Release distribution: MCP, plugins, skills, memory, and backups
AgentPlaybooks is a cross-platform bridge for AI agent configuration. A release is complete only when the versioned code, hosted service, installable components, store listings, and documentation agree. The release gate (npm run release:check) checks local versions, manifests, included files, and that the plugin logo matches the website. A cli-v* tag also opens an idempotent GitHub issue for live-listing verification.
Where to update
| Channel | Release action | Verification |
| npm | Publish @agentplaybooks/cli through the trusted-publishing workflow after tests and npm pack --dry-run. | Check the live npm version, tarball, binaries, and provenance. |
| SBOM and signatures | sbom.yml on the same cli-v* tag writes CycloneDX JSON (npm, Python, container image) and cosign-signs the files. Signing is tag-only. | Download the GitHub Release assets and run cosign verify-blob as in docs/security/supply-chain.md. |
| Official MCP Registry | Deploy the matching server, then publish root server.json as ai.agentplaybooks/agentplaybooks. The protected-main Publish MCP Registry workflow uses the domain key in the mcp-registry-publish GitHub environment. | Confirm the new active version and endpoint; do not confuse the deprecated accidental 1.0.0 entry with the latest product release. |
| Glama | Check the indexed AgentPlaybooks MCP listing and request a refresh if it remains stale. | Check listing version, logo, and live connection. |
| AgentStatus | Use the public Code Quality Champion playbook at https://agentplaybooks.ai/api/mcp/code-quality for anonymous read-only monitoring. The account-management endpoint requires authentication and is a separate measurement surface. | Verify initialize/discovery, tools/list, list_skills, and get_skill without credentials; confirm hidden writes and secret tools are refused. A submitted URL is not a verified score: confirm the monitored URL and probe results on the live dashboard. |
| Claude plugin (claude.ai chat, Cowork, Claude Code) | The plugin is plugins/agentplaybooks — no bin/ (claude.ai and Cowork refuse a plugin that has one), no lockfile, its commands pinned to @agentplaybooks/cli@ through npx; release:check fails on a stale pin. Bump its plugin.json and .claude-plugin/marketplace.json, run claude plugin validate plugins/agentplaybooks and claude plugin validate .. The Anthropic directory follows main once submitted (Submit new → Plugin bundle, plugin path plugins/agentplaybooks). | Install from Customize → Plugins → Add marketplace (matebenyovszky/agentplaybooks) and from /plugin in Claude Code; connect the bundled connector; check the version on the directory's Versions tab. A version that passes may still wait for a reviewer to publish it. |
| Claude Connectors Directory | Submit https://agentplaybooks.ai/api/mcp/manage once as an MCP connector in the same portal, so the plugin's connector has a listing of its own. The portal-by-portal checklist, reviewer test cases, and the non-code blockers (privacy policy completeness, test account) are in docs/claude-directory-notes.md. | Add the URL as a custom connector in Claude and call each tool before submitting; afterwards check health and usage in the portal. |
| Cursor Marketplace | Update root plugin.json, .cursor-plugin/marketplace.json, and package manifest; submit the public repository through Cursor's review portal. Each update is reviewed. | Verify the public listing and install; a repository manifest alone is not a store publication. |
| ChatGPT/Codex Plugins Directory | Update root Agent Plugins 1.0 package and submit a new version in the OpenAI plugin portal. Identity, domain, tools, test cases, and policies need review. | Verify approval and actual publication in the shared directory; uploading does not publish. |
| Hermes plugin catalog | Keep the merged memory catalog entry, its source pin, and the separate tools plugin compatible. Update catalog pins through upstream PRs when those packages change. | Check both install names, the memory setup, and the tools skill's authentication and profile instructions. |
| Agent Skills | Keep packages/cli/skills/, the public /.well-known/skills/ endpoint, and MCP Skills extension consistent. A GitHub-hosted skill can be installed with npx skills add; skills.sh indexes/install sources rather than replacing this source of truth. | Test discovery, install, skills/list, skills/get, and digest-verified resources/read. |
| AgentPlaybooks central backup | Test apb doctor, push, backups, pull, and sync against every supported adapter. | Restore into a fresh directory; confirm only secret references move, never secret values. |
Additional directories should be added only after checking their current submission policy and whether they accept MCP, plugins, or skills. Do not claim a store is updated until its live listing is verified.
Release sequence
- Bump the CLI, portable package, vendor plugin manifests, marketplaces, and
server.jsonto the same version. Runnpm run release:check,npm run test:all, lint, typecheck, build, andnpm pack --dry-run. - Merge and deploy the web service. Test the public MCP endpoint and the dashboard's Export as Agent Plugin button. The ZIP is an installable snapshot of skills, persona/instructions, and a host-authenticated account MCP reference—not a full private backup.
- Tag
cli-vonly after the package is ready. The npm workflow publishes with provenance;sbom.ymlattaches CycloneDX SBOMs and cosign bundles to the GitHub Release (signing runs on tags only); the distribution workflow creates a checklist issue. Verify npm provenance andcosign verify-blobon an SBOM (docs/security/supply-chain.md) before marking it done. - Check the automatic Publish MCP Registry workflow after npm publishing, or dispatch it from
mainwith the exactrelease_tag. Deploy the matching public domain proof first; see Registry publishing. Check Glama indexing. Update or submit manually reviewed store listings (Cursor, OpenAI, Hermes) and record their review status in the checklist. - Verify skill discovery and
npx skills add, then update README, docs, sitemap, changelog/blog, and a short release note. For a new integration, comment on third-party issues only when the answer directly solves the reported problem; include an exact test result or documentation link, avoid promotional repetition, and never automate unsolicited comments.
Two-level distribution model
The project plugin installs the CLI's stable skills and account MCP connection. A user's playbook is the second level: Export as Agent Plugin produces a portable plugin.json, mcp.json, and skills/ tree. MCP clients that implement the MCP Skills extension can additionally discover hosted playbook skills dynamically; clients without it use the exported snapshot or existing tools/resources. A store may import remote skills as a static snapshot, so a changed playbook does not necessarily update an approved listing automatically.
Agent Plugins 1.0 standardizes the plugin manifest, skills, and MCP configuration. It does not standardize secret vault values, live playbook backup, memory, custom-agent semantics, or store review. AgentPlaybooks carries those separately and preserves references rather than embedding credentials.