releasing-wpfdevpackmcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited releasing-wpfdevpackmcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Owner-only release tool for the WpfDevPackMcp NuGet package (the MCP server under mcp/). Its version is independent of the wpf-dev-pack plugin version (/wpf-dev-pack-release) and of knowledge content (served live, never versioned).
These rules MUST survive context compression. If prior context is lost, re-read this.
mcp/WpfDevPackMcp.csproj → <Version>wpf-dev-pack/.mcp.json → the dnx pin WpfDevPackMcp@<ver>mcp/.mcp/server.json → top-level "version"mcp/.mcp/server.json → packages[0].versiondotnet pack; update the.mcp.json pin ONLY AFTER the new version is live on nuget.org (the plugin keeps running on the old pin until the new one is available).
knowledge/ (served live — just git push) orplugin-only changes (skills/hooks/rules → /wpf-dev-pack-release).
server.json, the nuget registryBaseUrl MUST behttps://api.nuget.org/v3/index.json (the bare https://api.nuget.org fails Official MCP Registry validation with HTTP 400).
$0 = target version (e.g. 0.1.4). If omitted, increment the patch of thecurrent <Version> in mcp/WpfDevPackMcp.csproj.
Copy this checklist and track progress:
Release Progress:
- [ ] 0 Verify identity (GitHub + NuGet API key)
- [ ] 1 Determine {new-version}
- [ ] 2 Bump the 4 version strings
- [ ] 3 Verify all 4 match
- [ ] 4 Build + test
- [ ] 5 Pack
- [ ] 6 Push to NuGet (.nupkg → .snupkg pushed automatically)
- [ ] 7 Wait for nuget.org indexing
- [ ] 8 Re-pin wpf-dev-pack/.mcp.json
- [ ] 9 Commit + push
- [ ] 10 (optional) Re-publish to the Official MCP Registrygh auth status # switch to christian289 if needed: gh auth switch --user christian289Have the NuGet API key ready (nuget.org → Account → API Keys, scope Push). Never commit it.
grep "<Version>" mcp/WpfDevPackMcp.csprojUse $0 if provided, otherwise patch+1 (e.g. 0.1.3 → 0.1.4).
Set every one of these to {new-version}:
| File | What to change |
|---|---|
mcp/WpfDevPackMcp.csproj | <Version>{new-version}</Version> |
wpf-dev-pack/.mcp.json | "args": ["WpfDevPackMcp@{new-version}", "--yes"] — do this in Step 8, not now |
mcp/.mcp/server.json | top-level "version": "{new-version}" |
mcp/.mcp/server.json | packages[0].version: "{new-version}" |
The.mcp.jsonpin is intentionally deferred to Step 8 (publish-then-pin). In this step bump only the csproj<Version>and the twoserver.jsonfields.
grep -H "<Version>" mcp/WpfDevPackMcp.csproj
grep -nE '"version"' mcp/.mcp/server.json # expect TWO lines, both {new-version}If any differ, fix and re-run before continuing.
dotnet test mcp/WpfDevPackMcp.Tests/WpfDevPackMcp.Tests.csprojMust be green. (Optional: exercise tools with the MCP Inspector — see mcp/README.md.)
dotnet pack mcp/WpfDevPackMcp.csproj -c Release -o mcp/nupkgProduces WpfDevPackMcp.{new-version}.nupkg and .snupkg (both git-ignored).
dotnet nuget push "mcp/nupkg/WpfDevPackMcp.{new-version}.nupkg" \
--api-key <NUGET_KEY> --source https://api.nuget.org/v3/index.jsonThe matching .snupkg symbol package is pushed automatically.
Poll until the new version resolves (a few minutes):
dnx WpfDevPackMcp@{new-version} --yesUpdate wpf-dev-pack/.mcp.json: WpfDevPackMcp@{old} → WpfDevPackMcp@{new-version}. Also update the example pins in mcp/README.md / mcp/README.ko.md if they show a version.
git add -A
git commit -m "chore(wpf-dev-pack): WpfDevPackMcp {old} -> {new-version} - {summary}"
git push origin mainOnly if the server is (or should be) listed at registry.modelcontextprotocol.io. Requires the package from Step 6 to already be live. mcp-publisher is a standalone binary from the registry's GitHub releases (not a NuGet/dnx tool):
# download mcp-publisher for your OS from
# https://github.com/modelcontextprotocol/registry/releases/latest
mcp-publisher login github # auth as christian289 (io.github.christian289/*)
mcp-publisher publish mcp/.mcp/server.jsonknowledge/<id>/TOPIC.md, companions): served live fromthe clone on the server's next pull — no pack, no push, no version bump. Just git push.
wpf-dev-pack/): use/wpf-dev-pack-release instead; it bumps plugin.json + README badges + changelog.
mcp/ changed, there is nothingto republish.
/wpf-dev-pack-release — the plugin version release (different version stream).mcp/README.md — full publish reference + MCP Inspector usage..claude/CLAUDE.md → "WpfDevPackMcp NuGet package versioning".~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.