spencerm/claude-ms-todo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: ship unsigned — mcpb sign corrupts the bundle (CLI bug)

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Spencer McGuire
2026-06-16 17:43:37 -06:00
parent 2162aac515
commit 7d80e9f586
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
mcp-extension/README.md
View File

@@ -84,11 +84,19 @@ npx -y @anthropic-ai/mcpb validate manifest.json
npx -y @anthropic-ai/mcpb info ms-todo.mcpb
```
### Optional: sign the extension
### Signing — currently disabled
Unsigned extensions install with a "not verified" warning. You can self-sign so
the warning shows your identity (full removal of the warning needs a CA-issued
cert your org trusts):
Unsigned extensions install with a "not verified" warning, which is fine for
internal distribution (just click through it).
> ⚠️ **Do not sign with `mcpb sign` right now.** As of `@anthropic-ai/mcpb` 2.1.2
> (and 2.0.x/2.1.x), `sign` corrupts the bundle: it writes an invalid ZIP EOCD
> comment length, so Claude Desktop fails to open it ("Invalid comment length …
> extra bytes at the end of the file") and `mcpb verify` reports it as unsigned.
> Ship the **unsigned** bundle until this is fixed upstream.
When signing works again (or with a CA-trusted cert deployed to your fleet), the
command is:
```bash
npx -y @anthropic-ai/mcpb sign ms-todo.mcpb --cert cert.pem --key key.pem