Publish under @codegraph/mcp after npm rejected the unscoped name - #45
Merged
Conversation
…imilar npm's moderation blocked codegraph-mcp for similarity to the existing code-graph-mcp package, so the public package becomes @codegraph/mcp under the newly claimed codegraph org. Both bins keep their names, so documented commands use the explicit form: npx -y -p @codegraph/mcp codegraph-dashboard. The release gate, workflow, docs, and landing all follow, and the full installed-tarball smoke passes against the scoped artifact. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
npm's publish moderation rejected
codegraph-mcp(E403, too similar to the existingcode-graph-mcppackage). The public package is now@codegraph/mcpunder the newly claimedcodegraphorg. Version stays 0.1.0; both bins keep their names (codegraph-mcp,codegraph-dashboard); tags stayvX.Y.Z.Because neither bin matches the package's short name, a bare
npx -y @codegraph/mcpcannot resolve an executable (proven, not assumed), so every documented invocation uses the explicit form:npx -y -p @codegraph/mcp codegraph-dashboardand MCP configs pass["-y","-p","@codegraph/mcp","codegraph-mcp"]. npm flattens the scoped tarball to the samecodegraph-mcp-0.1.0.tgzfilename, which the release scripts now assert deliberately.Touched: the package manifest and build, all four release scripts and their tests, the release workflow's identity checks, README, DISTRIBUTION-SETUP, SECURITY, mcp.json.example, the dashboard setup copy, and the landing hero/release sections plus their claim-audit script. A full-repo grep classified every remaining
codegraph-mcpstring as bin name, tarball filename, or internal identity.Verification
Full
release:checkagainst the scoped artifact passed twice (fixer run and an independent orchestrator rerun) producing byte-identical tarballs: SHA-256e3ff79ca14bd822a43441d7c723b195b76485ee19af80c1ad9eeb1acd39efc7d, all 25 installed-package smoke assertions green, both explicit npx forms boot from a clean consumer (dashboard startup line, MCP initialize over stdio). Landing typecheck/lint/build/claim-audit green; turbo test 36/36; typecheck 20/20.🤖 Generated with Claude Code