Merge remote-tracking branch 'origin/main' into dev

# Conflicts:
#	mcp/pyproject.toml
#	mcp/uv.lock

Author: philderks

.github/workflows/deploy-website-on-release.yml

@@ -11,6 +11,8 @@ jobs:
   trigger-cloudflare-pages-deploy:
     name: Trigger Cloudflare Pages deploy hook
     runs-on: ubuntu-latest
+    # A skipped MCP-tagged Build & Release run is still a completed workflow.
+    # Guard its upstream tag independently so it cannot redeploy the panel site.
     if: ${{ (github.event.workflow_run.conclusion == 'success' && !startsWith(github.event.workflow_run.head_branch, 'mcp-v')) || github.event_name == 'workflow_dispatch' }}
     steps:
       - name: Validate deploy hook secret is configured

.github/workflows/mcp-tests.yml

@@ -0,0 +1,74 @@
+name: MCP package
+
+# Path-scoped so panel-only changes do not run it — with one deliberate
+# exception: backend/auth/buckets.py. That file IS the thing the drift test
+# watches, so a change to the panel's permission table has to trigger this
+# workflow or the check would only ever run when we happen to touch mcp/.
+on:
+  push:
+    paths:
+      - 'mcp/**'
+      - 'backend/auth/buckets.py'
+      - '.github/workflows/mcp-tests.yml'
+  pull_request:
+    paths:
+      - 'mcp/**'
+      - 'backend/auth/buckets.py'
+      - '.github/workflows/mcp-tests.yml'
+
+jobs:
+  # The gate. Runs the exact closure recorded in uv.lock, so a green tick here
+  # means "this commit works with the dependencies we committed".
+  locked:
+    name: locked closure (gate)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: mcp
+    env:
+      # Turns "panel source missing" from a skip into a failure, so the drift
+      # check can never quietly stop running here.
+      FABRICATOR_MCP_REQUIRE_PANEL: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install the locked closure
+        run: uv sync --frozen     # fails if uv.lock has drifted from pyproject.toml
+      - name: Run the suite
+        run: uv run pytest -q
+
+  # A warning, not a gate. Users do not install our lockfile: `uvx fabricator-panel-mcp`
+  # resolves the published dependency ranges fresh every time, so the closure a
+  # user gets is the one this job tests, not the one above. Without it the first
+  # report of an SDK regression would come from a user. It is allowed to fail:
+  # a broken upstream release must be visible without blocking a release that is
+  # otherwise fine.
+  unlocked:
+    name: unlocked closure (warning only)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    defaults:
+      run:
+        working-directory: mcp
+    env:
+      FABRICATOR_MCP_REQUIRE_PANEL: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Re-resolve the published dependency ranges
+        run: uv lock --upgrade    # discarded with the runner; never committed from CI
+      - name: Install what that resolved
+        run: uv sync
+      - name: Report what a user would actually get
+        run: |
+          uv run python - <<'PY'
+          from importlib.metadata import version
+          for dist in ("mcp", "httpx", "pydantic", "anyio"):
+              print(f"{dist}=={version(dist)}")
+          PY
+      - name: Run the suite against it
+        run: uv run pytest -q

.github/workflows/mcp.yml

@@ -1,74 +1,71 @@
-name: MCP package
+name: Publish MCP server
 
-# Path-scoped so panel-only changes do not run it — with one deliberate
-# exception: backend/auth/buckets.py. That file IS the thing the drift test
-# watches, so a change to the panel's permission table has to trigger this
-# workflow or the check would only ever run when we happen to touch mcp/.
 on:
-  push:
-    paths:
-      - 'mcp/**'
-      - 'backend/auth/buckets.py'
-      - '.github/workflows/mcp.yml'
-  pull_request:
-    paths:
-      - 'mcp/**'
-      - 'backend/auth/buckets.py'
-      - '.github/workflows/mcp.yml'
+  release:
+    types: [published]
+  workflow_dispatch:
 
 jobs:
-  # The gate. Runs the exact closure recorded in uv.lock, so a green tick here
-  # means "this commit works with the dependencies we committed".
-  locked:
-    name: locked closure (gate)
+  test:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      startsWith(github.event.release.tag_name, 'mcp-v')
+    name: locked closure (release gate)
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: mcp
     env:
-      # Turns "panel source missing" from a skip into a failure, so the drift
-      # check can never quietly stop running here.
+      # The panel permission table is a release contract, not an optional
+      # source-tree lookup. Fail rather than silently skipping its drift test.
       FABRICATOR_MCP_REQUIRE_PANEL: '1'
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
       - name: Install the locked closure
-        run: uv sync --frozen     # fails if uv.lock has drifted from pyproject.toml
-      - name: Run the suite
+        run: uv sync --frozen
+      - name: Run tests
         run: uv run pytest -q
 
-  # A warning, not a gate. Users do not install our lockfile: `uvx fabricator-mcp`
-  # resolves the published dependency ranges fresh every time, so the closure a
-  # user gets is the one this job tests, not the one above. Without it the first
-  # report of an SDK regression would come from a user. It is allowed to fail:
-  # a broken upstream release must be visible without blocking a release that is
-  # otherwise fine.
-  unlocked:
-    name: unlocked closure (warning only)
+  publish:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      startsWith(github.event.release.tag_name, 'mcp-v')
+    needs: test
     runs-on: ubuntu-latest
-    continue-on-error: true
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
     defaults:
       run:
         working-directory: mcp
-    env:
-      FABRICATOR_MCP_REQUIRE_PANEL: '1'
     steps:
       - uses: actions/checkout@v4
+
       - uses: astral-sh/setup-uv@v5
+
+      - name: Build
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          enable-cache: true
-      - name: Re-resolve the published dependency ranges
-        run: uv lock --upgrade    # discarded with the runner; never committed from CI
-      - name: Install what that resolved
-        run: uv sync
-      - name: Report what a user would actually get
+          packages-dir: mcp/dist
+
+      - name: Install mcp-publisher
         run: |
-          uv run python - <<'PY'
-          from importlib.metadata import version
-          for dist in ("mcp", "httpx", "pydantic", "anyio"):
-              print(f"{dist}=={version(dist)}")
-          PY
-      - name: Run the suite against it
-        run: uv run pytest -q
+          curl -sL https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz \
+            | tar xz mcp-publisher
+
+      - name: Publish to MCP Registry
+        run: |
+          ./mcp-publisher login github-oidc
+          for i in 1 2 3 4 5; do
+            ./mcp-publisher publish && exit 0
+            echo "Registry publish failed (attempt $i), retrying in 20s"
+            sleep 20
+          done
+          exit 1

.github/workflows/release.yml

@@ -11,8 +11,10 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    # MCP packages share this repository but must never produce panel release
+    # assets, move the GHCR :latest tag, or trigger the panel release chain.
     if: ${{ !startsWith(github.event.release.tag_name, 'mcp-v') }}
+    runs-on: ubuntu-latest
     outputs:
       is_prerelease: ${{ steps.detect.outputs.is_prerelease }}
     steps:

README.md

@@ -11,7 +11,7 @@
 [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Docker-lightgrey?style=flat-square)](https://github.com/philderks/Fabricator)
 [![Docker](https://img.shields.io/badge/ghcr.io-philderks%2Ffabricator-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/philderks/Fabricator/pkgs/container/fabricator)
 
-[Website](https://fabricator.site/) | [Documentation](https://docs.fabricator.site/)
+[Website](https://fabricator.site/) | [Documentation](https://docs.fabricator.site/) | [MCP server for AI clients](mcp/README.md)
 
 </div>
 

mcp/README.md

@@ -1,4 +1,6 @@
-# fabricator-mcp
+<!-- mcp-name: io.github.philderks/fabricator-panel-mcp -->
+
+# fabricator-panel-mcp
 
 > **Beta.** Young, and the way the client is configured may change between releases.
 
@@ -13,48 +15,38 @@ installed, check a mod against Modrinth, remove or update it, restart.
 > panel, against the token, on the server side. The tool set here is a curation layer: it is
 > narrower than what the token can reach, and it stays honest about the difference.
 
-## Requirements
-
-- The panel, reachable from this machine, with **MCP access enabled** in *Settings* → *Model
-  Context Protocol*.
-- An API token. **`read` is the recommended default** — it cannot change anything. Use `manage`
-  only when you want the assistant to be able to act.
-- **[`uv`](https://docs.astral.sh/uv/) installed and on your `PATH`.** This is the one hard
-  prerequisite, and it is not bundled with any MCP client. If `uv` is missing, your client will
-  report the Fabricator server as **failing to launch or disconnecting at startup** — it looks
-  like a broken server, not like a panel or token problem, because the process never starts.
-  Installing `uv` fixes it.
-
-## Connecting a client
+## Connect your MCP client
 
-Put this in your client's MCP server configuration (for Claude Desktop, `claude_desktop_config.json`):
+Paste this into your MCP client configuration. Create the token in Fabricator's **Settings** →
+*Model Context Protocol*.
 
 ```json
 {
   "mcpServers": {
     "fabricator": {
       "command": "uvx",
-      "args": [
-        "--from",
-        "git+https://github.com/philderks/Fabricator@dev#subdirectory=mcp",
-        "fabricator-mcp"
-      ],
+      "args": ["fabricator-panel-mcp"],
       "env": {
-        "FABRICATOR_URL": "http://127.0.0.1:5000",
-        "FABRICATOR_TOKEN": "YOUR_TOKEN_HERE"
+        "FABRICATOR_URL": "http://YOUR-PANEL:5000",
+        "FABRICATOR_TOKEN": "YOUR_API_TOKEN"
       }
     }
   }
 }
 ```
 
-The panel generates this block for you, with the URL and token filled in, in **Settings** →
-*Model Context Protocol*.
+## Requirements
+
+- The panel, reachable from this machine, with **MCP access enabled** in *Settings* → *Model
+  Context Protocol*.
+- An API token. **`read` is the recommended default** — it cannot change anything. Use `manage`
+  only when you want the assistant to be able to act.
+- **[`uv`](https://docs.astral.sh/uv/) installed and on your `PATH`.** This is the one hard
+  prerequisite, and it is not bundled with any MCP client. If `uv` is missing, your client will
+  report the Fabricator server as **failing to launch or disconnecting at startup** — it looks
+  like a broken server, not like a panel or token problem, because the process never starts.
+  Installing `uv` fixes it.
 
-> The package is installed straight from the repository because it is not published to PyPI yet.
-> When it is, `command` and `args` become `"uvx"` and `["fabricator-mcp"]`, and nothing else
-> changes. Those two values are the entire launch channel; they live here and in
-> `frontend/src/config/mcpClientConfig.js`.
 
 ## What the assistant can do
 
@@ -151,7 +143,7 @@ Four independent mechanisms keep this suite and the panel's from touching each o
    pytest's upward search here, so a run in `mcp/` never loads the panel's `conftest.py`; the
    panel's `pytest.ini` sets `testpaths = tests` and `norecursedirs = mcp` so a run at the repo
    root never descends into this directory.
-4. **Separate CI job** — path-scoped to `mcp/**`, with its own working directory.
+4. **Separate test workflow** — `.github/workflows/mcp-tests.yml` runs the locked and unlocked jobs from `mcp/`.
 
 **Do not add a `[tool.uv.workspace]` to the repository root.** A workspace would merge the two
 lockfiles and environments and destroy the island.

mcp/pyproject.toml

@@ -1,10 +1,14 @@
 [project]
-name = "fabricator-mcp"
-version = "0.3.0"
+name = "fabricator-panel-mcp"
+version = "0.1.0"
 description = "MCP server for the Fabricator Minecraft panel"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.10"
 license = "AGPL-3.0-only"
+authors = [
+    { name = "Philipp Noél Derks" },
+    { name = "Linus Sommermeyer" },
+]
 dependencies = [
     "mcp>=1.28,<2",
     "httpx>=0.28",
@@ -13,8 +17,12 @@ dependencies = [
     "pydantic-settings>=2.5.2,<2.15",
 ]
 
+[project.urls]
+Homepage = "https://fabricator.site/"
+Repository = "https://github.com/philderks/Fabricator"
+
 [project.scripts]
-fabricator-mcp = "fabricator_mcp.__main__:main"
+fabricator-panel-mcp = "fabricator_mcp.__main__:main"
 
 [dependency-groups]
 # anyio ships its own pytest plugin and is already in the mcp closure, so async

mcp/server.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.philderks/fabricator-panel-mcp",
+  "description": "Manage and diagnose Minecraft servers through the self-hosted Fabricator panel.",
+  "version": "0.1.0",
+  "repository": {
+    "url": "https://github.com/philderks/Fabricator",
+    "source": "github",
+    "subfolder": "mcp"
+  },
+  "packages": [
+    {
+      "registryType": "pypi",
+      "identifier": "fabricator-panel-mcp",
+      "version": "0.1.0",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "FABRICATOR_URL",
+          "description": "Base URL of the Fabricator panel",
+          "default": "http://127.0.0.1:5000",
+          "isRequired": false,
+          "isSecret": false
+        },
+        {
+          "name": "FABRICATOR_TOKEN",
+          "description": "API token created on the panel's Integrations page",
+          "isRequired": true,
+          "isSecret": true
+        }
+      ]
+    }
+  ]
+}