feat(mcp): universal cross-client launcher + OSS distribution prep

Code-Intelligence is launching as public OSS, not staying an internal
dev-tool, so the "ci" MCP server needs to work the same way regardless
of which agent/IDE spawns it, and the release/distribution story needs
to actually be complete rather than partially wired.

- scripts/mcp-launcher.sh: single launcher shared by Claude Code
  (.mcp.json), Cursor (.cursor/mcp.json), and VS Code (.vscode/mcp.json).
  Resolves in order: cached/local binary -> SHA256-verified GitHub
  Release download (Linux only, only when HEAD is exactly a released
  git tag, never guesses "latest") -> cargo build from source. A failed
  or corrupted download never gets executed but always falls back to
  building from source instead of dead-ending.
- fix release.yml: the musl cross-build passed bare
  --no-default-features, which silently dropped the tier0-5 language
  grammars along with the intended embeddings feature; now scoped to
  --features tier0-5. Also adds SHA256SUMS generation and a GHCR
  Docker-image-publish job.
- add root LICENSE (MIT) and `ci --version` (clap `version` attribute)
  so the launcher can sanity-check a downloaded binary's version.
- docs/mcp-client-setup.md documents the launcher's resolution tiers
  and the Windsurf/JetBrains manual-paste snippets (global-only config,
  can't be checked into the repo).
- retire .claude/hooks/ci-mcp-entrypoint.sh (Claude-only, superseded by
  the universal launcher's build-from-source tier).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

.claude/hooks/ci-mcp-entrypoint.sh

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "ci": {
+      "command": "bash",
+      "args": ["scripts/mcp-launcher.sh"]
+    }
+  }
+}

.cursor/mcp.json

@@ -43,7 +43,7 @@ jobs:
 
       - name: Build (cross)
         if: matrix.cross
-        run: cross build --release --bin ci --target ${{ matrix.target }} --no-default-features
+        run: cross build --release --bin ci --target ${{ matrix.target }} --no-default-features --features tier0-5
 
       - name: Build (native)
         if: ${{ !matrix.cross }}
@@ -70,8 +70,43 @@ jobs:
           path: dist
           merge-multiple: true
 
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum ci-*.tar.gz > SHA256SUMS
+
       - name: Publish release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
-          files: dist/*.tar.gz
+          files: |
+            dist/*.tar.gz
+            dist/SHA256SUMS
           generate_release_notes: true
+
+  docker:
+    name: Publish container image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve image tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: Containerfile
+          push: true
+          tags: |
+            ghcr.io/eilodon/code-intelligence:${{ steps.version.outputs.version }}
+            ghcr.io/eilodon/code-intelligence:latest

.github/workflows/release.yml

@@ -27,7 +27,8 @@ __pycache__/
 # OS / editor
 .DS_Store
 Thumbs.db
-.vscode/
+.vscode/*
+!.vscode/mcp.json
 .idea/
 *.swp
 *.swo

.gitignore

@@ -18,7 +18,7 @@
     "ci": {
       "type": "stdio",
       "command": "bash",
-      "args": [".claude/hooks/ci-mcp-entrypoint.sh"],
+      "args": ["scripts/mcp-launcher.sh"],
       "env": {}
     }
   }

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "servers": {
+    "ci": {
+      "command": "bash",
+      "args": ["scripts/mcp-launcher.sh"]
+    }
+  }
+}

.vscode/mcp.json

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eilodon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

LICENSE

@@ -32,19 +32,14 @@ ci index --project-root .
 ci serve --project-root .
 ```
 
-Tích hợp vào MCP client (ví dụ Claude Code) qua `.mcp.json`:
-
-```json
-{
-  "mcpServers": {
-    "ci": {
-      "type": "stdio",
-      "command": "ci",
-      "args": ["serve", "--project-root", "."]
-    }
-  }
-}
-```
+Repo đã có sẵn config cho Claude Code (`.mcp.json`), Cursor (`.cursor/mcp.json`)
+và VS Code (`.vscode/mcp.json`) — cả ba đều trỏ vào `scripts/mcp-launcher.sh`,
+một launcher dùng chung: tự tìm binary đã build/cache, tải bản prebuilt đã
+verify checksum nếu đang ở đúng git tag, hoặc build từ source nếu không có
+gì sẵn — clone repo về là chạy được ngay, không cần build tay bước 1 ở trên
+trước. Xem [`docs/mcp-client-setup.md`](docs/mcp-client-setup.md) để biết
+cách dùng với Windsurf/JetBrains (config toàn cục, không check-in vào repo
+được) và chi tiết cách launcher hoạt động.
 
 > **Lưu ý**: `ci serve` tự động thêm `.codeindex/` vào `.gitignore` khi khởi động để tránh
 > commit DB vào repo.
@@ -194,8 +189,13 @@ reason = "core không được phụ thuộc server layer"
 ## Deployment
 
 - `cargo build --release` → binary tĩnh musl qua `.github/workflows/release.yml`, matrix:
-  `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl`, `aarch64-apple-darwin`.
-- `Containerfile` multi-stage (`rust:alpine` → `scratch`), image ~10MB.
+  `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl` (kèm `SHA256SUMS`),
+  `aarch64-apple-darwin`. `scripts/mcp-launcher.sh` tự tải + verify checksum bản
+  đúng platform khi checkout đang ở đúng git tag — xem
+  [`docs/mcp-client-setup.md`](docs/mcp-client-setup.md).
+- `Containerfile` multi-stage (`rust:alpine` → `scratch`), image ~10MB, publish
+  lên `ghcr.io/eilodon/code-intelligence` (tag theo version + `latest`) mỗi khi
+  push git tag.
 - `compose.yaml` mẫu hardened (`read_only`, `cap_drop: ALL`, `no-new-privileges`, `pids_limit: 64`,
   `mem_limit: 256m`).
 
@@ -216,4 +216,4 @@ Chi tiết resolver internals, ADR, migration plans nằm trong [`docs/`](docs/)
 
 ## License
 
-MIT
+[MIT](LICENSE)

README.md

@@ -6,7 +6,8 @@ use clap::{Parser, Subcommand};
 #[derive(Parser)]
 #[command(
     name = "ci",
-    about = "Code Intelligence — MCP server for codebase analysis"
+    about = "Code Intelligence — MCP server for codebase analysis",
+    version
 )]
 struct Cli {
     #[command(subcommand)]

crates/ci-cli/src/main.rs

@@ -68,7 +68,7 @@ This must build to the **same path** `.mcp.json` expects:
 benefit here, since this binary is a local dev/dogfood tool, not a
 distributed artifact; keep this in sync with
 `.claude/hooks/session-start-build-ci.sh` and
-`.claude/hooks/ci-mcp-entrypoint.sh` if that ever changes).
+`scripts/mcp-launcher.sh` if that ever changes).
 
 Keep it under Claude Code's ~5-minute Setup Script budget — 59s measured
 leaves a wide margin.
@@ -89,9 +89,11 @@ session before any cache exists, or right after the ~7-day cache expiry)
 
 ## What's already handled in this repo (defense in depth, not a substitute)
 
-- `.claude/hooks/ci-mcp-entrypoint.sh` — `.mcp.json`'s actual entrypoint
-  now. Execs the pre-built binary directly if present (no `cargo`
-  involved, no risk of an unexpected rebuild reopening this exact race);
+- `scripts/mcp-launcher.sh` — `.mcp.json`'s actual entrypoint now (shared
+  across every MCP client, not just Claude Code; see
+  `docs/mcp-client-setup.md`). Execs an already-cached binary directly if
+  present (no `cargo` involved, no risk of an unexpected rebuild reopening
+  this exact race);
   only builds inline if the binary is missing outright.
 - `.claude/hooks/session-start-build-ci.sh` — still runs every session.
   Redundant with the Setup Script in the common case (no-op if `target/`