AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified Apache-2.0 Self-run

Mcpb Bundle

skill-hybridlabor-api-bdb-dev-optimized-agent-skills-mcpb-bundle · by hybridlabor-api

How to migrate the tdmcp Claude Desktop bundle from legacy .dxt to .mcpb (MCP Bundle) and keep it building — covers the manifest schema (verify against the installed packer, never hardcode), the build-dxt.mjs packer/zip-fallback flow, the npm scripts, and the full .dxt→.mcpb reference sweep across docs and scripts. Use when packaging or migrating the tdmcp desktop bundle.

No reviews yet
0 installs
0 views
view→install

Install

$ agentstack add skill-hybridlabor-api-bdb-dev-optimized-agent-skills-mcpb-bundle

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-hybridlabor-api-bdb-dev-optimized-agent-skills-mcpb-bundle)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
today

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Mcpb Bundle? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

tdmcp Desktop bundle: .dxt → .mcpb

Anthropic renamed Desktop Extensions from DXT (.dxt, packer @anthropic-ai/dxt, manifest key dxt_version) to MCPB (.mcpb, packer @anthropic-ai/mcpb, manifest key manifest_version). Legacy .dxt still installs in Claude Desktop, but new directory submissions should ship .mcpb.

What this repo already has

scripts/build-dxt.mjs is already MCPB-aware: it tries @anthropic-ai/mcpb first, falls back to legacy @anthropic-ai/dxt, then to a system zip. The bundle stages manifest.json at the archive root + dist/, recipes/, td/, README.md, LICENSE, package.json, and a production-only node_modules. So the migration is mostly renaming the output + the references, not a rewrite.

dxt/manifest.json currently declares "manifest_version": "0.3" — already the modern MCPB key (not the legacy dxt_version), so the manifest is largely correct.

The migration, concretely

  1. Manifest — verify, don't guess. Before touching manifest_version, check

what the installed packer accepts: npx --yes @anthropic-ai/mcpb --help (look for pack / validate). If it ships a validate command, run it against dxt/manifest.json and let it tell you. Only change manifest_version if validation demands it. A wrong value breaks install — this is why we verify rather than assume a number.

  1. Output filenametdmcp.mcpb. In scripts/build-dxt.mjs: change

outFile to tdmcp.mcpb and update the log lines (they say .dxt). Keep the packer-preference order and the zip fallback intact — both must still work. Optionally rename the script file to build-mcpb.mjs (update the npm script if you do).

  1. npm scripts (package.json): rename build:dxtbuild:mcpb pointing at

the script. Only keep a build:dxt alias if something external depends on the old name (grep first); otherwise replace it cleanly — no compatibility cruft. Check the version script too (it stages dxt/manifest.json).

  1. Reference sweep — change user-facing .dxt.mcpb in:

docs/guide/{install,troubleshooting,glossary}.md + their docs/pt/ mirrors, docs/DEPLOYMENT.md, docs/reference/cli.md, scripts/setup.mjs, README.md. Also grep .github/ for any release workflow that builds or uploads tdmcp.dxt / runs build:dxt.

  1. Release-asset URLs. Links to

releases/latest/download/tdmcp.dxt point at a published asset. After this change the next release ships tdmcp.mcpb; update those links to .mcpb and record that a new release must be cut so the asset exists (the current v0.3.0 asset is still .dxt). Note this for the human in migration notes.

Preserve, don't erase

Where docs explain "one-click Desktop Extension", keep the explanation and add that .dxt still installs (legacy) while .mcpb is current. Don't delete info that helps users who already downloaded the .dxt.

Verify the build still works

npm run build          # populate dist/
npm run build:mcpb     # (renamed) → must emit tdmcp.mcpb
unzip -l tdmcp.mcpb     # manifest.json at root + dist/ present

The dxt/ directory name and dxt/manifest.json path can stay as-is (internal paths the script references) — renaming the directory is optional churn and not required for a valid .mcpb. If you rename it, update build-dxt.mjs, package.json's version script, and sync-manifest-version.mjs.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.