is published as a non-root, multi-platform image:
|
|
94
|
+
|
|
95
|
+
```bash
|
|
96
|
+
docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.6
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
|
|
100
|
+
|
|
101
|
+
```bash
|
|
102
|
+
docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.6 .
|
|
103
|
+
```
|
|
104
|
+
|
|
105
|
+
The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
|
|
106
|
+
attestation. It is also the package referenced by [`server.json`](./server.json) for the
|
|
107
|
+
Official MCP Registry.
|
|
83
108
|
|
|
84
109
|
## Leaderboard
|
|
85
110
|
|
|
@@ -284,6 +309,10 @@ server over stdio, so any MCP client (Claude Code, Cowork, Cursor, Codex) can re
|
|
|
284
309
|
trust certificate as a tool call. It wraps the exact same scan the CLI runs — same scores,
|
|
285
310
|
same verdict — and is listed on Smithery via the repo's `smithery.yaml`.
|
|
286
311
|
|
|
312
|
+
The canonical discovery manifest is [`server.json`](./server.json), published under
|
|
313
|
+
`io.github.BargLabs/cejel` in the Official MCP Registry. Its npm ownership metadata,
|
|
314
|
+
OCI ownership label, image version, and registry version are checked together before release.
|
|
315
|
+
|
|
287
316
|
Add it to an MCP client config:
|
|
288
317
|
|
|
289
318
|
```json
|
package/package.json
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cejel/cejel",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.6",
|
|
4
|
+
"mcpName": "io.github.BargLabs/cejel",
|
|
4
5
|
"private": false,
|
|
5
6
|
"publishConfig": {
|
|
6
7
|
"access": "public"
|
|
@@ -46,6 +47,7 @@
|
|
|
46
47
|
"scripts": {
|
|
47
48
|
"build": "tsup",
|
|
48
49
|
"build:sea-js": "tsup --config tsup.public-sea.config.ts",
|
|
50
|
+
"validate:distribution": "node scripts/validate-distribution-metadata.mjs",
|
|
49
51
|
"prepublishOnly": "pnpm run build",
|
|
50
52
|
"prepack": "pnpm run build",
|
|
51
53
|
"dev": "tsx src/index.ts",
|