Module 05 · Production AI Tooling
Packaging and Distributing Your MCP Server
Open lesson + course map
On this lesson
Course outline
Module 1 · Claude Code Fundamentals
Module 2 · CLI Workflows
Module 3 · Model Context Protocol Basics
Module 4 · Building an MCP Server
Distribution turns a private script into a supply-chain responsibility. Consumers need reproducible builds, version compatibility, integrity, permissions, data behavior, configuration, upgrade notes, and removal instructions.
// concept
Prepare the Package Contract
Publish:
- supported runtime, MCP protocol, and SDK versions;
- capabilities and side effects;
- required credentials/scopes and network destinations;
- configuration schema and safe defaults;
- data sent, stored, logged, and retained;
- install, health check, update, rollback, and uninstall steps;
- security reporting and support owner;
- changelog and compatibility policy.
Exclude .env, fixtures with real data, logs, build caches, and local config. Pin dependencies with a lockfile, generate a software bill of materials where appropriate, scan dependencies, and build in CI from a tagged commit.
// concept
Version by Contract Change
Breaking schema, permission, behavior, or configuration changes require an explicit compatibility decision. Do not silently add a write tool in a patch release. Consumers should review capability and scope changes before upgrade.
Sign releases or use registry provenance features where supported. Publish checksums/artifacts through an owned organization account with recovery and multi-factor controls.
// worked_example
Worked Example
A Lahore agency packages a read-only catalog server. CI runs tests, builds a minimal artifact, checks for secrets, creates an SBOM, and publishes from a protected tag. README lists one read tool, fixture-free installation, expected environment variable names, and exact uninstall.
Version 1.1 adds an optional resource without new credentials. A future draft-write capability is planned as a new reviewed release and separate scope, not slipped into 1.1.1.
The release record links test evidence, source commit, dependency inventory, reviewer, and the exact artifact consumed by the clean-install test.
// failure_cases
Failure Cases to Diagnose
6 cases to diagnose
Package contains `.env`
remove, revoke, and scan history/artifacts.
Floating dependencies
lock and monitor.
Install script performs hidden network action
minimize and document.
No compatibility matrix
consumers cannot upgrade safely.
Personal registry owner
move to organization control.
Uninstall leaves credentials/service
document complete removal.
// pakistan_angle
Pakistan Angle
Pakistani freelancers should contractually define maintenance, hosting, third-party costs, incident response, and handover. The client must own production accounts and recovery—not depend on the seller’s personal registry or email.
Price the actual lifecycle in PKR: discovery, build, review, hosting, monitoring, updates, and support. Do not sell an unsupported zip as “production AI infrastructure.”
// hands_on
Hands-On Exercise
5 steps
Create the package contract and threat review.
Add CI tests, secret scan, SBOM, and artifact build.
Publish to a private test registry or local package store.
Install from clean environment, then uninstall.
Simulate a breaking capability change.
// completion_rubric
Completion Rubric
6 checks — tick as you verify
// sources
Sources
3 official sources — check every claim yourself
// check_yourself
Check yourself
4 questions · answers and options are taken word-for-word from this course
1 / 4 · diagnose
Your work shows this failure mode: “Package contains `.env`.” What does the lesson tell you to do about it?