release

Author: pranavcodeant

.github/workflows/publish-mcpb.yml

@@ -19,12 +19,18 @@ jobs:
           node-version: '20'
 
       - id: version
-        run: echo "version=$(jq -r .version mcpb/manifest.json)" >> "$GITHUB_OUTPUT"
+        run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
 
       - run: npm ci
 
       - run: npm run mcpb:build
 
+      - uses: actions/upload-artifact@v4
+        with:
+          name: codeant-mcpb-v${{ steps.version.outputs.version }}
+          path: dist/codeant.mcpb
+          if-no-files-found: error
+
       - uses: softprops/action-gh-release@v2
         with:
           tag_name: mcpb-v${{ steps.version.outputs.version }}

.github/workflows/publish.yml

@@ -1,25 +1,55 @@
-name: Publish Package
+name: Build CLI Release
 
 on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
-  publish:
+  build-cli:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+
+      - id: version
+        run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
 
       - run: npm ci
 
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm pack
+        # produces codeant-cli-<version>.tgz in the working directory
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: codeant-cli-v${{ steps.version.outputs.version }}
+          path: codeant-cli-${{ steps.version.outputs.version }}.tgz
+          if-no-files-found: error
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          tag_name: cli-v${{ steps.version.outputs.version }}
+          name: CodeAnt CLI v${{ steps.version.outputs.version }}
+          files: codeant-cli-${{ steps.version.outputs.version }}.tgz
+          fail_on_unmatched_files: true
+          body: |
+            CodeAnt CLI npm tarball v${{ steps.version.outputs.version }}
+
+            Commit: ${{ github.sha }}
+            Message: ${{ github.event.head_commit.message }}
+
+            ## Publish to npm
+
+            Download the `.tgz` and run:
+
+            ```
+            npm publish codeant-cli-${{ steps.version.outputs.version }}.tgz --access public
+            ```
+
+            (Requires npm auth with publish rights on the `codeant-cli` package.)

README.md

@@ -236,6 +236,24 @@ node src/index.js secrets --last-commit
 node src/index.js secrets --all
 ```
 
+## MCP / Claude Connector
+
+This package also ships an MCP (Model Context Protocol) server that exposes CodeAnt's scan, review, and PR data as tools to Claude and other MCP clients. The same source tree is packaged as a Desktop Extension (`.mcpb`) for one-click install in Claude Desktop.
+
+See [mcp.md](mcp.md) for the tools listing, install paths (Claude Code CLI, Claude Desktop manual config, MCPB double-click), and bundling/submission instructions.
+
+## Privacy Policy
+
+Full policy: **https://codeant.ai/privacy**
+
+Summary of what this CLI / MCP server sends and stores:
+
+- **Data sent to CodeAnt servers.** Authentication tokens, repository metadata (org, repo, branch, PR identifiers), and — for local review and secrets scanning — the code snippets and diffs you explicitly ask CodeAnt to scan. Nothing is sent on its own; every call is in response to a command you run or a tool Claude invokes.
+- **Where it is stored.** On CodeAnt's infrastructure (https://api.codeant.ai or your self-hosted instance). Locally, the auth token is cached in `~/.codeant/config.json` on your machine.
+- **Third-party sharing.** None beyond CodeAnt's own infrastructure. CodeAnt does not sell or share your data with third parties for marketing.
+- **Retention.** Scan findings and PR data are retained per the CodeAnt account's retention policy (see the privacy URL above). Local config persists until you run `codeant logout` or delete `~/.codeant/config.json`.
+- **Contact.** support@codeant.ai
+
 ## License
 
 MIT

mcp.md

@@ -170,14 +170,15 @@ npm run mcpb:build
 
 CodeAnt's MCP server uses stdio + a packaged bundle, so the submission route is **Desktop Extensions (MCPB)**, not the remote-connector form.
 
-- **Submission URL:** https://clau.de/desktop-extention-submission
+- **Submission URL:** https://claude.com/docs/connectors/building/submission
 - **Bundle:** upload `dist/codeant.mcpb`
 - **Required metadata:** already in [mcpb/manifest.json](mcpb/manifest.json) — display name, description, author, homepage, documentation, repository, license, keywords, `privacy_policies`, `tools` static listing, `user_config` schema.
+- **Privacy policy.** Linked from both [README.md](README.md#privacy-policy) and the manifest's `privacy_policies` field (`https://codeant.ai/privacy`).
 
 Reviewer notes worth preparing:
 
 - **Auth model.** CodeAnt uses a user-scoped API token entered into `user_config.api_token`. The token never leaves the user's machine — the bundle talks to `api.codeant.ai` (or the user's self-hosted URL) directly. No third-party OAuth flow needed.
-- **Sandbox creds.** Provide a test account + token so reviewers can exercise the read tools.
+- **Sandbox creds.** Email support@codeant.ai for a reviewer sandbox token; paste it into the submission form's reviewer-notes field along with an org slug that has scans + PRs to browse.
 - **Write tools.** Gated behind `user_config.read_only` (defaults to on). Reviewers can toggle off to test `codeant_scans_start` / `codeant_pr_resolve`.
 
 ---

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.4.14",
+  "version": "0.5.0",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {