The NPM_TOKEN used by publish-npm is dead (npm classic-token sunset) —
both June release attempts failed publishing with a disguised auth error
(E404 on the publish PUT) after PyPI legs succeeded. Each
@modelcontextprotocol/* package's npm trusted publisher is being bound to
this workflow (release.yml) + the release environment, so publish-npm now
authenticates via OIDC instead of a token:
- add id-token: write permission to publish-npm (required to mint the
OIDC token; contents: read added explicitly since setting permissions
drops the defaults)
- upgrade the npm CLI in the publish job (trusted publishing requires
npm >= 11.5.1; Node 22 bundles an older npm)
- drop NODE_AUTH_TOKEN from the publish step
Also touch each TypeScript server's README (add everything's missing
License section; link each package's npm page) so scripts/release.py
includes all four packages in the next npm publish matrix — they've been
stranded on npm at 2026.1.26 while PyPI advanced to 2026.6.16.
See #4463 for the rollout plan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
* fix: regenerate uv.lock after version bump in release script
When the release script bumps the version in pyproject.toml, it needs
to also regenerate the uv.lock file. Otherwise the lockfile becomes
out of sync and `uv sync --locked` fails in CI with:
"The lockfile at uv.lock needs to be updated"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: use --frozen instead of --locked in release workflow
The release script bumps the version in pyproject.toml, which causes
the lockfile to be out of sync (uv includes the package's own version
in the lockfile). Using --frozen skips the lockfile freshness check
while still using pinned dependency versions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The update-packages job needs to push tags to the repository but was
missing the required `permissions: contents: write`. This caused the
workflow to fail with a 403 error when trying to push the version tag.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in publish-pypi job,
- only proceed if there are python packages to publish
- in publish-npm job,
- only proceed if there are npm packages to publish
