┌─────────────────────────────┬────────────────────────────────────────────────────────────┐

  │            Issue            │                            Fix                             │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 001 cli_flags tests         │ Replaced with deprecation shim test                        │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 002 hai-mcp integration     │ Updated to spawn haisdk mcp instead of hai-mcp             │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 003 contract snapshot stale │ Updated version 0.9.0 → 0.9.1                              │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 004 rust.yml --features cli │ Removed, added jacs-cli + jacs-mcp test steps              │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 005 release-cli.yml         │ Builds jacs-cli, removed jacs-mcp packaging/smoke tests    │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 006 release-crate.yml       │ Added jacs-cli to version check + publish                  │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 007 setup.sh/.mcp.json      │ Updated for unified jacs mcp                               │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 008 empty http feature      │ Removed http = [] stub from jacs-mcp                       │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 009 CLI flags               │ N/A (stdio-only per security directive)                    │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 010 deprecation subcommands │ Added hidden jacs mcp install and jacs mcp run             │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 011 compiler warnings       │ Fixed all 12 (9 auto-fix + 2 manual + attestation feature) │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 012 jacs version pin        │ Deferred (requires crates.io publish)                      │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 013 jacs-mcp integration.rs │ Updated to spawn jacs mcp via jacs-cli                     │
  ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
  │ 014 edition 2024            │ No action needed (consistent)                              │
  └─────────────────────────────┴────────────────────────────────────────────────────────────┘

Author: Hendler

.github/workflows/release-cli.yml

@@ -25,18 +25,14 @@ jobs:
       - name: Check Cargo.toml versions match tag
         run: |
           TAG_VERSION="${{ steps.extract.outputs.version }}"
-          JACS_VERSION=$(grep '^version = ' jacs/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
-          MCP_VERSION=$(grep '^version = ' jacs-mcp/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
-          echo "jacs version: $JACS_VERSION, tag: $TAG_VERSION"
-          echo "jacs-mcp version: $MCP_VERSION, tag: $TAG_VERSION"
-          if [ "$JACS_VERSION" != "$TAG_VERSION" ]; then
-            echo "::error::Version mismatch! jacs/Cargo.toml has $JACS_VERSION but tag is $TAG_VERSION"
-            exit 1
-          fi
-          if [ "$MCP_VERSION" != "$TAG_VERSION" ]; then
-            echo "::error::Version mismatch! jacs-mcp/Cargo.toml has $MCP_VERSION but tag is $TAG_VERSION"
-            exit 1
-          fi
+          for dir in jacs jacs-mcp jacs-cli; do
+            CARGO_VERSION=$(grep '^version = ' $dir/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+            echo "$dir version: $CARGO_VERSION, tag: $TAG_VERSION"
+            if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
+              echo "::error::Version mismatch! $dir/Cargo.toml has $CARGO_VERSION but tag is $TAG_VERSION"
+              exit 1
+            fi
+          done
 
   build:
     needs: verify-version
@@ -69,7 +65,6 @@ jobs:
     env:
       VERSION: ${{ needs.verify-version.outputs.version }}
       CLI_ASSET_NAME: jacs-cli-${{ needs.verify-version.outputs.version }}-${{ matrix.asset_suffix }}
-      MCP_ASSET_NAME: jacs-mcp-${{ needs.verify-version.outputs.version }}-${{ matrix.asset_suffix }}
     steps:
       - uses: actions/checkout@v4
         if: runner.os != 'Windows'
@@ -104,6 +99,7 @@ jobs:
             $_ -eq "$prefix/jacs/LICENSE" -or
             $_ -eq "$prefix/jacs/build.rs" -or
             $_ -like "$prefix/jacs/benches/*" -or
+            $_ -eq "$prefix/jacs-cli/Cargo.toml" -or
             $_ -eq "$prefix/jacs-mcp/Cargo.toml" -or
             $_ -eq "$prefix/jacs-mcp/README.md" -or
             $_ -eq "$prefix/jacsnpm/Cargo.toml" -or
@@ -115,6 +111,7 @@ jobs:
             $_ -like "$prefix/binding-core/src/*" -or
             $_ -like "$prefix/jacs/src/*" -or
             $_ -like "$prefix/jacs/schemas/*" -or
+            $_ -like "$prefix/jacs-cli/src/*" -or
             $_ -like "$prefix/jacs-mcp/src/*"
           }
 
@@ -132,49 +129,39 @@ jobs:
 
       - name: Build binaries
         run: |
-          cargo build --release -p jacs --features cli --target ${{ matrix.target }}
-          cargo build --release -p jacs-mcp --target ${{ matrix.target }}
+          cargo build --release -p jacs-cli --target ${{ matrix.target }}
 
       - name: Smoke test (Unix)
         if: runner.os != 'Windows'
         run: |
           ./target/${{ matrix.target }}/release/jacs --version
-          ./target/${{ matrix.target }}/release/jacs-mcp --help > /dev/null
 
       - name: Smoke test (Windows)
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
           .\target\${{ matrix.target }}\release\jacs.exe --version
-          .\target\${{ matrix.target }}\release\jacs-mcp.exe --help | Out-Null
 
       - name: Package (Unix)
         if: runner.os != 'Windows'
         run: |
           cp target/${{ matrix.target }}/release/jacs jacs-cli
-          cp target/${{ matrix.target }}/release/jacs-mcp jacs-mcp
           tar czf ${CLI_ASSET_NAME}.tar.gz jacs-cli
-          tar czf ${MCP_ASSET_NAME}.tar.gz jacs-mcp
           shasum -a 256 ${CLI_ASSET_NAME}.tar.gz > ${CLI_ASSET_NAME}.tar.gz.sha256
-          shasum -a 256 ${MCP_ASSET_NAME}.tar.gz > ${MCP_ASSET_NAME}.tar.gz.sha256
 
       - name: Package (Windows)
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
           Copy-Item "target/${{ matrix.target }}/release/jacs.exe" "jacs-cli.exe"
-          Copy-Item "target/${{ matrix.target }}/release/jacs-mcp.exe" "jacs-mcp.exe"
           Compress-Archive -Path "jacs-cli.exe" -DestinationPath "${env:CLI_ASSET_NAME}.zip"
-          Compress-Archive -Path "jacs-mcp.exe" -DestinationPath "${env:MCP_ASSET_NAME}.zip"
           Get-FileHash "${env:CLI_ASSET_NAME}.zip" -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  ${env:CLI_ASSET_NAME}.zip" } | Out-File "${env:CLI_ASSET_NAME}.zip.sha256" -Encoding ascii
-          Get-FileHash "${env:MCP_ASSET_NAME}.zip" -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  ${env:MCP_ASSET_NAME}.zip" } | Out-File "${env:MCP_ASSET_NAME}.zip.sha256" -Encoding ascii
 
       - uses: actions/upload-artifact@v4
         with:
           name: binaries-${{ matrix.asset_suffix }}
           path: |
             ${{ env.CLI_ASSET_NAME }}.*
-            ${{ env.MCP_ASSET_NAME }}.*
 
   release:
     needs: [verify-version, build]
@@ -199,31 +186,31 @@ jobs:
           body: |
             ## JACS CLI v${{ needs.verify-version.outputs.version }}
 
-            Prebuilt binaries for:
-            - `jacs` (CLI)
-            - `jacs-mcp` (MCP server)
+            Unified `jacs` binary with CLI + built-in MCP server.
 
             ### Install
 
-            Download the binary for your platform, extract, and add to your PATH:
+            **From crates.io:**
+            ```bash
+            cargo install jacs-cli
+            ```
 
+            **From prebuilt binary:**
             ```bash
             # macOS (Apple Silicon)
             curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-darwin-arm64.tar.gz
             tar xzf jacs-cli-*.tar.gz
-            sudo mv jacs-cli /usr/local/bin/
+            sudo mv jacs-cli /usr/local/bin/jacs
 
             # Linux (x86_64)
             curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-linux-x64.tar.gz
             tar xzf jacs-cli-*.tar.gz
-            sudo mv jacs-cli /usr/local/bin/
+            sudo mv jacs-cli /usr/local/bin/jacs
             ```
 
-            Install MCP directly from the CLI (uses these platform assets by default):
-
+            **Start MCP server (stdio):**
             ```bash
-            jacs mcp install
-            jacs mcp run
+            jacs mcp
             ```
 
             ### Verify checksums

.github/workflows/release-crate.yml

@@ -22,18 +22,18 @@ jobs:
           TAG="${GITHUB_REF#refs/tags/crate/v}"
           echo "version=$TAG" >> $GITHUB_OUTPUT
 
-      - name: Check Cargo.toml version matches tag (jacs + jacs-mcp)
+      - name: Check Cargo.toml version matches tag (jacs + jacs-mcp + jacs-cli)
         run: |
           TAG_VERSION="${{ steps.extract.outputs.version }}"
-          for dir in jacs jacs-mcp; do
+          for dir in jacs jacs-mcp jacs-cli; do
             CARGO_VERSION=$(grep '^version = ' $dir/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
             echo "$dir Cargo version: $CARGO_VERSION, tag: $TAG_VERSION"
             if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
               echo "::error::Version mismatch! $dir/Cargo.toml has $CARGO_VERSION but tag is $TAG_VERSION"
               exit 1
             fi
           done
-          echo "Version match confirmed for jacs and jacs-mcp"
+          echo "Version match confirmed for jacs, jacs-mcp, and jacs-cli"
 
   publish:
     needs: verify-version
@@ -51,3 +51,8 @@ jobs:
         working-directory: jacs-mcp
         continue-on-error: true
         run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}
+
+      - name: Publish jacs-cli to crates.io
+        working-directory: jacs-cli
+        continue-on-error: true
+        run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}

.github/workflows/rust.yml

@@ -6,6 +6,8 @@ on:
     tags: ["v*"]
     paths:
       - "jacs/**"
+      - "jacs-cli/**"
+      - "jacs-mcp/**"
       - "binding-core/**"
       - "Cargo.toml"
       - "Cargo.lock"
@@ -14,6 +16,8 @@ on:
     branches: ["main"]
     paths:
       - "jacs/**"
+      - "jacs-cli/**"
+      - "jacs-mcp/**"
       - "binding-core/**"
       - "Cargo.toml"
       - "Cargo.lock"
@@ -56,11 +60,13 @@ jobs:
 
       - name: Run quick Rust test suite
         run: |
-          cargo test -p jacs --verbose --lib --features cli
+          cargo test -p jacs --verbose --lib
           cargo test -p jacs --verbose --test pq2025_tests
           cargo test -p jacs --verbose --test cross_language_tests
           cargo test -p jacs --verbose --test structured_logging_tests
           cargo test -p jacs-binding-core --verbose
+          cargo build -p jacs-cli
+          cargo test -p jacs-mcp --verbose
 
   full-jacs-release:
     name: Full jacs suite (${{ matrix.os }})
@@ -90,8 +96,11 @@ jobs:
 
       - name: Run full jacs tests
         run: |
-          cargo test -p jacs --verbose --features cli
+          cargo test -p jacs --verbose
           cargo test -p jacs-binding-core --verbose
+          cargo build -p jacs-cli
+          cargo test -p jacs-mcp --verbose
+          cargo test -p jacs-cli --verbose
 
   full-jacs-nightly:
     name: Full jacs suite (nightly ubuntu)
@@ -114,5 +123,8 @@ jobs:
 
       - name: Run nightly full Rust tests
         run: |
-          cargo test -p jacs --verbose --features cli
+          cargo test -p jacs --verbose
           cargo test -p jacs-binding-core --verbose
+          cargo build -p jacs-cli
+          cargo test -p jacs-mcp --verbose
+          cargo test -p jacs-cli --verbose

jacs-cli/Cargo.toml

@@ -17,8 +17,9 @@ name = "jacs"
 path = "src/main.rs"
 
 [features]
-default = ["mcp"]
+default = ["mcp", "attestation"]
 mcp = ["dep:jacs-mcp"]
+attestation = ["jacs/attestation"]
 
 [dependencies]
 jacs = { path = "../jacs" }

jacs-cli/src/main.rs

@@ -19,7 +19,7 @@ use jacs::{load_agent, load_agent_with_dns_policy};
 use rpassword::read_password;
 use std::env;
 use std::error::Error;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process;
 
 const CLI_PASSWORD_FILE_ENV: &str = "JACS_PASSWORD_FILE";
@@ -693,7 +693,17 @@ pub fn main() -> Result<(), Box<dyn Error>> {
         )
         .subcommand(
             Command::new("mcp")
-                .about("Start the built-in JACS MCP server (stdio transport)"),
+                .about("Start the built-in JACS MCP server (stdio transport)")
+                .subcommand(
+                    Command::new("install")
+                        .about("Deprecated: MCP is now built into the jacs binary")
+                        .hide(true)
+                )
+                .subcommand(
+                    Command::new("run")
+                        .about("Deprecated: use `jacs mcp` directly")
+                        .hide(true)
+                ),
         )
         .subcommand(
             Command::new("a2a")
@@ -1260,7 +1270,7 @@ pub fn main() -> Result<(), Box<dyn Error>> {
                 let filename = create_matches.get_one::<String>("filename");
                 let outputfilename = create_matches.get_one::<String>("output");
                 let directory = create_matches.get_one::<String>("directory");
-                let verbose = *create_matches.get_one::<bool>("verbose").unwrap_or(&false);
+                let _verbose = *create_matches.get_one::<bool>("verbose").unwrap_or(&false);
                 let no_save = *create_matches.get_one::<bool>("no-save").unwrap_or(&false);
                 let agentfile = create_matches.get_one::<String>("agent-file");
                 let schema = create_matches.get_one::<String>("schema");
@@ -1271,8 +1281,8 @@ pub fn main() -> Result<(), Box<dyn Error>> {
 
                 let mut agent: Agent = load_agent(agentfile.cloned()).expect("REASON");
 
-                let attachment_links = agent.parse_attachement_arg(attachments);
-                create_documents(
+                let _attachment_links = agent.parse_attachement_arg(attachments);
+                let _ = create_documents(
                     &mut agent,
                     filename,
                     directory,
@@ -1289,7 +1299,7 @@ pub fn main() -> Result<(), Box<dyn Error>> {
                 let new_filename = create_matches.get_one::<String>("new").unwrap();
                 let original_filename = create_matches.get_one::<String>("filename").unwrap();
                 let outputfilename = create_matches.get_one::<String>("output");
-                let verbose = *create_matches.get_one::<bool>("verbose").unwrap_or(&false);
+                let _verbose = *create_matches.get_one::<bool>("verbose").unwrap_or(&false);
                 let no_save = *create_matches.get_one::<bool>("no-save").unwrap_or(&false);
                 let agentfile = create_matches.get_one::<String>("agent-file");
                 let schema = create_matches.get_one::<String>("schema");
@@ -1319,7 +1329,7 @@ pub fn main() -> Result<(), Box<dyn Error>> {
                 let agentfile = create_matches.get_one::<String>("agent-file");
                 let mut agent: Agent = load_agent(agentfile.cloned()).expect("REASON");
                 let schema = create_matches.get_one::<String>("schema");
-                let no_save = *create_matches.get_one::<bool>("no-save").unwrap_or(&false);
+                let _no_save = *create_matches.get_one::<bool>("no-save").unwrap_or(&false);
 
                 // Use updated set_file_list with storage
                 sign_documents(&mut agent, schema, filename, directory)?;
@@ -1332,7 +1342,7 @@ pub fn main() -> Result<(), Box<dyn Error>> {
                 let schema = create_matches.get_one::<String>("schema");
 
                 // Use updated set_file_list with storage
-                let files: Vec<String> = default_set_file_list(filename, directory, None)
+                let _files: Vec<String> = default_set_file_list(filename, directory, None)
                     .expect("Failed to determine file list");
                 check_agreement(&mut agent, schema, filename, directory)?;
             }
@@ -1352,13 +1362,13 @@ pub fn main() -> Result<(), Box<dyn Error>> {
 
                 let mut agent: Agent = load_agent(agentfile.cloned()).expect("REASON");
                 // Use updated set_file_list with storage
-                create_agreement(&mut agent, agentids, filename, schema, no_save, directory);
+                let _ = create_agreement(&mut agent, agentids, filename, schema, no_save, directory);
             }
 
             Some(("verify", verify_matches)) => {
                 let filename = verify_matches.get_one::<String>("filename");
                 let directory = verify_matches.get_one::<String>("directory");
-                let verbose = *verify_matches.get_one::<bool>("verbose").unwrap_or(&false);
+                let _verbose = *verify_matches.get_one::<bool>("verbose").unwrap_or(&false);
                 let agentfile = verify_matches.get_one::<String>("agent-file");
                 let mut agent: Agent = load_agent(agentfile.cloned()).expect("REASON");
                 let schema = verify_matches.get_one::<String>("schema");
@@ -1369,12 +1379,12 @@ pub fn main() -> Result<(), Box<dyn Error>> {
             Some(("extract", extract_matches)) => {
                 let filename = extract_matches.get_one::<String>("filename");
                 let directory = extract_matches.get_one::<String>("directory");
-                let verbose = *extract_matches.get_one::<bool>("verbose").unwrap_or(&false);
+                let _verbose = *extract_matches.get_one::<bool>("verbose").unwrap_or(&false);
                 let agentfile = extract_matches.get_one::<String>("agent-file");
                 let mut agent: Agent = load_agent(agentfile.cloned()).expect("REASON");
                 let schema = extract_matches.get_one::<String>("schema");
                 // Use updated set_file_list with storage
-                let files: Vec<String> = default_set_file_list(filename, directory, None)
+                let _files: Vec<String> = default_set_file_list(filename, directory, None)
                     .expect("Failed to determine file list");
                 // extract the contents but do not save
                 extract_documents(&mut agent, schema, filename, directory)?;
@@ -1448,11 +1458,25 @@ pub fn main() -> Result<(), Box<dyn Error>> {
             _ => println!("please enter subcommand see jacs key --help"),
         },
         #[cfg(feature = "mcp")]
-        Some(("mcp", _mcp_matches)) => {
-            let agent = jacs_mcp::load_agent_from_config_env()?;
-            let server = jacs_mcp::JacsMcpServer::new(agent);
-            let rt = tokio::runtime::Runtime::new()?;
-            rt.block_on(jacs_mcp::serve_stdio(server))?;
+        Some(("mcp", mcp_matches)) => {
+            match mcp_matches.subcommand() {
+                Some(("install", _)) => {
+                    eprintln!("`jacs mcp install` is no longer needed.");
+                    eprintln!("MCP is built into the jacs binary. Use `jacs mcp` to serve.");
+                    process::exit(0);
+                }
+                Some(("run", _)) => {
+                    eprintln!("`jacs mcp run` is no longer needed.");
+                    eprintln!("Use `jacs mcp` directly to start the MCP server.");
+                    process::exit(0);
+                }
+                _ => {
+                    let agent = jacs_mcp::load_agent_from_config_env()?;
+                    let server = jacs_mcp::JacsMcpServer::new(agent);
+                    let rt = tokio::runtime::Runtime::new()?;
+                    rt.block_on(jacs_mcp::serve_stdio(server))?;
+                }
+            }
         }
         #[cfg(not(feature = "mcp"))]
         Some(("mcp", _)) => {

jacs-mcp/Cargo.toml

@@ -15,7 +15,6 @@ categories = ["cryptography", "development-tools"]
 [features]
 default = ["mcp", "attestation"]
 mcp = ["dep:rmcp", "dep:tokio", "jacs/mcp-server"]
-http = []
 attestation = ["jacs/attestation", "jacs-binding-core/attestation"]
 
 [dependencies]

jacs-mcp/contract/jacs-mcp-contract.json

@@ -3,7 +3,7 @@
   "server": {
     "name": "jacs-mcp",
     "title": "JACS MCP Server",
-    "version": "0.9.0",
+    "version": "0.9.1",
     "website_url": "https://humanassisted.github.io/JACS/",
     "instructions": "This MCP server provides data provenance and cryptographic signing for agent state files and agent-to-agent messaging. Agent state tools: jacs_sign_state (sign files), jacs_verify_state (verify integrity), jacs_load_state (load with verification), jacs_update_state (update and re-sign), jacs_list_state (list signed docs), jacs_adopt_state (adopt external files). Messaging tools: jacs_message_send (create and sign a message), jacs_message_update (update and re-sign a message), jacs_message_agree (co-sign/agree to a message), jacs_message_receive (verify and extract a received message). Agent management: jacs_create_agent (create new agent with keys), jacs_reencrypt_key (rotate private key password). A2A artifacts: jacs_wrap_a2a_artifact (sign artifact with provenance), jacs_verify_a2a_artifact (verify wrapped artifact), jacs_assess_a2a_agent (assess remote agent trust level). A2A discovery: jacs_export_agent_card (export Agent Card), jacs_generate_well_known (generate .well-known documents), jacs_export_agent (export full agent JSON). Trust store: jacs_trust_agent (add agent to trust store), jacs_untrust_agent (remove from trust store, requires JACS_MCP_ALLOW_UNTRUST=true), jacs_list_trusted_agents (list all trusted agent IDs), jacs_is_trusted (check if agent is trusted), jacs_get_trusted_agent (get trusted agent JSON). Attestation: jacs_attest_create (create signed attestation with claims), jacs_attest_verify (verify attestation, optionally with evidence checks), jacs_attest_lift (lift signed document into attestation), jacs_attest_export_dsse (export attestation as DSSE envelope). Security: jacs_audit (read-only security audit and health checks)."
   },