U4 of the Claude Desktop .mcpb bundle plan.
- mcp/manifest.json hand-authored to match PP's emitted shape (see
~/printing-press/library/bugbounty-goat/manifest.json for the
canonical reference). 13 user_config slots, all sensitive=true and
required=false so the engine's graceful degradation to web-only
mode keeps the install non-blocking on credential entry.
- Covered API keys: OpenAI, xAI, Brave, Exa, Serper, Google,
Gemini (and the Google_genai alias), Apify, Bluesky app password,
Parallel, ScrapeCreators, OpenRouter. Cookie / session flows
(Truth Social, Xiaohongshu, ChatGPT account ID, Codex auth)
deferred per plan Scope Boundaries - they need a richer UX than
plain user_config strings.
- internal/manifest/manifest_test.go enforces the structural
invariants Claude Desktop install correctness depends on:
required MCPB fields, lowercased-env-name -> user_config-key
cross-reference both directions, sensitive=true + required=false +
description present on every slot, and platform list coverage.
- Local smoke: `printing-press bundle --skip-build --binary <built>`
produces last30days-pp-mcp-darwin-arm64.mcpb (4.7MB compressed,
manifest.json + bin/last30days-pp-mcp).
Matt Van Horn
1b23a3e900