Add support to publish servers as MCP Bundles by vcolin7 · Pull Request #1681 · microsoft/mcp

vcolin7 · 2026-02-09T20:36:58Z

What does this PR do?

This PR implements end-to-end MCPB (MCP Bundle) packaging and signing infrastructure using Microsoft's ESRP (Enterprise Signing and Release Pipeline) service. MCPB is a standardized bundle format for distributing MCP servers, similar to Chrome extensions (.crx) or VS Code extensions (.vsix).

Documentation

Added comprehensive design documentation for MCPB signing via ESRP (mcpb-signing-via-esrp.md)
Updated eng/README to include MCPB

PowerShell Scripts

Added:
- Pack-Mcpb.ps1 - Packages trimmed and self-contained server binaries into MCPB format
- Stage-McpbForSigning.ps1 - Prepares MCPB files for ESRP signing
- Apply-McpbSignatures.ps1 - Applies ESRP detached signatures to MCPB files
- Verify-McpbSignatures.ps1 - Validates MCPB signatures
- Update-ServerJsonMcpbHashes.ps1 - Updates server.json with MCPB hashes
Updated:
- New-ServerJson.ps1 - Added entries for MCPB files

Pipeline Templates

Added:
- pack-and-sign-mcpb.yml - Main packaging and signing job
- release-mcpb.yml - Release MCPB files to GitHub releases
Updated:
- common.yml
- release.yml
- sign-and-pack.yml
- update-mcp-repository.yml
- Each server's build.yml
- 1es-reditect - Fixed issue with Go package downloads. Module downloads now go through Microsoft's internal proxy server instead of going directly to the public internet (proxy.golang.org).

Server Manifests

Added a manifest.json for all servers. These files serve as a base that gets updated during release to include the most recent server metadata (version, tools, etc.).
Updated server.json for Azure and Template servers to list MCP Bundles in the official MCP registry.

Testing

MCPB packaging produces valid bundles for all servers
ESRP signing workflow completes successfully
mcpb verify validates signed bundles
GitHub release includes signed MCPB files
Official MCP Registry shows MCPB entries for Template MCP Server

GitHub issue number?

Fixes: #128

Pre-merge Checklist

…ning

…nd update .NET SDK usage

Copilot

Pull request overview

This PR introduces end-to-end infrastructure to package MCP servers as MCP Bundles (.mcpb), sign them via ESRP detached PKCS#7 signing, publish bundles to GitHub Releases, and surface MCPB entries in server.json (including SHA256 hash updates during publishing).

Changes:

Added MCPB packaging/signing PowerShell scripts and new pipeline job templates to pack, sign, verify, and publish .mcpb artifacts.
Added per-server MCPB manifests/icons and updated server registry metadata (server.json) to include MCPB package entries.
Added/updated documentation describing MCPB packaging/signing and updated engineering docs/pipeline parameters to support PackageMCPB.

Reviewed changes

Copilot reviewed 24 out of 28 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
servers/Template.Mcp.Server/server.json	Adds MCPB package entries (URLs + SHA placeholders) to registry metadata.
servers/Template.Mcp.Server/mcpb/servericon.png	Adds MCPB icon asset for Template server.
servers/Template.Mcp.Server/mcpb/manifest.json	Adds MCPB bundle manifest for Template server.
servers/Template.Mcp.Server/build.yml	Introduces `PackageMCPB` parameter wiring for Template pipeline.
servers/Fabric.Mcp.Server/mcpb/servericon.png	Adds MCPB icon asset for Fabric server.
servers/Fabric.Mcp.Server/mcpb/manifest.json	Adds MCPB bundle manifest for Fabric server.
servers/Fabric.Mcp.Server/build.yml	Introduces `PackageMCPB` parameter wiring for Fabric pipeline.
servers/Azure.Mcp.Server/server.json	Adds MCPB package entries (URLs + SHA placeholders) to registry metadata.
servers/Azure.Mcp.Server/mcpb/servericon.png	Adds MCPB icon asset for Azure server.
servers/Azure.Mcp.Server/mcpb/manifest.json	Adds MCPB bundle manifest for Azure server.
servers/Azure.Mcp.Server/changelog-entries/1770669516879.yaml	Adds changelog entry noting MCPB support.
servers/Azure.Mcp.Server/build.yml	Enables `PackageMCPB` by default for Azure pipeline.
eng/scripts/Verify-McpbSignatures.ps1	Adds MCPB signature verification script (mcpb info/verify).
eng/scripts/Update-ServerJsonMcpbHashes.ps1	Adds script to compute SHA256 for signed bundles and update `server.json`.
eng/scripts/Stage-McpbForSigning.ps1	Adds staging script for ESRP detached signing workflow.
eng/scripts/Pack-Mcpb.ps1	Adds packaging script to generate `.mcpb` bundles from trimmed binaries + manifests.
eng/scripts/New-ServerJson.ps1	Updates server.json generation to populate MCPB download URLs.
eng/scripts/Apply-McpbSignatures.ps1	Adds script to embed detached PKCS#7 signatures into MCPB format.
eng/pipelines/templates/jobs/update-mcp-repository.yml	Updates MCP repository publish job to apply MCPB SHA256 hashes.
eng/pipelines/templates/jobs/sign-and-pack.yml	Adds `PackageMCPB` parameter and MCPB pack/sign job inclusion.
eng/pipelines/templates/jobs/release.yml	Adds MCPB publishing job and wires MCPB into release flow.
eng/pipelines/templates/jobs/mcpb/release-mcpb.yml	Adds job template to upload signed `.mcpb` assets to GitHub Releases.
eng/pipelines/templates/jobs/mcpb/pack-and-sign-mcpb.yml	Adds job template to pack, ESRP-sign, apply signatures, and verify MCPB bundles.
eng/pipelines/templates/common.yml	Plumbs `PackageMCPB` parameter through common pipeline template.
eng/pipelines/templates/1es-redirect.yml	Enables 1ES golang internal module proxy feature flag.
eng/README.md	Documents MCPB artifact type and related scripts/pipelines.
docs/design/mcpb-packaging-and-signing-via-esrp.md	Adds detailed design document for MCPB packaging/signing via ESRP.
.gitignore	Ignores `.vscode/settings.json`.

eng/scripts/Verify-McpbSignatures.ps1

eng/pipelines/templates/jobs/mcpb/pack-and-sign-mcpb.yml

docs/design/mcpb-packaging-and-signing-via-esrp.md

eng/pipelines/templates/jobs/mcpb/pack-and-sign-mcpb.yml

eng/pipelines/templates/jobs/release.yml

eng/pipelines/templates/jobs/update-mcp-repository.yml

eng/scripts/Apply-McpbSignatures.ps1

docs/design/mcpb-packaging-and-signing-via-esrp.md

eng/README.md

…ning

eng/pipelines/templates/jobs/mcpb/release-mcpb.yml

hallipr · 2026-02-11T07:50:00Z

eng/pipelines/templates/jobs/release.yml

@@ -83,9 +91,12 @@ jobs:
 - template: /eng/pipelines/templates/jobs/update-mcp-repository.yml


How does update-mcp-repository know if it needs to update a docker entry without a PackageDocker parameter?

By default, it assumes we ship them all at the same time; that there aren't partial updates to our public releases. We would have to modify the script if we are expecting partial updates.

I think we can address this in a separate PR.

I meant that more as, why don't we just do what docker does without a parameter. Is the parameter needed? Will there be a server that doesn't do mcpb?

When talking to Connie last week she mentioned not wanting to push other servers onto all platforms by default and letting them choose. I'm ok with enabling releases for everyone everywhere, but I'm willing to change my mind. What do you think?

Let's go with optional while also making the deployment story consistent. If we want to stick with optional targets per server, we should probably make all the targets optional (and those should be hard-coded template parameters instead of pipeline run parameters).

Issue added: #1769

eng/scripts/Apply-McpbSignatures.ps1

hallipr · 2026-02-11T08:35:25Z

servers/Azure.Mcp.Server/mcpb/servericon.png

We already have a server icon in each server directory and we refer to it in each server's csproj. New-BuildInfo is responsible for ensuring that the csproj relative path is converted to a repo-root relative path in buildInfo.json.

The packaging manifests refer to the image in a static location and the packaging scripts use the server's imagePath property to copy the server image into that location:

https://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/images/azureicon.png

vscode/package.json

"icon": "resources/package-icon.png",

Pack-Vsix.ps1

Write-Host "Copying server icon from $($server.packageIcon) to $tempPath/resources/package-icon.png" New-Item -Path "$tempPath/resources" -ItemType Directory -Force | Out-Null Copy-Item -Path "$RepoRoot/$($server.packageIcon)" -Destination "$tempPath/resources/package-icon.png" -Force

eng/scripts/Apply-McpbSignatures.ps1

eng/scripts/New-ServerJson.ps1

eng/scripts/Pack-Mcpb.ps1

eng/scripts/Update-ServerJsonMcpbHashes.ps1

eng/scripts/Apply-McpbSignatures.ps1

eng/scripts/New-ServerJson.ps1

…ure and Template servers

eng/pipelines/templates/jobs/mcpb/pack-and-sign-mcpb.yml

eng/scripts/Pack-Mcpb.ps1

…I version

vcolin7 and others added 30 commits January 30, 2026 17:04

Testing MCPB detached signing with ESRP

3e246c8

Updated signing config

19795f8

Updated the pipeline to attach signature to .mcpb file and verify

47e79df

Fixed file extension

aaf14eb

Created design document

0156975

Created script to pack MCP bundles and updated docs

99144c8

Removed test .mcpb file

c56a49e

Updated packing scrip to update server version on manifest

43584e6

Reverted changes to common.yml

148035f

Merge remote-tracking branch 'origin/main' into vcolin7/test-mcpb-sig…

521d8b6

…ning

Created other scripts to be used with ESRP signing

031e321

Added unit tests

d59cea7

Implemented phase 2

208ed17

Implemented phase 3

32d1ec9

Updated docs

eac7151

Added a manifest.json and server icon for the Template server

276f157

Added a manifest.json and server icon for the Fabric MCP server

ca7e26c

Updated manifests for all server

64c33ed

Updated eng docs and build.yml

9366573

Updated .gitignore

af12ac1

Updated release-mcpb.yml to use inline PowerShell

3fa7430

Updated docs

1dcf16d

Refactor MCPB packaging pipeline: remove Windows pool specification a…

90237ea

…nd update .NET SDK usage

Updated docs to clarify the correct signature format

1ea8554

Attempt to fix .NET version issue with mcpb CLI

bead9f1

Trying to fix issue with applying signature

1b35de3

Added MCBP flag to Fabric build.yml

c4d86b0

Fix uploading MCPB files to GH release.

8fe1f23

Add internalModuleProxy feature flag for golang in 1es-redirect.yml

8ba81b9

Removed old test artifacts

443403f

vcolin7 requested review from KarishmaGhiya, alzimmermsft, msalaman, sandeep-sen, weshaggard and xiangyan99 February 9, 2026 21:24

Copilot started reviewing on behalf of vcolin7 February 9, 2026 21:25 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

vcolin7 added 5 commits February 9, 2026 16:22

Applied Copilot feedback

e0a2dbf

Merge remote-tracking branch 'origin/main' into vcolin7/test-mcpb-sig…

3650222

…ning

Updated version in Azure MCP Server manifest

85c4c10

Fixed broken links

e1c2c8a

Actually fixed broken links

d61b3d0

hallipr reviewed Feb 11, 2026

View reviewed changes

eng/pipelines/templates/jobs/mcpb/release-mcpb.yml Show resolved Hide resolved

hallipr reviewed Feb 11, 2026

View reviewed changes

eng/scripts/Apply-McpbSignatures.ps1 Outdated Show resolved Hide resolved

hallipr reviewed Feb 11, 2026

View reviewed changes

conniey reviewed Feb 11, 2026

View reviewed changes

eng/scripts/Apply-McpbSignatures.ps1 Outdated Show resolved Hide resolved

conniey reviewed Feb 11, 2026

View reviewed changes

eng/scripts/New-ServerJson.ps1 Outdated Show resolved Hide resolved

eng/scripts/Pack-Mcpb.ps1 Outdated Show resolved Hide resolved

eng/scripts/Update-ServerJsonMcpbHashes.ps1 Outdated Show resolved Hide resolved

conniey reviewed Feb 11, 2026

View reviewed changes

eng/scripts/Apply-McpbSignatures.ps1 Outdated Show resolved Hide resolved

conniey reviewed Feb 11, 2026

View reviewed changes

eng/scripts/New-ServerJson.ps1 Outdated Show resolved Hide resolved

vcolin7 added 3 commits February 17, 2026 16:40

Applied some PR feedback

e0dc5e4

Modified scripts to use build_info.json files for mapping MCPB builds

3fb4aba

Polished up server.json approach and updated .csproj files for the Az…

ee1ba24

…ure and Template servers

hallipr reviewed Feb 18, 2026

View reviewed changes

eng/pipelines/templates/jobs/mcpb/pack-and-sign-mcpb.yml Outdated Show resolved Hide resolved

hallipr reviewed Feb 18, 2026

View reviewed changes

eng/scripts/Pack-Mcpb.ps1 Outdated Show resolved Hide resolved

vcolin7 added 3 commits February 18, 2026 17:13

Removed unnecessary server icons

eba3dc0

Removed other usages of Write-Host in favor of using LogInfo

f08787a

Added a centralized .config/dotnet-tools.json file to pin the mcpb CL…

8b58af0

…I version

hallipr approved these changes Feb 19, 2026

View reviewed changes

		@@ -83,9 +91,12 @@ jobs:
		- template: /eng/pipelines/templates/jobs/update-mcp-repository.yml

Conversation

vcolin7 commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Documentation

PowerShell Scripts

Pipeline Templates

Server Manifests

Testing

GitHub issue number?

Pre-merge Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

vcolin7 commented Feb 9, 2026 •

edited

Loading