@@ -124,115 +124,6 @@ bundle.mcpb (ZIP file)
124124- Include all required shared libraries if dynamic linking used
125125- Test on clean systems without development tools
126126
127- # For App Developers
128-
129- Supporting MCPB bundles in your application involves three key steps:
130-
131- 1 . ** Load and validate the bundle manifest**
132- 2 . ** Extract the bundle contents to a secure location**
133- 3 . ** Launch the MCP server with the appropriate configuration**
134-
135- ## Installation
136-
137- ``` sh
138- npm install @anthropic-ai/mcpb
139- ```
140-
141- ## Basic Usage
142-
143- ``` typescript
144- import { loadConfig , runMcp } from " @anthropic-ai/mcpb" ;
145-
146- // Load a bundle configuration
147- const config = await loadConfig (" /path/to/bundle.mcpb" , {
148- userConfigValues: {
149- // Optional: provide user configuration values
150- apiKey: " user-api-key" ,
151- },
152- });
153-
154- // Run the MCP server
155- const transport = await runMcp (config , {
156- serverParams: config .serverParams ,
157- serverPath: config .extractedPath ,
158- env: {
159- // Optional: additional environment variables
160- ... process .env ,
161- ... config .env ,
162- },
163- });
164-
165- // Use the transport with the MCP SDK client
166- import { Client } from " @modelcontextprotocol/sdk/client/index.js" ;
167- import { StdioClientTransport } from " @modelcontextprotocol/sdk/client/stdio.js" ;
168-
169- const client = new Client (
170- {
171- name: " example-app" ,
172- version: " 1.0.0" ,
173- },
174- {
175- capabilities: {},
176- },
177- );
178-
179- await client .connect (transport );
180-
181- // List available tools
182- const tools = await client .listTools ();
183- console .log (" Available tools:" , tools );
184- ```
185-
186- ## Features
187-
188- ### Manifest Validation
189-
190- All manifests are validated against the schema to ensure compatibility:
191-
192- ``` typescript
193- import { validateManifest } from " @anthropic-ai/mcpb" ;
194-
195- const isValid = validateManifest (" /path/to/manifest.json" );
196- ```
197-
198- ### Signature Verification
199-
200- MCPB bundles can be digitally signed for security. The library includes functions for verifying signatures:
201-
202- ``` typescript
203- import { verifyMcpbFile } from " @anthropic-ai/mcpb/node" ;
204-
205- const signatureInfo = await verifyMcpbFile (" /path/to/bundle.mcpb" );
206- if (signatureInfo .status === " signed" ) {
207- console .log (" Bundle signed by:" , signatureInfo .publisher );
208- }
209- ```
210-
211- ### User Configuration
212-
213- Bundles can define configuration options that users need to provide:
214-
215- ``` typescript
216- const config = await loadConfig (" /path/to/bundle.mcpb" , {
217- userConfigValues: {
218- apiKey: " user-provided-key" ,
219- dataPath: " /path/to/data" ,
220- },
221- });
222- ```
223-
224- ## Security Considerations
225-
226- 1 . ** Extraction Location** : Always extract bundles to a secure, isolated directory
227- 2 . ** Path Validation** : The library includes protection against zip slip attacks
228- 3 . ** Process Isolation** : Run MCP servers in isolated processes with limited permissions
229- 4 . ** Environment Variables** : Be careful about which environment variables are passed to servers
230- 5 . ** Signature Verification** : Consider requiring signed bundles in production
231-
232- ## API Reference
233-
234- See the [ TypeScript definitions] ( src/index.ts ) for complete API documentation.
235-
236127# Contributing
237128
238129We welcome contributions! Please see our [ Contributing Guide] ( CONTRIBUTING.md ) for details.
0 commit comments