Current blocker
The Release to npm workflow for v0.1.17 completed checkout, package identity checks, dependency installation, lint, tests, build, package audit, and Sigstore provenance successfully. The final npm publish call failed with:
npm error E404 Not Found - PUT https://registry.npmjs.org/@sandbaseai%2fcli
The requested resource @sandbaseai/cli@0.1.17 could not be found or you do not have permission to access it.
Failed run: https://github.com/sandbaseai/cli/actions/runs/32213056689
This is consistent with the npm Trusted Publisher not being configured for the exact GitHub Actions identity. It is not a build or package-content failure.
Required npm configuration
In the npm settings for @sandbaseai/cli, configure a GitHub Actions trusted publisher with these exact values:
- GitHub owner / organization:
sandbaseai
- Repository:
cli
- Workflow file:
release.yml
- Environment:
npm-production
The workflow already grants id-token: write, uses Node 24 and npm 11, and intentionally does not set a publishing token.
Verification after configuration
- Re-run the failed
v0.1.17 publish job. Do not create or move the immutable tag.
- Verify
npm view @sandbaseai/cli@0.1.17 version returns 0.1.17.
- Confirm the
Publish to MCP Registry workflow is triggered by the successful release.
- Verify the registry response contains
io.github.sandbaseai/cli version 0.1.17:
curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.sandbaseai%2Fcli"
Why this matters
The repository already contains a valid server.json, but the official MCP Registry correctly refuses to publish an npm package version that is not publicly available. Completing Trusted Publishing unlocks both the normal npx @sandbaseai/cli installation path and official MCP Registry discovery.
Current blocker
The
Release to npmworkflow forv0.1.17completed checkout, package identity checks, dependency installation, lint, tests, build, package audit, and Sigstore provenance successfully. The finalnpm publishcall failed with:Failed run: https://github.com/sandbaseai/cli/actions/runs/32213056689
This is consistent with the npm Trusted Publisher not being configured for the exact GitHub Actions identity. It is not a build or package-content failure.
Required npm configuration
In the npm settings for
@sandbaseai/cli, configure a GitHub Actions trusted publisher with these exact values:sandbaseaiclirelease.ymlnpm-productionThe workflow already grants
id-token: write, uses Node 24 and npm 11, and intentionally does not set a publishing token.Verification after configuration
v0.1.17publish job. Do not create or move the immutable tag.npm view @sandbaseai/cli@0.1.17 versionreturns0.1.17.Publish to MCP Registryworkflow is triggered by the successful release.io.github.sandbaseai/cliversion0.1.17:curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.sandbaseai%2Fcli"Why this matters
The repository already contains a valid
server.json, but the official MCP Registry correctly refuses to publish an npm package version that is not publicly available. Completing Trusted Publishing unlocks both the normalnpx @sandbaseai/cliinstallation path and official MCP Registry discovery.