Capability bundles from a URL

A bundle is a packaged MCP server or Agent Skill that you host yourself. Workspace owners and admins add it by URL, and members' computers download, verify and run it locally when an agent, workflow step or assistant uses it. Publishers keep their source private and release new versions on their own schedule.

Bundles extend the Capability Catalog. Assignment, access policies and required or optional rules work the same way as for any other capability.

Add a bundle

1. Open Settings → Capabilities, then Add MCP or Add skill.
2. Select the Bundle URL tab.
3. Enter an HTTPS URL for a package or a release feed. The URL can't contain a username, password, query string or fragment.
4. Choose Authentication: None, Bearer token (recommended) or Basic auth, and enter the credential.
5. Select Validate. One Horizon downloads the bundle, checks it without running it, and shows its name, version, server type, signer, platforms and file count.
6. Read the Third-party code notice, check I trust this publisher, then select Add.

An MCP server with a secret setting continues to its authentication step, where you add the token the server needs at run time. That runtime token is separate from the download credential.

Members need One Horizon Desktop or the CLI at a version that supports bundles. Older versions see "Update One Horizon Desktop or CLI to use this bundle." A required bundle stops the run before it starts; an optional one is listed as a limitation.

Package formats

A bundle holds one MCP server or one skill, with its supporting files. A ZIP with several skills is rejected with the folders it found; publish each skill separately.

MCPB user_config. Fields with a default are filled in from that default. At most one sensitive string field is supported, and it must fill one whole environment variable in server.mcp_config.env; admins set its value in the server's authentication settings. directory and file fields, multiple fields, required fields without a default, and secrets in arguments are rejected with the field names.

Versions. A feed version is used as is. For a direct URL, the MCPB version or the skill's metadata.version is used. Without one, the version is sha256- plus the first 12 characters of the package digest.

Publish a release feed

A release feed lists versions and per-platform packages. One Horizon installs the highest stable version and ignores prereleases.

{  "schemaVersion": 1,  "type": "mcp",  "name": "acme-search",  "versions": [    {      "version": "1.5.0",      "packages": [        { "url": "packages/acme-search-1.5.0-darwin-arm64.mcpb", "sha256": "4f2a…", "platform": "darwin", "arch": "arm64" },        { "url": "packages/acme-search-1.5.0-linux-x64.mcpb", "sha256": "9c1e…", "size": 18432000, "platform": "linux", "arch": "x64" },        { "url": "https://downloads.acme.com/acme-search-1.5.0-win32-x64.mcpb", "sha256": "b70d…", "platform": "win32", "arch": "x64" }      ]    }  ]}

A package without platform and arch runs anywhere its manifest allows. For a binary server, One Horizon reads the executable's header to confirm its operating system and CPU; a universal macOS binary covers both x64 and arm64.

Hosting and authentication

• The download credential is bound to the origin of the URL you entered, such as https://packages.acme.com. One Horizon sends it only to that origin.
• Package links and redirects to another origin, such as signed S3 or CDN URLs, are fetched without the credential. Once a redirect leaves the origin, the credential isn't sent again, even if a later redirect returns.
• Treat signed URLs as secrets. One Horizon uses them once and never stores, logs or shows them.
• Up to 3 redirects are followed, all over HTTPS. Addresses in private, loopback, link-local or other reserved ranges are refused.
• Credentials are stored encrypted and never shown again. Members' computers never receive them.

Integrity, signing and trust

• Every package is pinned by its SHA-256 digest. A feed must publish sha256 for each package, and a mismatch stops the install. A direct URL is pinned to the bytes One Horizon downloaded.
• MCPB packages signed with mcpb sign are checked. A signature that doesn't match the package is rejected. A valid signature shows its signer; one that doesn't chain to a trusted certificate authority shows as "not verified". Unsigned packages show Unsigned. Skill ZIPs have no signature format and rely on the digest.
• Validation checks structure and integrity. It doesn't check whether the software is safe. A bundle runs on each member's computer with that member's permissions, so add bundles only from publishers you trust.
• One Horizon never runs bundle code on its servers. Inspection only reads files.

Updates and pinning

Open the bundle in Settings → Capabilities:

• Check for updates downloads and validates the latest version. A new version, or the same version number with changed contents, is staged as available. The installed version keeps working.
• Update to a new version requires the same trust confirmation as adding the bundle.
• Discard update drops the staged version.

Sessions that already started keep the exact version and digest they began with. New sessions use the approved version.

Replace token rotates the download credential in place. Remove credential deletes it. Without a working credential, checks and updates for a private bundle fail with an authentication error, while versions you already approved keep working until you remove the bundle.

On members' computers

Before a run or an assistant turn, Desktop and the CLI pick the package for the computer's operating system and CPU, download it from One Horizon, and verify its digest. Verified packages are kept read-only in ~/.one/capabilities/cache/packages, so a later start uses the cached copy without downloading. A cached package that changed is removed and downloaded again once.

Node.js, Python and uv servers need that runtime on PATH, at the version the manifest requires. Run activity shows when a package is downloading and how long preparation took.

Limits

Archives are also rejected for .. paths, absolute, drive-letter or UNC paths, backslashes, Windows reserved names, names ending in a dot or space, links, and names that differ only by case.

Troubleshooting

Test a bundle source

The repository's acceptance suite runs a local publisher simulator with these cases, including authentication, signed redirects and hostile archives:

yarn workspace @one/tools-acceptance test:bundles

Gateway's inspection rules have their own tests:

yarn go:test ./apps/api/gateway/routes/ -run 'Bundle'