Skip to content

Releases

GuildControl MCP 2.3.9

GuildControl MCP 2.3.9 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 13:23
Immutable release. Only release title and notes can be modified.
v2.3.9
27e4990
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.3.9 is published from the protected v2.3.9 source tag at commit 27e4990cb6cd7d4f3b529ea9a43161e0b35f050b.

Release summary

GuildControl 2.3.9 keeps channel name matching behavior while removing a regular-expression path that could do excessive work on long names.

Highlights

  • Channel creation and scaffold matching normalize separator-heavy names with direct boundary checks.

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.9 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.9.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.9.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.9 --repo j-256/guildcontrol
gh release download v2.3.9 --repo j-256/guildcontrol
gh release verify-asset v2.3.9 guildctl-2.3.9.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.9 guildcontrol-2.3.9.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.9 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.9.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.9 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.9.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.9 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:e722331d1ccd8cf8ce2c2d4884f78adf9d0f51ffef3c250c6754350b9fe7bd79 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.9 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Assets 9
Loading

GuildControl MCP 2.3.8

GuildControl MCP 2.3.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Nov 20:25
Immutable release. Only release title and notes can be modified.
v2.3.8
4a009f7

GuildControl MCP 2.3.8 is published from the protected v2.3.8 source tag at commit 4a009f7e426a41df524b00ef405245933eedc10f.

Release summary

GuildControl MCP 2.3.8 repairs default-runtime HTTP compatibility and keeps guild administration available when Discord introduces unfamiliar channel types. Unsupported channel semantics remain explicit coverage gaps, and GuildControl uses bot authentication only.

Highlights

  • Restore native HTTP across local, npm, MCPB, and container launch paths while preserving the selected standard runtime in child processes.
  • Retain unfamiliar guild channel types as exact topology without granting them unsupported operations.
  • Allow reviewed single and bulk member-role changes, invite role grants, and role deletion with signed partial channel analysis while retaining required authorization, known-risk checks, and discovered dependency blockers.

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.8 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.8.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.8.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.8 --repo j-256/guildcontrol
gh release download v2.3.8 --repo j-256/guildcontrol
gh release verify-asset v2.3.8 guildctl-2.3.8.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.8 guildcontrol-2.3.8.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.8 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.8.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.8 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.8.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.8 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:afc4065792e7b43d60283eaf3c4d804d0e822901e5b126a7fd436f1dc0657b05 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.8 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.7

GuildControl MCP 2.3.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 14:23
Immutable release. Only release title and notes can be modified.
v2.3.7
356113e

GuildControl MCP 2.3.7 is published from the protected v2.3.7 source tag at commit 356113e02ecf9cb97db7b1387d79aba344e81f51.

Release summary

Refresh reviewed MCP SDK and automation dependencies while preserving dependency review and artifact identity.

Highlights

  • Align the MCP SDK client and server updates.
  • Refresh reviewed Docker login and Node type pins.
  • Preserve the selected Docker connection during container verification.
  • Document dependency review and candidate artifact preparation.

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.7 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.7.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.7.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.7 --repo j-256/guildcontrol
gh release download v2.3.7 --repo j-256/guildcontrol
gh release verify-asset v2.3.7 guildctl-2.3.7.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.7 guildcontrol-2.3.7.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.7 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.7.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.7 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.7.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.7 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:eea07fb9457611e9c753403e1094ac2326504a33ef1fdf5e5ea957ef1562167a --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.7 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.6

GuildControl MCP 2.3.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 19:55
Immutable release. Only release title and notes can be modified.
v2.3.6
40a5396

GuildControl MCP 2.3.6 is published from the protected v2.3.6 source tag at commit 40a53963bc5e855ad9a9ecc4d3272e263cccf7d8.

Release summary

Refresh the source-backed Discord MCP Registry comparison. The field-wide lead claim is suspended until the newly registered comparable release receives a complete matrix and migration audit.

Highlights

  • Dated Registry coverage and external evidence links verified by the documentation gate

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.6 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.6.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.6.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.6 --repo j-256/guildcontrol
gh release download v2.3.6 --repo j-256/guildcontrol
gh release verify-asset v2.3.6 guildctl-2.3.6.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.6 guildcontrol-2.3.6.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.6 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.6.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.6.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:c6f415ab26e42d9a30ce49f35d56b1ea2b456fff9992a29a1a049eb9906ae8c7 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.6 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.5

GuildControl MCP 2.3.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 17:47
Immutable release. Only release title and notes can be modified.
v2.3.5
a1a922d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.3.5 is published from the protected v2.3.5 source tag at commit a1a922d06f935054a892ef1924a140b91b8db82f.

Release summary

GuildControl 2.3.5 upgrades its OpenTelemetry API, SDK, and OTLP exporters as a compatible dependency set.

The supported Node.js floor is 22.15, following the OpenTelemetry 3 migration requirement. Package metadata, bundled artifact identity, and setup documentation are aligned with that runtime floor.

Highlights

  • Upgrade OpenTelemetry SDK and exporters to the 3.x-compatible releases
  • Require Node.js 22.15 or newer for the application and MCPB bundle
  • Rebuild the versioned MCPB and bind its digest to the Registry manifest

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.5 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.5.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.5.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.5 --repo j-256/guildcontrol
gh release download v2.3.5 --repo j-256/guildcontrol
gh release verify-asset v2.3.5 guildctl-2.3.5.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.5 guildcontrol-2.3.5.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.5 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.5.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.5 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.5.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.5 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:e3d17ef79415c457a1065fcb848ae388809f43692dbbc5515d41cc61057c33af --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.5 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.4

GuildControl MCP 2.3.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 20:54
Immutable release. Only release title and notes can be modified.
v2.3.4
497993d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.3.4 is published from the protected v2.3.4 source tag at commit 497993dbf516247bd15206df1cf3518c437244b2.

Release summary

GuildControl 2.3.4 refreshes its pinned Zod and Node.js type dependencies while preserving the existing Discord access and approval controls.

The CodeQL workflow uses reviewed v4.39.0 action commits, and release metadata checks recognize the updated dependency and action pins.

The documentation portal updates Astro and its Markdown peer to patched releases that clear the dependency security check.

Highlights

  • Refresh pinned validation and Node.js type dependencies.
  • Keep CodeQL analysis on reviewed action commits.
  • Update documentation tooling to patched Astro.

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.4 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.4.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.4.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.4 --repo j-256/guildcontrol
gh release download v2.3.4 --repo j-256/guildcontrol
gh release verify-asset v2.3.4 guildctl-2.3.4.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.4 guildcontrol-2.3.4.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.4 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.4.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.4 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.4.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.4 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:54b5d47e638bc79e65dab5d2e8e9adfb1422bb03a3353938d376c5d1b1362358 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.4 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.3

GuildControl MCP 2.3.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 20:28
Immutable release. Only release title and notes can be modified.
v2.3.3
3a52957

GuildControl MCP 2.3.3 is published from the protected v2.3.3 source tag at commit 3a5295763bc67328f59a6a927293d7fb4e4087c1.

Release summary

GuildControl MCP 2.3.3 refreshes the audited Discord MCP comparison and preserves release-exact migration plans for source versions offered by previous published GuildControl releases.

Migration planning remains offline and advisory; it does not import source configuration, credentials, or host settings. Release verification accommodates slow MCP Registry reads while preserving the existing publication checks.

Highlights

  • Audit Cappyeo 0.32.0 in the latest scored comparison and update Registry evidence checks
  • Restore exact Cappyeo and PaSympa migration source versions previously offered by published GuildControl releases
  • Keep older source inventories and outcome guidance available when a newer competitor version becomes the comparison baseline
  • Complete staged release verification when the MCP Registry responds slowly

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.3 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.3.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.3.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.3 --repo j-256/guildcontrol
gh release download v2.3.3 --repo j-256/guildcontrol
gh release verify-asset v2.3.3 guildctl-2.3.3.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.3 guildcontrol-2.3.3.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.3 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.3.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.3 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.3.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.3 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:9c892b1e208cf96dae5c3f633c87d623c5bdf7154b721b7fb764f946ab40e094 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.3 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.1

GuildControl MCP 2.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 20:22
Immutable release. Only release title and notes can be modified.
v2.3.1
a29fddf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.3.1 is published from the protected v2.3.1 source tag at commit a29fddf9538a41088e12dce0f3f829e2c7f1d024.

Release summary

GuildControl updates its MCP dependencies and patches documentation build dependencies. Release preparation can verify a reviewed source repair on its exact task commit before protected integration and publication.

Highlights

  • Update MCP client and server dependencies to the patched release
  • Patch documentation image, source map, TOML, and selector dependencies
  • Prepare source repairs with exact commit and integration-base checks, complete release verification, and rollback on failure

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.1 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.1.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.1.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.1 --repo j-256/guildcontrol
gh release download v2.3.1 --repo j-256/guildcontrol
gh release verify-asset v2.3.1 guildctl-2.3.1.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.1 guildcontrol-2.3.1.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.1 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.1.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.1 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.1.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.1 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:d5025c7eab80e5d0e6e64fe83be8cefd04108d77e38390d078b3c3eda31e962d --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.1 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.3.0

GuildControl MCP 2.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Sep 00:23
Immutable release. Only release title and notes can be modified.
v2.3.0
0c7451e

GuildControl MCP 2.3.0 is published from the protected v2.3.0 source tag at commit 0c7451e75c8b8925a96e04069aa3152e6f155262.

Release summary

GuildControl MCP 2.3.0 makes rich Discord messages readable in MCP text results and bounds operational shutdown while preserving the existing configuration format and reviewed administration gates.

This release includes the runtime dependency updates prepared under the unpublished 2.2.1 version and publishes the combined changes under a minor version for the added message presentation capability.

Highlights

  • Read original message, nested Text Display, and embed text alongside preserved structured results, with secret redaction and complete response limits
  • Close independent stdio resources under one deadline, drain admitted tool work before final telemetry, and retain recovery evidence when cleanup is incomplete
  • Refresh the Discord MCP Registry comparison and Cappyeo 0.27.1 migration assessment
  • Update runtime and documentation dependencies and improve documentation discovery and generated cover checks
  • Verify clean EOF shutdown in installed npm and MCPB distributions

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.3.0 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.3.0.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.3.0.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.3.0 --repo j-256/guildcontrol
gh release download v2.3.0 --repo j-256/guildcontrol
gh release verify-asset v2.3.0 guildctl-2.3.0.tgz --repo j-256/guildcontrol
gh release verify-asset v2.3.0 guildcontrol-2.3.0.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.3.0 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.3.0.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.0 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.3.0.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.0 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:d70bc0fc5bd5adafa89739bc142dc1ac968a741d03f8bf623e3d80b9d7bb13b0 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.3.0 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading

GuildControl MCP 2.2.0

GuildControl MCP 2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 12:50
Immutable release. Only release title and notes can be modified.
v2.2.0
4b4c893
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuildControl MCP 2.2.0 is published from the protected v2.2.0 source tag at commit 4b4c893fbe3f490429118746694ce4507942bd31.

Release summary

GuildControl MCP 2.2.0 establishes the stable version line without a new runtime, command, or configuration break from 0.4.0.

The 2.x major records the earlier package and executable rename from guildcontrol to guildctl; the 2.1 and 2.2 minor milestones carry forward the compatible policy, documentation-search, thread-conversation, host-detection, and safe short-option additions released after that clean break.

This is a forward rebaseline that preserves the project's real compatibility history without inventing retroactive published artifacts.

Highlights

  • Keep the existing 0.4.0 policy documents and guildctl commands compatible
  • Publish npm, OCI, MCPB, and MCP Registry distributions under one stable 2.2.0 identity
  • Retain the reviewed-write, least-privilege, privacy, and evidence boundaries

Install

npx --yes [email protected] catalog --check
docker run --rm -i --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=64 ghcr.io/j-256/guildcontrol:2.2.0 catalog --check

Compatible local MCP hosts can install the one-click MCPB bundle. The host asks for one strict non-secret configuration file and stores the bot token as a separate sensitive input.

Every operational deployment requires an operator-owned Discord application and bot. No distribution includes a shared bot or credential.

Distribution identities

The protected workflow registers MCP Registry metadata only after this immutable Release and every MCPB byte verify exactly.

Included evidence

  • guildctl-2.2.0.tgz: the exact npm archive reconstructed and attested by the protected release workflow
  • guildcontrol-2.2.0.mcpb: the reproducible cross-platform one-click bundle with an embedded SPDX inventory, third-party notices, privacy policy, and credential-free contract evidence
  • catalog-evidence.json: the deterministic credential-free MCP contract fingerprint
  • sbom.spdx.json: the validated SPDX production-dependency inventory
  • release-notes.md: the canonical notes retained as an immutable asset because GitHub permits displayed Release notes to be edited
  • SHA256SUMS: SHA-256 digests for the listed evidence assets above

The immutable GitHub Release attestation binds the source tag, commit, and attached assets. npm provenance separately binds the package to the protected workflow, while the OCI index carries per-platform BuildKit provenance and SPDX evidence plus a signed root-digest claim.

Verify

gh release verify v2.2.0 --repo j-256/guildcontrol
gh release download v2.2.0 --repo j-256/guildcontrol
gh release verify-asset v2.2.0 guildctl-2.2.0.tgz --repo j-256/guildcontrol
gh release verify-asset v2.2.0 guildcontrol-2.2.0.mcpb --repo j-256/guildcontrol
gh release verify-asset v2.2.0 release-notes.md --repo j-256/guildcontrol
gh attestation verify guildctl-2.2.0.tgz --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
gh attestation verify guildcontrol-2.2.0.mcpb --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
gh attestation verify oci://ghcr.io/j-256/guildcontrol@sha256:cd59abec4efd288e4cb6e2bbd2c68bf87ebca2b12a9bfa122961bc9e7becd114 --repo j-256/guildcontrol --signer-workflow j-256/guildcontrol/.github/workflows/release.yml --source-ref refs/tags/v2.2.0 --deny-self-hosted-runners
shasum -a 256 -c SHA256SUMS

Attestations establish artifact identity, origin, and integrity. They do not guarantee that software is vulnerability-free, and the SBOM remains bounded by the scanner and package metadata that produced it.

Loading