feat(release): add MCPB bundle packaging to release pipeline

- package-mcpb CI job: pack, sign, verify, attest, upload
- just mcpb recipe for local bundle builds
- .gitignore: add server/ and *.mcpb, allow certs/*.pem
- docs: MCPB install instructions in MCP.md and PACKAGE-MANAGERS.md

Author: zircote

.github/workflows/release.yml

@@ -303,3 +303,92 @@ jobs:
         with:
           name: ${{ matrix.asset_name }}
           path: ${{ matrix.asset_name }}
+
+  package-mcpb:
+    name: Package MCPB Bundle
+    needs: [create-release, build-binaries]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        # yamllint disable-line rule:line-length
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v6.0.2
+
+      - name: Setup Node.js
+        # yamllint disable-line rule:line-length
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a  # v4.2.0
+        with:
+          node-version: "22"
+
+      - name: Install mcpb CLI
+        run: npm install -g @anthropic-ai/mcpb
+
+      - name: Download platform binaries
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p server
+          gh release download "${{ github.ref_name }}" \
+            --pattern "nsip-linux-amd64" \
+            --pattern "nsip-linux-arm64" \
+            --pattern "nsip-macos-amd64" \
+            --pattern "nsip-macos-arm64" \
+            --pattern "nsip-windows-amd64.exe" \
+            --dir server
+
+      - name: Set binary permissions
+        run: chmod +x server/nsip-*
+
+      - name: Inject version into manifest
+        env:
+          VERSION: >-
+            ${{ needs.create-release.outputs.version }}
+        run: >-
+          sed -i
+          "s/\"version\": \".*\"/\"version\": \"${VERSION}\"/"
+          manifest.json
+
+      - name: Validate manifest
+        run: mcpb validate .
+
+      - name: Pack bundle
+        run: mcpb pack . --output nsip.mcpb
+
+      - name: Sign bundle
+        env:
+          MCPB_SIGNING_KEY: ${{ secrets.MCPB_SIGNING_KEY }}
+        run: |
+          echo "$MCPB_SIGNING_KEY" > /tmp/signing-key.pem
+          mcpb sign nsip.mcpb \
+            --cert certs/mcpb-signing.pem \
+            --key /tmp/signing-key.pem
+          rm -f /tmp/signing-key.pem
+
+      - name: Verify signature
+        run: mcpb verify nsip.mcpb
+
+      - name: Inspect bundle
+        run: mcpb info nsip.mcpb
+
+      - name: Attest bundle provenance
+        id: attest_mcpb
+        # yamllint disable-line rule:line-length
+        uses: actions/attest-build-provenance@62fc1d596301d0ab9914e1fec14dc5c8d93f65cd  # v3.2.0
+        with:
+          subject-path: nsip.mcpb
+
+      - name: Rename attestation bundle
+        env:
+          MCPB_BUNDLE: >-
+            ${{ steps.attest_mcpb.outputs.bundle-path }}
+        run: >-
+          cp "$MCPB_BUNDLE"
+          nsip.mcpb.sigstore.json
+
+      - name: Upload to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${{ github.ref_name }}" \
+            nsip.mcpb \
+            nsip.mcpb.sigstore.json \
+            --clobber

.gitignore

@@ -77,6 +77,7 @@ Desktop.ini
 secrets/
 credentials/
 *.pem
+!certs/*.pem
 *.key
 
 # Temporary files
@@ -110,3 +111,7 @@ junit.xml
 # Generated CLI artifacts
 completions/
 man/
+
+# MCPB staging
+server/
+*.mcpb

docs/MCP.md

@@ -48,6 +48,16 @@ Pre-built binaries are available from [GitHub Releases](https://github.com/zirco
 | macOS ARM64    | `nsip-macos-arm64`        |
 | Windows x86_64 | `nsip-windows-amd64.exe`  |
 
+### MCP Bundle (Claude Desktop / Claude Code)
+
+Download the universal `nsip.mcpb` bundle from [GitHub Releases](https://github.com/zircote/nsip/releases). It contains all platforms in a single file.
+
+**Claude Desktop:** Drag `nsip.mcpb` into Settings > Extensions, or double-click it.
+
+**Claude Code:** Install via the extensions UI.
+
+The bundle auto-selects the correct binary for your platform (macOS ARM64, Linux x86_64, Windows x86_64).
+
 ### Docker
 
 ```bash

docs/distribution/PACKAGE-MANAGERS.md

@@ -92,6 +92,27 @@ msiexec /i nsip-0.1.0-x64.msi /quiet
 
 **Install Location:** `C:\Program Files\nsip\`
 
+### MCP Bundle (.mcpb)
+
+```bash
+# Download from releases
+curl -LO https://github.com/zircote/nsip/releases/latest/download/nsip.mcpb
+
+# Install in Claude Desktop: drag into Settings > Extensions
+# Verify integrity:
+gh attestation verify nsip.mcpb --repo zircote/nsip
+```
+
+**Workflow:** `.github/workflows/release.yml` (package-mcpb job)
+
+**Bundle Contents:**
+- `manifest.json` - MCPB v0.3 manifest with tool/prompt declarations
+- `server/nsip-linux-amd64` - Linux x86_64 binary
+- `server/nsip-linux-arm64` - Linux ARM64 binary
+- `server/nsip-macos-amd64` - macOS x86_64 binary
+- `server/nsip-macos-arm64` - macOS ARM64 binary
+- `server/nsip-windows-amd64.exe` - Windows x86_64 binary
+
 ## Configuration
 
 ### Debian Package Metadata

justfile

@@ -130,6 +130,18 @@ publish-dry:
 changelog:
     git-cliff --latest --strip header
 
+# Build MCPB bundle locally (requires: npm i -g @anthropic-ai/mcpb)
+mcpb: build-release
+    @mkdir -p server
+    @cp target/release/nsip server/nsip-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/arm64/arm64/;s/aarch64/arm64/;s/x86_64/amd64/') 2>/dev/null || true
+    mcpb validate .
+    mcpb pack . --output nsip.mcpb
+    mcpb sign nsip.mcpb --self-signed || true
+    mcpb verify nsip.mcpb
+    mcpb info nsip.mcpb
+    @echo "Bundle created: nsip.mcpb"
+    @rm -rf server
+
 # === Shell Completions & Man Pages ===
 
 # Generate shell completions for all supported shells