MCP: ship the helper as an MCP Bundle and list it in the MCP Registry

[r3dbars]

Requested by Justin · project thread

Why

Before: Transcripted's MCP tools only exist inside the app. MCP directories (the official MCP Registry, Glama, PulseMCP and the clients that read from them) have nothing to list, so people browsing for "meeting notes MCP" never find it.

After: each release can ship transcripted-mcp.mcpb and publish io.github.r3dbars/transcripted to the official MCP Registry. Glama can be claimed through glama.json. Registry aggregators pick it up from there.

Product Impact

• Affects: agent artifacts
• Lane: activation
• Why this matters: a new way to discover Transcripted, through the directories AI tool users already browse.

What changed

• .github/workflows/publish-mcp-registry.yml ("Publish MCP Bundle"): on release: published or by hand with a tag, it downloads the release DMG, copies the signed Contents/Helpers/transcripted-mcp out byte-for-byte, checks its signature, packs it with the manifest (plus an icon from the app), validates it with @anthropic-ai/mcpb, attaches transcripted-mcp.mcpb to the release, fills server.json with version, URL and SHA-256, and publishes with mcp-publisher login github-oidc. No secrets, no rebuild, no signing. Re-runs reuse the bundle already on the release so the SHA stays stable, and skip publishing when that version is already in the registry.
• server.json: registry template (placeholder version and SHA; the workflow fills them).
• Tools/TranscriptedMCP/mcpb/manifest.json: MCPB 0.3 manifest, binary server, macOS only, all 20 tools listed.
• glama.json: names r3dbars as maintainer on Glama.
• Tools/TranscriptedMCP/README.md: short section on the above.

How I checked it

• bash check.sh quick (PASS, Linux-safe repo checks)
• scripts/dev/agent-preflight.sh origin/main, python3 scripts/dev/check-known-traps.py, python3 scripts/dev/check-doc-paths.py
• npx @anthropic-ai/mcpb validate Tools/TranscriptedMCP/mcpb/manifest.json: passes
• server.json validates against the registry's draft server.schema.json; description is 93 chars (limit 100)
• mcp-publisher_darwin_arm64.tar.gz download URL resolves
• Swift CI green on the first head (no Swift changed)

Checks I could not run, and why:

• The workflow itself has not run. It needs a macOS runner and a real release. First run should be a manual dispatch with the latest tag.

Mac or hardware test still needed? If yes:

• After the first run, double-click the .mcpb from the release on a Mac with Claude Desktop, confirm it installs and status returns indexed counts. On main there is no bundle to install.

Risk Review

• Privacy / local-first behavior reviewed: same helper binary, same telemetry gates; nothing new leaves the Mac
• No new analytics properties
• No source-pinned files edited
• No storage path changes
• Public-facing copy stays concrete: the manifest says it's read-only and needs the app installed
• Release/update impact: adds one asset to releases after they are published; does not touch the release-candidate workflow, appcast or cask
• Independent deep review of the full diff: separate Claude reviewer, verdict "no blocking issues" (checked OIDC namespace, schema, identifier rules, zip layout against the registry and mcpb source). Its two minor notes (SIGPIPE risk in the asset check, re-run failing on an existing registry version) are fixed in 2405485.
• No private data included

Notes

• Releases are created with gh release create by the owner, so release: published fires. Manual dispatch works too.

Agent handoff

COORD_DONE: GREEN | this PR | server.json, glama.json, mcpb manifest, publish workflow | none | merge, then dispatch "Publish MCP Bundle" for the latest tag | check.sh quick, preflight, known-traps, doc-paths, mcpb validate, schema validate, independent review | lanes used: Codex=n/a; Claude=n/a (cloud session); Local=n/a; Windows=n/a | merge and run the workflow once

🤖 Generated with Claude Code

https://claude.ai/code/session_019rnUrtKHHbRAiW6wAsPPwW