v0.26.0

Serve MCP exposures from the server built into peppy by listing them in a launcher, with no node to generate or build.

Released on August 26, 2026

peppy repo exposure is removed, and an exposure is no longer a committed bundle plus a generated MCP server node. Validate exposures with peppy repo index --check --validate-mcp-exposures and delete the old generated artifacts.
Serve an exposure from a launcher's source: { exposures: ["<name>:<tag>", ...] } instead of deploying its generated <name>_mcp node; the server built into peppy binds 127.0.0.1:<port>, one endpoint per exposure at /<name>/<tag>/mcp.
peppy mcp catalog <name:tag> prints the catalog an endpoint advertises: every resource, tool, and task with its public name, policies, and derived JSON Schemas.
A target's contract sha256 is now optional; omit it and the exposure follows the contract as its repository evolves, with each launch pinning the bytes it resolves.
One deployment can serve several exposures on a single port, sharing a contract slot when two exposures name the same target and the same contract.
peppy stack list adds an Instance endpoints table listing each endpoint URL an instance serves.
Exposure deployments work in a federated launch: the exposure documents and the contracts they reference are pinned and shipped to the machine hosting the instance.
A new default mcp-hub repository resolves the MCP exposure documents a launcher lists.
An exposure manifest may carry a labels list of free-form strings for whoever browses the repository.