Install · MCPG

Install

Pick the install path that fits.

MCPG ships as a single Rust binary. Linux x86_64 (glibc + musl), Linux aarch64, and macOS aarch64 are first-class targets. Windows is not currently supported (it works under WSL2).

Cargo install

Fastest path on a dev machine. Requires a Rust toolchain (1.77+). Compiles in under two minutes on a modern laptop.

bash

cargo install mcpg-ctl
cargo install mcpg

Verify

Confirm a release is genuine.

Every release is SLSA L3-attested. Plugin artifacts are Ed25519-signed. The CP audit ledger entries are signed. Verify before deploying.

bash

# Verify release signature
cosign verify-blob \
  --certificate mcpg.tar.gz.cert \
  --signature mcpg.tar.gz.sig \
  --certificate-identity-regexp 'github.com/mcpg-dev/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  mcpg.tar.gz

See the security model article for details on the signing chain.