Version and identity

Use the catalog of the specific MCP connection to select instructions. A product label, a skill name or the Glyphs display name cannot identify an MCP interface by itself. The current lean catalog has twenty-one data/action tools plus the optional read-only card-display tool; the v1 catalog and its pinned Glyphs 3 skills remain separate.

Current source target

The release helper scripts/desktop_release_identity.py reads release.json and the Xcode project. The managed skill inventory comes from skills/manifest.json. This checkout currently targets:

Item	Value
Product version	2.4.0
Release version	2.4.0
Channel	stable
Beta number	0
Installer build	71
Lean interface	glyphs-mcp-sidecar
Interface revision	1
Bridge protocol	1
Managed skills	12
MCP tools	22
Job kinds	up to 13, capability-derived
Desktop payload targets	Glyphs 4 only
Separate pinned v1 release	1.11.0

Stable 2.4.0/build 71 is published under signed tag v2.4.0, with verified archives Glyphs-MCP-2.4.0.dmg and Glyphs-MCP-2.4.0.zip. The task-management update adds tasks.document-recovery.v1 and edit.queue.automatic.v1 while keeping interface revision 1, bridge protocol 1 and 22 tools.

Earlier stable 2.3.1/build 69 was published under signed tag v2.3.1, with archives Glyphs-MCP-2.3.1.dmg and Glyphs-MCP-2.3.1.zip. It makes development skills optional during setup and preserves local development copies with positive guidance. See the published release. Interface revision 1 and bridge protocol 1 remain unchanged.

Stable 2.3.0/build 68 is published under signed tag v2.3.0. See qualification.

Stable 2.1.0/build 63 is published under signed tag v2.1.0, with archive names Glyphs-MCP-2.1.0.dmg and Glyphs-MCP-2.1.0.zip. Public downloads were compared with the verified signed distribution before update-feed promotion.

Stable 2.0.4/build 61 is published under signed tag v2.0.4, with archive names Glyphs-MCP-2.0.4.dmg and Glyphs-MCP-2.0.4.zip. Stable 2.0.3, build 59, remains published under signed tag v2.0.3.

sidecarVersion and bridgeVersion are coordinated product versions. The lean interface revision identifies the lean capability-gated contract; the bridge protocol identifies the sidecar/native message contract. The dated MCP transport version is negotiated separately during initialization. These values need not match. The sixth job, outline_edit, is additive and appears only when the bridge advertises outline.edit.v1; an older coordinated installation reports five. Within that job, native shape-preserving remove_node is advertised separately through outline.remove-node.v1; older bridges retain the other outline operations but reject that operation before preparation. The seventh job, native_action, appears only with native.action.v1 and a nonempty filtered nativeActions catalog. Its action list is negotiated with the exact Glyphs build rather than inferred from protocol or product version. The eighth and ninth jobs, feature_compile and font_export, appear only when their live/saved compiler or static/variable export and verification capabilities are advertised. They reuse the same job lifecycle and do not add MCP endpoints. The tenth job, dimensions_edit, appears only with master.dimensions.edit.v1. It edits per-master reference notes; existing values require conversational overwrite approval, while blank fills do not. Independent Curve Inspector and Reference Inspector versions do not determine the MCP product version.

Verify an installation

Compare the freshly observed get_status result with that installation's manifest and receipt:

• release identifies the product/release version, channel, beta number and build.
• interface and interfaceVersion identify the lean interface. Check advertised readCapabilities, writeCapabilities, jobKinds and nativeActions for the requested workflow.
• Sidecar runtimeId combines its release with a short file fingerprint; codeHash gives the complete fingerprint. Check bridge.release, bridge.runtimeId and bridge.codeHash independently.
• bridge.host identifies the native application by bundle identifier, version and build. The v2 payload accepts com.GeorgSeifert.Glyphs4. Glyphs 3 uses its separate v1.11.0 distribution.

The fingerprint is computed from component files at initialization. It is not a hash of in-memory code, and changed installed files do not prove that the running process loaded them. Missing identity is unavailable evidence; differing expected and reported component hashes require investigation. Do not fabricate a match.

The MCP endpoint remains http://127.0.0.1:9680/mcp/ by default. Use the configured endpoint and Edit → Glyphs MCP Server… in the intended host. Verifying identity needs no document discovery or Save. Dirty-font state is unrelated to interface identification. During font work, retain the connection's known document ID and read fresh data; rediscover after stale-ID rejection or a known host/bridge restart.

Source, installation and release evidence

The previous 2.0.4/build 61 release uses signed source tag v2.0.4, archive names Glyphs-MCP-2.0.4.dmg and Glyphs-MCP-2.0.4.zip, and stable feed https://raw.githubusercontent.com/thierryc/Glyphs-mcp/main/appcast.xml. Published 2.0.1/build 56 has separate signing, notarization and bounded native acceptance. The signed 2.0.2 distribution has its own update/migration/recovery evidence on macOS 14.6.1 and 26.6.2 arm64. Optional Diffenator and Beztrace packages have bounded signed local Apple Silicon evidence; hosted assets and supported-platform qualification remain pending. See qualification. Preserve published tags, artifacts and signed feeds until final candidate verification and separately authorized promotion.

A source version states what a checkout is preparing. An installation receipt states which files were installed. A live status response identifies the loaded components' initialization-time fingerprints. Developer ID, notarization, Gatekeeper and signed-update acceptance require results for the exact final artifacts. None of these is established by a marketing label or a docs build.

Beta 7 passed signing, notarization and Gatekeeper and is published as a non-Latest GitHub prerelease. Its archived signed appcast describes its verified public archive. Its exact signed desktop-update/component-migration test remains unperformed; publication does not qualify that path. Exact evidence and remaining limits are recorded in BETA7-VALIDATION.md. Beta 6’s earlier successful update and migration test remains historical evidence in BETA6-VALIDATION.md. Physical Intel hardware and the broader manual/client matrix remain unverified beta coverage. A configured URL alone does not prove a feed or release is valid.

Beta 12/build 54 was the preceding unpublished local candidate with unsigned builds and scoped native qualification. No signed public Beta 12 distribution is available. Its planned tag is v2.0.0-beta.12; planned distribution filenames are Glyphs-MCP-2.0.0-beta.12.dmg and Glyphs-MCP-2.0.0-beta.12.zip. See BETA12-VALIDATION.md. Both main and the Beta branch now serve the unchanged signed stable feed, allowing existing beta installations to receive the published stable update.

Beta 11/build 53 is published under signed tag v2.0.0-beta.11, with Glyphs-MCP-2.0.0-beta.11.dmg and Glyphs-MCP-2.0.0-beta.11.zip. The exact signed beta feed advances after public archive verification. Qualification and remaining limits are recorded in BETA11-VALIDATION.md. Beta 10/build 52 and its qualification remain historical published evidence.

Beta 9 is published under tag v2.0.0-beta.9 and branch lit/v2-beta. Its feed is https://raw.githubusercontent.com/thierryc/Glyphs-mcp/lit/v2-beta/appcast.xml. Published beta artifacts include Glyphs-MCP-2.0.0-beta.9.dmg and Glyphs-MCP-2.0.0-beta.9.zip. A beta is a prerelease with make_latest=false; never publish Glyphs-MCP-latest.dmg for it. Stable releases use their separate feed and release process. Installer builds increase across beta and final releases; changing the label does not make an older build newer.

See migration, skill installation and conflicts, and packaging and release discovery.

Compiled comparison availability is independent: inspect comparisonWorker and comparisonCapabilities, requiring font.compare.diffenator.v1. The comparison job is file-bound and starts through compare_fonts; the document-bound jobKinds catalog retains its own capability gates.