chore: run toolbox via npx instead of the bundled binary (#104)

Author: wangauone

.github/renovate.json5

@@ -21,18 +21,20 @@
       pinDigests: true,
     },
     {
-      matchPackageNames: ['googleapis/mcp-toolbox'],
-      'semanticCommitType': 'feat'
+      matchPackageNames: ['@toolbox-sdk/server'],
+      // Group the toolbox update under a stable branch name (renovate/toolbox).
+      groupName: 'toolbox',
+      semanticCommitType: 'feat',
     }
   ],
   customManagers: [
     {
+      // Track the npm toolbox server pinned in the extension's MCP command.
       customType: "regex",
-      managerFilePatterns: ["/toolbox_version\\.txt$/"],
-      matchStrings: ["(?<currentValue>[\\d\\.]+)"],
-      datasourceTemplate: "github-releases",
-      packageNameTemplate: "googleapis/mcp-toolbox",
-      extractVersionTemplate: "^v(?<version>.*)$",
+      managerFilePatterns: ["/gemini-extension\\.json$/"],
+      matchStrings: ["@toolbox-sdk/server@(?<currentValue>[\\d\\.]+)"],
+      datasourceTemplate: "npm",
+      depNameTemplate: "@toolbox-sdk/server",
     }
   ]
 }

.github/workflows/mirror-changelog.yml

@@ -15,12 +15,15 @@
 name: Mirror Toolbox Changelog
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, edited]
 
 jobs:
   add-release-notes:
-    if: github.actor == 'renovate-bot' && startsWith(github.head_ref, 'renovate/googleapis-mcp-toolbox')
+    # Renovate groups the npm toolbox update under groupName 'toolbox' (see
+    # renovate.json5), so its branch is renovate/toolbox. Release notes still come
+    # from googleapis/mcp-toolbox (same source repo), so the markers below are unchanged.
+    if: github.actor == 'renovate-bot' && startsWith(github.head_ref, 'renovate/toolbox')
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write

.github/workflows/package-and-upload-assets.yml

@@ -20,19 +20,15 @@ on:
 jobs:
   run-presubmit-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli
 
-      - name: Install toolbox binary
-        run: |
-          VERSION=$(cat toolbox_version.txt)
-          curl -L -o toolbox "https://storage.googleapis.com/mcp-toolbox-for-databases/v${VERSION}/linux/amd64/toolbox"
-          chmod +x toolbox
-
       - name: Install Extension
         run: npx gemini extensions validate .
         env:

.github/workflows/presubmit-tests.yml

@@ -137,5 +137,5 @@ Use `gemini --debug` to enable debugging.
 Common issues:
 
 * "✖ Error during discovery for server: MCP error -32000: Connection closed": The database connection has not been established. Ensure your configuration is set via environment variables.
-* "✖ MCP ERROR: Error: spawn /Users/USER/.gemini/extensions/postgres/toolbox ENOENT": The Toolbox binary did not download correctly. Ensure you are using Gemini CLI v0.6.0+.
-* "cannot execute binary file": The Toolbox binary did not download correctly. Ensure the correct binary for your OS/Architecture has been downloaded. See [Installing the server](https://mcp-toolbox.dev/documentation/introduction/#install-toolbox) for more information.
+* "✖ MCP ERROR: Error: spawn npx ENOENT": Node.js/`npx` is not installed or not on your `PATH`. Install Node.js (which provides `npx`).
+* "npm error"/network failures on first run: `npx` fetches `@toolbox-sdk/server` on first launch, so it needs network access. Retry once connectivity is available.

README.md

@@ -4,8 +4,10 @@
   "description": "Connect and interact with a PostgreSQL database and data",
   "mcpServers": {
     "postgresql": {
-      "command": "${extensionPath}${/}toolbox",
+      "command": "npx",
       "args": [
+        "-y",
+        "@toolbox-sdk/server@1.8.0",
         "--prebuilt",
         "postgres",
         "--stdio"