Defame1297
b4f5881973
plugins/bin/.mcp.json declared the obsidian server as `npx @bitbonsai/mcpvault@latest`, so an unpinned third-party npm package was fetched and executed at every session start. The apm-consumed install promoted that string to committed repo-root content in .mcp.json, giving every clone the same unpinned execution. Pinned to 0.15.0, the version `latest` currently resolves to. bin 1.1.2 -> 1.1.3 and marketplace 0.4.0 -> 0.4.1, following the mappingbb9158destablishes and3bfdf58confirms: the marketplace takes the same bump severity as the highest-severity package bump. kyberforge is not bumped here, so executables.allow's `kyberforge#1.5.0` key is untouched. The pin is not live for this working copy until this lands on the remote and `apm update` re-resolves — apm.lock.yaml still records 1.1.2 and `@latest`, because the six dependencies resolve from the remote rather than from the tree beside them. Correct for a fresh clone immediately. .gitignore gains /.claude-plugin/plugin.json: a bare `apm pack` emits a root-package manifest there that has never been tracked on any branch. Scoped to the file, since the sibling marketplace.json is compiled output that is committed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
bin
A place for things to be binned
Install
Claude Code:
claude plugin marketplace add <owner>/<repo>
claude plugin install bin@<marketplace-name>
GitHub Copilot CLI:
copilot plugin marketplace add <owner>/<repo>
copilot plugin install bin
Local (development):
# Claude Code
claude --plugin-dir ./plugins/bin
# GitHub Copilot CLI
copilot plugin install ./plugins/bin
Contents
| Component | Path | Description |
|---|---|---|
| Skills | .apm/skills/ → skills/ |
Slash commands available after install |
| MCP servers | .mcp.json |
The obsidian server (npx @bitbonsai/mcpvault@0.15.0 docs/), hand-authored at the plugin root |
.apm/ is the authoring source; skills/ is the generated mirror plugin hosts scan (ADR-0017). This plugin ships no agents. It is the only plugin here with a non-empty .mcp.json, which is why its compiled manifests are the only ones carrying an mcpServers block.
The two compiled manifests get that block by different routes. .claude-plugin/plugin.json gets it from apm itself: build_plugin_manifest's Claude branch calls collect_mcp_servers, which reads .mcp.json, sanitizes it, and inlines the resulting server objects. .github/plugin/plugin.json gets nothing from apm — the Copilot branch drops the field — so scripts/sync-plugin-content.sh's reinject_mcp_servers() puts it back, as the string ".mcp.json" rather than the resolved objects. Copilot's manifest schema types the field as "string or object — MCP server config path or inline definitions", and a path reference cannot carry a credential into a committed manifest. See ADR-0017's mcpServers amendment.
Author
Defame1297