chore: run toolbox via npx instead of the bundled binary

.github/renovate.json5

@@ -21,18 +21,20 @@
       pinDigests: true,
     },
     {
-      matchPackageNames: ['googleapis/mcp-toolbox'],
-      'semanticCommitType': 'feat'
+      matchPackageNames: ['@toolbox-sdk/server'],
+      // Group the toolbox update under a stable branch name (renovate/toolbox).
+      groupName: 'toolbox',
+      semanticCommitType: 'feat',
     }
   ],
   customManagers: [
     {
+      // Track the npm toolbox server pinned in the extension's MCP command.
       customType: "regex",
-      managerFilePatterns: ["/toolbox_version\\.txt$/"],
-      matchStrings: ["(?<currentValue>[\\d\\.]+)"],
-      datasourceTemplate: "github-releases",
-      packageNameTemplate: "googleapis/mcp-toolbox",
-      extractVersionTemplate: "^v(?<version>.*)$",
+      managerFilePatterns: ["/gemini-extension\\.json$/"],
+      matchStrings: ["@toolbox-sdk/server@(?<currentValue>[\\d\\.]+)"],
+      datasourceTemplate: "npm",
+      depNameTemplate: "@toolbox-sdk/server",
     }
   ]
 }

.github/workflows/mirror-changelog.yml

@@ -15,12 +15,15 @@
 name: Mirror Toolbox Changelog
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, edited]
 
 jobs:
   add-release-notes:
-    if: github.actor == 'renovate-bot' && startsWith(github.head_ref, 'renovate/googleapis-mcp-toolbox')
+    # Renovate groups the npm toolbox update under groupName 'toolbox' (see
+    # renovate.json5), so its branch is renovate/toolbox. Release notes still come
+    # from googleapis/mcp-toolbox (same source repo), so the markers below are unchanged.
+    if: github.actor == 'renovate-bot' && startsWith(github.head_ref, 'renovate/toolbox')
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write

.github/workflows/presubmit-tests.yml

@@ -20,19 +20,15 @@ on:
 jobs:
   run-presubmit-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli
 
-      - name: Install toolbox binary
-        run: |
-          VERSION=$(cat toolbox_version.txt)
-          curl -L -o toolbox "https://storage.googleapis.com/mcp-toolbox-for-databases/v${VERSION}/linux/amd64/toolbox"
-          chmod +x toolbox
-
       - name: Install Extension
         run: npx gemini extensions validate .
         env:

DEVELOPER.md

@@ -75,14 +75,9 @@ are currently tested in the [MCP Toolbox GitHub](https://github.com/googleapis/g
 
 ## Building the Extension
 
-The "build" process for this extension involves packaging the extension's
-metadata files (`gemini-extension.json`, `sql-server.md`, `LICENSE`) along with the
-pre-built `toolbox` binary into platform-specific archives (`.tar.gz` or `.zip`).
-
-This process is handled automatically by the
-[`package-and-upload-assets.yml`](.github/workflows/package-and-upload-assets.yml)
-GitHub Actions workflow when a new release is created. Manual building is not
-required.
+No build step is required. The extension is a set of metadata files
+(`gemini-extension.json`, the context file, `LICENSE`); the MCP server is fetched
+and run at launch via `npx`, so there is no binary to compile or package.
 
 ## Maintainer Information
 
@@ -138,8 +133,4 @@ The process is handled by the [`mirror-changelog.yml`](.github/workflows/mirror-
 2.  **Merge Release PR:** A maintainer approves and merges the Release PR. This
     action triggers `release-please` to create a new GitHub tag and a
     corresponding GitHub Release.
-3.  **Package and Upload:** The new release triggers the
-    `package-and-upload-assets.yml` workflow. This workflow builds the
-    platform-specific extension archives and uploads them as assets to the
-    GitHub Release.
 

README.md

@@ -126,5 +126,5 @@ Use `gemini --debug` to enable debugging.
 Common issues:
 
 * "✖ Error during discovery for server: MCP error -32000: Connection closed": The database connection has not been established. Ensure your configuration is set via environment variables.
-* "✖ MCP ERROR: Error: spawn /Users/USER/.gemini/extensions/sql-server/toolbox ENOENT": The Toolbox binary did not download correctly. Ensure you are using Gemini CLI v0.6.0+.
-* "cannot execute binary file": The Toolbox binary did not download correctly. Ensure the correct binary for your OS/Architecture has been downloaded. See [Installing the server](https://mcp-toolbox.dev/documentation/introduction/#install-toolbox) for more information.
+* "✖ MCP ERROR: Error: spawn npx ENOENT": Node.js/`npx` is not installed or not on your `PATH`. Install Node.js (which provides `npx`).
+* "npm error"/network failures on first run: `npx` fetches `@toolbox-sdk/server` on first launch, so it needs network access. Retry once connectivity is available.

gemini-extension.json

@@ -4,8 +4,10 @@
   "description": "Connect to SQL Server",
   "mcpServers": {
     "sql_server": {
-      "command": "${extensionPath}${/}toolbox",
+      "command": "npx",
       "args": [
+        "-y",
+        "@toolbox-sdk/server@1.8.0",
         "--prebuilt",
         "mssql",
         "--stdio"