A release workflow for an MCP server using Changesets, a tool that records changes and updates package versions and changelogs.

Use it when adding a changeset, choosing a major, minor, or patch version, creating a draft GitHub release, or publishing to npm or GitHub.

It gives contributors and maintainers a defined way to describe changes, prepare releases, test builds, and publish packages.

How PinMeTo/pinmeto-location-mcp configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to PinMeTo/pinmeto-location-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/PinMeTo/pinmeto-location-mcp/main/.claude/skills/release/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/PinMeTo/pinmeto-location-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pinmeto/pinmeto-location-mcp/release/github.svg)](https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release)

Your own site

<a href="https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release"><img src="https://agentmods.dev/badge/skills/pinmeto/pinmeto-location-mcp/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release"><img src="https://agentmods.dev/badge/skills/pinmeto/pinmeto-location-mcp/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 42 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 431 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 13
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 19
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00042	$0.00431
Opus 5.5	$0.00017	$0.00172
Sonnet 5.5	$0.00008	$0.00086
Haiku 4.5	$0.00004	$0.00043

Measured 2mo ago against content hash 74aadd91a7ac, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/release/SKILL.md · 45 lines

What it actually says

Release Workflow

This project uses Changesets for version management and changelog generation.

Adding Changes (Contributors)

npx changeset add          # Add a changeset for your changes
# Select: major/minor/patch
# Write: summary (appears in CHANGELOG)
git add .changeset/ && git commit -m "docs: add changeset"

⚠️ REQUIRED: Every PR must include a changeset. CI will reject PRs without one. For changes that don't affect the published package (docs, internal tooling), add an empty changeset with npx changeset add --empty.

Version Guidelines

patch: Bug fixes, documentation, internal changes
minor: New features, enhancements (backwards compatible)
major: Breaking changes (API changes, removed features)

Release Commands

npm run release:prepare    # Preview pending changesets
npm run release:version    # Bump version + update CHANGELOG + README badges
npm run release:draft      # Test, build, pack, create draft GitHub release
npm run release:publish    # Publish the draft release (or use GitHub UI)
npm run clean              # Remove build directory

Release Flow (Maintainers)

Run npm run release:prepare to see pending changes
Run npm run release:version to apply version bump
Commit: git add -A && git commit -m "chore: release vX.Y.Z"
Run npm run release:draft to create draft release
Review draft on GitHub, then run npm run release:publish
Push: git push && git push --tags

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 45 lines · 42 tokens per session scan A 74aadd91a7ac

Subscribe to this mod's changes

release is a skill published in the GitHub repository PinMeTo/pinmeto-location-mcp (15 stars, last pushed 2mo ago), licensed MIT. It adds 42 tokens to every session and 431 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Git and workflow Releases ai api-integration claude mcp mcp-server mcpserver

release next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
releasePinMeTo/pinmeto-location-mcp	Skill	15	2mo ago	MIT	A	42	Claude Code
release-changelog-harnessArenukvern/mcp_flutter	Skill	395	20d ago	MIT	A	84	Claude Code
polish-docs-metacyanheads/git-mcp-server	Skill	245	1mo ago	Apache-2.0	A	53	Claude Code, Codex
hmem-releaseBumblebiber/hmem	Skill	24	6d ago	MIT	A	50	Claude Code
release-managementsaidsef/mcp-github-pr-issue-analyser	Skill	6	2d ago	Apache-2.0	A	22	Claude Code, Codex
repository-manager-workspace-releaseKnuckles-Team/repository-manager	Skill	3	yesterday	MIT	A	191	Codex
release-versioningaethrox/doctrine	Skill	19	1mo ago	MIT	A	84	Claude Code, Codex

pinmeto-location-mcp: Skill for Claude Code