cli

# Signadot CLI

This is the source repository for the [Signadot](https://signadot.com) command-line interface.

Please see the [CLI reference](https://www.signadot.com/docs/reference/cli) for installation and usage instructions.

To file an issue, please use our [community issue tracker](https://github.com/signadot/community/issues).

NOTE: Starting next release, and hence in the main branch, this repository has a dependency
on a private repository, and hence building or running from source will not work.
Previous releases should continue to work.

## Install

To install the CLI, run:

```sh
curl -sSLf https://raw.githubusercontent.com/signadot/cli/main/scripts/install.sh | sh
```

By default, the script will install the latest version at `/usr/local/bin/signadot`. The target version can be selected by setting the SIGNADOT_CLI_VERSION variable, while you can specify the install directory with `SIGNADOT_CLI_PATH`.

## Build

To build the CLI from source, such as to test changes, you'll need Go 1.27.1+.

The `main` package is in  `cmd/signadot`:

```sh
go build ./cmd/signadot
```

## Release

To release the CLI, you can use the release Github action.
Push a new tag that matches the format `v[0-9]+.[0-9]+.[0-9]`
and it will push new release artifacts and update brew.

### Post-release: publish to the MCP Registry

After the GitHub release artifacts are live, publish the MCP server entry
manually. goreleaser does not yet support the `fileSha256` integrity field
required by the MCP registry for `mcpb` packages.

**Prerequisites:**

- install [`mcp-publisher`](https://github.com/modelcontextprotocol/registry)
- a classic GitHub PAT with only the `read:org` scope
  ([create one here](https://github.com/settings/tokens/new?scopes=read:org&description=mcp-registry-publish)),
  owned by an **Owner** of the signadot org. Since
  [registry#1383](https://github.com/modelcontextprotocol/registry/pull/1383)
  the registry grants the `io.github.signadot/*` namespace only to org Owners,
  and the interactive `mcp-publisher login github` device flow cannot read org
  roles — logging in with a PAT is what makes org publishing work.

```sh
./scripts/gen-mcp-server-json.sh <version>   # e.g. v1.8.0 — writes server.json
MCP_GITHUB_TOKEN=<pat-with-read:org> mcp-publisher login github
mcp-publisher publish server.json
```

The script writes the `v`-prefixed tag (e.g. `v1.8.0`) as the version in
`server.json`. Don't hand-edit it to the bare form — the registry treats
`1.4.0` and `v1.4.0` as distinct versions, and mixing the two has created
duplicate entries in the past.

This covers the official MCP registry only. For getting the MCP server
listed in other directories (Claude Desktop extensions, Docker MCP Catalog,
and others), see [docs/mcp-distribution.md](docs/mcp-distribution.md).

## See Also

The CLI is built on top of the [Go SDK](https://github.com/signadot/go-sdk).

The CLI is built using [libconnect](https://github.com/signadot/libconnect).