# nobrainer-tech-flow 2.7.1: the plugin ZIP declares the remote MCP server

Release date: 2026-10-25.

This release changes packaging and plugin metadata only. Skills, references, workflow
guidance, hooks and the module set (eighteen) do not change.

## Why

The OpenAI plugin directory review of the 2.7.0 ZIP reported two findings:

- "We are not accepting more skills-only submissions at this time." The remote MCP server
  was already connected in the portal, but the package did not declare it.
- "We couldn't complete an automated assessment of your privacy policy." The manifest
  linked `docs/PRIVACY.md` on GitHub, which described a skills-only package with no
  publisher backend.

## What changes

- `scripts/build_plugin.py` writes `.mcp.json` into the ZIP with exactly
  `{"mcpServers": {"nobrainer-tech-flow": {"url": "https://mcp.nobrainer.tech/mcp"}}}`,
  the shape OpenAI requires for Codex packages (one remote server, no `type`, `$schema` or
  headers), and adds `"mcpServers": "./.mcp.json"` to the ZIP's `.codex-plugin/plugin.json`.
- The file is generated only into the ZIP. The repository root is also the Claude Code and
  Codex marketplace plugin root, so a root `.mcp.json` would connect every marketplace
  install to the remote server. The repository's own `.codex-plugin/plugin.json` has no
  `mcpServers` field, so it never references a file absent at the root.
- `privacyPolicyURL` is now https://nobrainer.tech/flow/privacy/ and `termsOfServiceURL`
  https://nobrainer.tech/flow/terms/ in `.codex-plugin/plugin.json` and `plugin.json`.
- The plugin descriptions drop "delegates ready work": one main loop does the work and
  native workers are used only for parallel work, context isolation, independent review or
  specialization, as in 2.7.0. The long description names the server's six read-only tools.
- `docs/PRIVACY.md` and `docs/CHAT_PLUGINS.md` say the ZIP declares the optional server and
  link its full policy and terms.
- Tests: `tests/test_mcp_isolation.py` checks the built ZIP's `.mcp.json` (one entry, exact
  shape, no headers) and the manifest reference; `tests/test_suite.py` checks the new URLs
  and that the repository root declares no MCP server.

## Known limit

Claude expects `"type": "http"` for a remote server. `claude plugin validate` on the
extracted ZIP reports the `.mcp.json` entry as an error and states that Claude Code drops
such an entry at load. The Claude directory tracks the separate skills-only export
(`nobrainer-tech/nobrainer-tech-flow-plugin`), which should not copy `.mcp.json` or the
`mcpServers` manifest line. A direct Claude upload of this ZIP was not tested.

## Verification

Recorded on the release branch before merge:

- `python3 scripts/validate_skills.py` and `python3 scripts/validate_skills.py --suite`: OK.
- `python3 -m unittest discover -s tests`: 583 tests, OK (5 skipped).
- `scripts/build_plugin.py` built a 145-file ZIP (version 2.7.1, 18 skills, no hooks) with `.mcp.json`
  (107 bytes) at the root and `"mcpServers": "./.mcp.json"` in `.codex-plugin/plugin.json`.
- https://nobrainer.tech/flow/privacy/ and https://nobrainer.tech/flow/terms/ returned HTTP 200.
- `git diff --check` and gitleaks on the staged diff: clean.

Not verified: the OpenAI directory review of the 2.7.1 ZIP, and the published release.