npm-launcher npx anything, anywhere.

SHA256 verified

Every binary is checked against checksums from the same GitHub Release. Mismatches abort and clean up.

Atomic downloads

Writes to .tmp, verifies, then renames. Interrupted downloads never poison the cache.

Zero dependencies

Pure Node.js stdlib. No node-fetch, no got, nothing to audit. Ships at about 20 kB.

Cache-first

Downloads once per version, then runs from local cache. Second launch is instant.

Quiet mode

Set MCPTOOLSHOP_LAUNCHER_QUIET=1 for script-friendly silent operation. Errors always print.

Transparent to the tool

Every argument reaches the tool, --version and --help included, and the tool sees its own name as argv[0].

Concurrent-safe

File locking prevents race conditions when multiple npx invocations download the same binary.

1. Build binaries in CI

# PyInstaller matrix → GitHub Release assets
sovereignty-1.4.0-linux-x64
sovereignty-1.4.0-darwin-arm64
sovereignty-1.4.0-darwin-x64
sovereignty-1.4.0-win-x64.exe
checksums-1.4.0.txt

2. Write a tiny wrapper

#!/usr/bin/env node
process.env.MCPTOOLSHOP_LAUNCH_CONFIG = JSON.stringify({
  toolName: "sovereignty",
  owner: "mcp-tool-shop-org",
  repo: "sovereignty",
  version: "1.4.0",
});
require("@mcptoolshop/npm-launcher/bin/mcptoolshop-launch.js");