# Bit Lantern MCP Registry packaging

[![smithery badge](https://smithery.ai/badge/zaguanlabs/atlas-scout)](https://smithery.ai/servers/zaguanlabs/atlas-scout)

This repository contains the inspectable packaging metadata and locked build
recipe used to publish Bit Lantern to the official MCP Registry.

Bit Lantern is a local, read-only MCP server for structural code navigation. It
builds a disposable SQLite index inside each workspace and provides bounded
definitions, exact source ranges, references, static call relationships,
architecture summaries, and edit-impact evidence to connected coding agents.

## Install

Use an MCP Registry client that supports MCPB packages and choose the release
asset matching your operating system and CPU architecture. Each bundle starts:

```text
bitlantern mcp
```

The current Preview 30 target matrix is:

| Target | Minimum platform |
|---|---|
| `aarch64-apple-darwin` | macOS 15 on Apple silicon |
| `aarch64-unknown-linux-gnu` | 64-bit Linux with glibc 2.35+ on ARM64 |
| `x86_64-unknown-linux-gnu` | 64-bit Linux with glibc 2.35+ on x86-64 |
| `x86_64-pc-windows-msvc` | 64-bit Windows 11 25H2+ on x86-64 |

Preview binaries for macOS and Windows are not yet platform-signed. Review the
[installation and platform-safety documentation](https://atlasscout.dev/docs)
and do not weaken operating-system or organization security controls.

## Reproduce the MCPB artifacts

The build is locked to Bit Lantern `1.0.0-preview.30`, the exact signed public
release-manifest digest, all four source-archive digests and byte lengths, and
`@anthropic-ai/mcpb` `2.1.2`.

Requirements: Bash, curl, jq, Node.js/npm, sha256sum, tar, and unzip.

```bash
./scripts/build-mcpb.sh
(cd dist/packages && sha256sum --check SHA256SUMS)
```

The script downloads only immutable Preview 30 release objects from
`download.atlasscout.dev`, verifies them before extraction, and packages one
native target per `.mcpb` file. Generated artifacts remain under `dist/` and
are not committed to Git.

For directories that accept only one downloadable MCPB artifact per listing,
build the universal package:

```bash
./scripts/build-smithery-mcpb.sh
```

That package contains Brotli-compressed copies of three verified native executables.
Its Node.js launcher selects the matching target, verifies the decoded byte length
and SHA-256, and runs it from a private temporary directory that is removed on exit.
It supports macOS/ARM64, Linux/x86-64, and Windows/x86-64 and requires Node.js
18 or newer and a writable temporary directory. No startup download is required.
Smithery currently limits MCPB uploads to 25 MiB, so Linux/ARM64
users should install its target-specific package from the official MCP Registry
or GitHub release. Bit Lantern itself remains a native executable; the launcher
is used only for cross-platform MCPB distribution.

Run the launcher's integrity, argument-forwarding, and cleanup checks with
`node --test smithery/launcher.test.cjs` before building the final release bundle.

The official MCPB CLI records the packaging time in each ZIP. Rebuilding
verifies and packages the same native inputs, but does not promise a
byte-identical `.mcpb` digest. The immutable release-asset digests used by MCP
clients are recorded in `server.json` and `RELEASE_EVIDENCE.md`.

The source archives additionally provide OpenPGP signatures, Sigstore bundles,
SPDX SBOMs, and aggregate checksums through the [signed public release
manifest](https://download.atlasscout.dev/bitlantern/preview/1.0.0-preview.30/release.json).

## Licensing boundary

The packaging metadata, build scripts, and repository documentation are
licensed under Apache License 2.0. Bit Lantern itself is separate proprietary
software. The executables and product materials inside MCPB release assets
remain governed by the Bit Lantern Proprietary License and EULA included in
every bundle.

Installing or using an MCPB asset constitutes use of the proprietary runtime,
not a grant under this repository's Apache license.

## Privacy and support

Bit Lantern indexes locally. It does not transmit repository paths, symbols,
queries, tool calls, editor state, Git remotes, index metrics, or source code to
the Bit Lantern licensing service. Navigation results are sent to the coding
agent the user connects.

- Product documentation: <https://atlasscout.dev/docs>
- Privacy policy: <https://atlasscout.dev/legal/privacy>
- Support and security: <support@atlasscout.dev>