Install
$ agentstack add skill-hybridlabor-api-bdb-dev-optimized-agent-skills-mcpb-bundle ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
tdmcp Desktop bundle: .dxt → .mcpb
Anthropic renamed Desktop Extensions from DXT (.dxt, packer @anthropic-ai/dxt, manifest key dxt_version) to MCPB (.mcpb, packer @anthropic-ai/mcpb, manifest key manifest_version). Legacy .dxt still installs in Claude Desktop, but new directory submissions should ship .mcpb.
What this repo already has
scripts/build-dxt.mjs is already MCPB-aware: it tries @anthropic-ai/mcpb first, falls back to legacy @anthropic-ai/dxt, then to a system zip. The bundle stages manifest.json at the archive root + dist/, recipes/, td/, README.md, LICENSE, package.json, and a production-only node_modules. So the migration is mostly renaming the output + the references, not a rewrite.
dxt/manifest.json currently declares "manifest_version": "0.3" — already the modern MCPB key (not the legacy dxt_version), so the manifest is largely correct.
The migration, concretely
- Manifest — verify, don't guess. Before touching
manifest_version, check
what the installed packer accepts: npx --yes @anthropic-ai/mcpb --help (look for pack / validate). If it ships a validate command, run it against dxt/manifest.json and let it tell you. Only change manifest_version if validation demands it. A wrong value breaks install — this is why we verify rather than assume a number.
- Output filename →
tdmcp.mcpb. Inscripts/build-dxt.mjs: change
outFile to tdmcp.mcpb and update the log lines (they say .dxt). Keep the packer-preference order and the zip fallback intact — both must still work. Optionally rename the script file to build-mcpb.mjs (update the npm script if you do).
- npm scripts (
package.json): renamebuild:dxt→build:mcpbpointing at
the script. Only keep a build:dxt alias if something external depends on the old name (grep first); otherwise replace it cleanly — no compatibility cruft. Check the version script too (it stages dxt/manifest.json).
- Reference sweep — change user-facing
.dxt→.mcpbin:
docs/guide/{install,troubleshooting,glossary}.md + their docs/pt/ mirrors, docs/DEPLOYMENT.md, docs/reference/cli.md, scripts/setup.mjs, README.md. Also grep .github/ for any release workflow that builds or uploads tdmcp.dxt / runs build:dxt.
- Release-asset URLs. Links to
releases/latest/download/tdmcp.dxt point at a published asset. After this change the next release ships tdmcp.mcpb; update those links to .mcpb and record that a new release must be cut so the asset exists (the current v0.3.0 asset is still .dxt). Note this for the human in migration notes.
Preserve, don't erase
Where docs explain "one-click Desktop Extension", keep the explanation and add that .dxt still installs (legacy) while .mcpb is current. Don't delete info that helps users who already downloaded the .dxt.
Verify the build still works
npm run build # populate dist/
npm run build:mcpb # (renamed) → must emit tdmcp.mcpb
unzip -l tdmcp.mcpb # manifest.json at root + dist/ present
The dxt/ directory name and dxt/manifest.json path can stay as-is (internal paths the script references) — renaming the directory is optional churn and not required for a valid .mcpb. If you rename it, update build-dxt.mjs, package.json's version script, and sync-manifest-version.mjs.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: hybridlabor-api
- Source: hybridlabor-api/bdb-dev-optimized-agent-skills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.