feat(mcp): run server from Rust binary

.github/workflows/mcp-release.yml

@@ -51,7 +51,7 @@ jobs:
       - name: Install native build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libsecret-1-dev
+          sudo apt-get install -y libfontconfig1-dev libsecret-1-dev
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -77,12 +77,36 @@ jobs:
             "packages/node-core/package.json",
             "packages/cli/package.json",
             "packages/mcp-server/package.json",
+            "packages/mcp-darwin-arm64/package.json",
+            "packages/mcp-darwin-x64/package.json",
+            "packages/mcp-linux-arm64-gnu/package.json",
+            "packages/mcp-linux-x64-gnu/package.json",
+            "packages/mcp-win32-arm64/package.json",
+            "packages/mcp-win32-x64/package.json",
           ]) {
             const pkg = readJson(path);
             pkg.version = version;
             writeJson(path, pkg);
           }
 
+          const mcpPackagePath = "packages/mcp-server/package.json";
+          const mcpPackage = readJson(mcpPackagePath);
+          for (const dependency of Object.keys(mcpPackage.optionalDependencies ?? {})) {
+            if (dependency.startsWith("@dbx-app/mcp-")) {
+              mcpPackage.optionalDependencies[dependency] = version;
+            }
+          }
+          writeJson(mcpPackagePath, mcpPackage);
+
+          const lockPath = "pnpm-lock.yaml";
+          let lockfile = fs.readFileSync(lockPath, "utf8");
+          for (const dependency of Object.keys(mcpPackage.optionalDependencies ?? {})) {
+            const escapedDependency = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const specifierPattern = new RegExp(`('${escapedDependency}':\\n\\s+specifier: )[^\\n]+`);
+            lockfile = lockfile.replace(specifierPattern, `$1${version}`);
+          }
+          fs.writeFileSync(lockPath, lockfile);
+
           const serverPath = "packages/mcp-server/server.json";
           const server = readJson(serverPath);
           server.version = version;
@@ -93,10 +117,17 @@ jobs:
           }
           writeJson(serverPath, server);
 
+          const cargoPath = "crates/dbx-mcp/Cargo.toml";
+          const cargo = fs.readFileSync(cargoPath, "utf8").replace(/^version = "[^"]+"/m, `version = "${version}"`);
+          fs.writeFileSync(cargoPath, cargo);
+
           fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\n`);
           fs.appendFileSync(process.env.GITHUB_OUTPUT, `tag=packages-v${version}\n`);
           NODE
 
+      - name: Update Rust lockfile
+        run: cargo check -p dbx-mcp --no-default-features
+
       - name: Run package tests
         run: pnpm test:packages
 
@@ -111,7 +142,7 @@ jobs:
       - name: Commit package release version
         run: |
           VERSION="${{ steps.version.outputs.version }}"
-          git add packages/mongo-shell/package.json packages/node-core/package.json packages/cli/package.json packages/mcp-server/package.json packages/mcp-server/server.json
+          git add Cargo.lock pnpm-lock.yaml crates/dbx-mcp/Cargo.toml packages/mongo-shell/package.json packages/node-core/package.json packages/cli/package.json packages/mcp-server/package.json packages/mcp-server/server.json packages/mcp-*/package.json
           if git diff --cached --quiet; then
             echo "Package versions already committed for ${VERSION}."
           else
@@ -243,18 +274,10 @@ jobs:
           pnpm --filter @dbx-app/node-core publish --access public --provenance --no-git-checks
           echo "published_or_existing=true" >> "$GITHUB_OUTPUT"
 
-  publish-leaf-packages:
-    name: Publish ${{ matrix.package-name }}
+  publish-cli:
+    name: Publish @dbx-app/cli
     runs-on: ubuntu-latest
     needs: [prepare, publish-node-core]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - package-name: "@dbx-app/cli"
-            filter: "@dbx-app/cli"
-          - package-name: "@dbx-app/mcp-server"
-            filter: "@dbx-app/mcp-server"
 
     steps:
       - uses: actions/checkout@v5
@@ -287,19 +310,151 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           VERSION: ${{ needs.prepare.outputs.version }}
-          PACKAGE_NAME: ${{ matrix.package-name }}
-          PACKAGE_FILTER: ${{ matrix.filter }}
         run: |
-          if npm view "${PACKAGE_NAME}@${VERSION}" version >/dev/null 2>&1; then
-            echo "${PACKAGE_NAME}@${VERSION} already exists on npm; skipping."
+          if npm view "@dbx-app/cli@${VERSION}" version >/dev/null 2>&1; then
+            echo "@dbx-app/cli@${VERSION} already exists on npm; skipping."
             exit 0
           fi
-          pnpm --filter "${PACKAGE_FILTER}" publish --access public --provenance --no-git-checks
+          pnpm --filter "@dbx-app/cli" publish --access public --provenance --no-git-checks
+
+  publish-mcp-platforms:
+    name: Publish ${{ matrix.package-name }}
+    needs: prepare
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            target: aarch64-apple-darwin
+            package-dir: mcp-darwin-arm64
+            package-name: "@dbx-app/mcp-darwin-arm64"
+            binary: dbx-mcp
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+            package-dir: mcp-darwin-x64
+            package-name: "@dbx-app/mcp-darwin-x64"
+            binary: dbx-mcp
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            package-dir: mcp-linux-arm64-gnu
+            package-name: "@dbx-app/mcp-linux-arm64-gnu"
+            binary: dbx-mcp
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            package-dir: mcp-linux-x64-gnu
+            package-name: "@dbx-app/mcp-linux-x64-gnu"
+            binary: dbx-mcp
+          - runner: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            package-dir: mcp-win32-arm64
+            package-name: "@dbx-app/mcp-win32-arm64"
+            binary: dbx-mcp.exe
+          - runner: windows-2025
+            target: x86_64-pc-windows-msvc
+            package-dir: mcp-win32-x64
+            package-name: "@dbx-app/mcp-win32-x64"
+            binary: dbx-mcp.exe
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ needs.prepare.outputs.tag }}
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: dbx-mcp-${{ matrix.target }}
+
+      - name: Install Linux native dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libfontconfig1-dev
+
+      - name: Build Rust MCP binary
+        shell: bash
+        run: cargo build --release -p dbx-mcp --target "${{ matrix.target }}"
+
+      - name: Stage platform package
+        shell: bash
+        run: |
+          mkdir -p "packages/${{ matrix.package-dir }}/bin"
+          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "packages/${{ matrix.package-dir }}/bin/${{ matrix.binary }}"
+          if [[ "${{ runner.os }}" != "Windows" ]]; then
+            chmod +x "packages/${{ matrix.package-dir }}/bin/${{ matrix.binary }}"
+          fi
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          registry-url: https://registry.npmjs.org
+
+      - name: Publish platform package
+        shell: bash
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          if npm view "${{ matrix.package-name }}@${VERSION}" version >/dev/null 2>&1; then
+            echo "${{ matrix.package-name }}@${VERSION} already exists on npm; skipping."
+            exit 0
+          fi
+          npm publish "./packages/${{ matrix.package-dir }}" --access public --provenance
+
+  publish-mcp-server:
+    name: Publish @dbx-app/mcp-server
+    runs-on: ubuntu-latest
+    needs: [prepare, publish-mcp-platforms]
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ needs.prepare.outputs.tag }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Publish MCP launcher
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          for package in \
+            @dbx-app/mcp-darwin-arm64 \
+            @dbx-app/mcp-darwin-x64 \
+            @dbx-app/mcp-linux-arm64-gnu \
+            @dbx-app/mcp-linux-x64-gnu \
+            @dbx-app/mcp-win32-arm64 \
+            @dbx-app/mcp-win32-x64; do
+            npm view "${package}@${VERSION}" version >/dev/null 2>&1 || {
+              echo "${package}@${VERSION} is not available on npm; refusing to publish @dbx-app/mcp-server."
+              exit 1
+            }
+          done
+          if npm view "@dbx-app/mcp-server@${VERSION}" version >/dev/null 2>&1; then
+            echo "@dbx-app/mcp-server@${VERSION} already exists on npm; skipping."
+            exit 0
+          fi
+          pnpm --filter "@dbx-app/mcp-server" publish --access public --provenance --no-git-checks
 
   publish-homebrew-formula:
     name: Publish Homebrew formula
     runs-on: ubuntu-latest
-    needs: [prepare, publish-leaf-packages]
+    needs: [prepare, publish-cli, publish-mcp-server]
     steps:
       - name: Download CLI npm tarball and compute SHA256
         id: cli-hash