Packaged `.dxt` binary file loses executable permission (throws EACCES error)

[aaj3f]

When using dxt pack (from @anthropic-ai/dxt npm package), and when using it specifically for a manifest configured for a binary, the dxt-packaged binary loses its execution permissions, such that when Claude Desktop goes to run the binary from its new .../Claude Extensions/... location, it encounters EACCES errors. (Notice below the -rwxr-xr-x and 755 confirming execution perms)

$ ls
fluree_favicon.png      manifest.json           nexus-mcp-server
$ ls -la nexus-mcp-server 
-rwxr-xr-x@ 1 ajohnson  staff  13495120 Jun 27 10:30 nexus-mcp-server
$ stat -f "%A %N" ./nexus-mcp-server
755 ./nexus-mcp-server
$ dxt pack
Validating manifest...
Manifest is valid!

📦  fluree-mcp-server@1.0.0
Archive Contents
   1.7kB fluree_favicon.png
   2.1kB manifest.json
  12.9MB nexus-mcp-server

Archive Details
name: fluree-mcp-server
version: 1.0.0
filename: fluree-mcp-server-1.0.0.dxt
package size: 5.0MB
unpacked size: 12.9MB
shasum: ea68fdf696dd4ac3a4c10bb8c5c725c3790e00dd
total files: 3
ignored (.dxtignore) files: 1

Output: /Users/ajohnson/fluree/rust/nexus-mcp-server/assets/assets.dxt

Then proceed to open & install the extension with Claude Desktop. When I enable the extension and look in the mcp-server-fluree-mcp-server.log file, I see...

2025-06-27T15:02:47.628Z [fluree-mcp-server] [info] Initializing server... { metadata: undefined }
2025-06-27T15:02:47.645Z [fluree-mcp-server] [error] spawn /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server EACCES {
  metadata: {
    context: 'connection',
    stack: 'Error: spawn /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server EACCES\n' +
      '    at ChildProcess._handle.onexit (node:internal/child_process:285:19)\n' +
      '    at onErrorNT (node:internal/child_process:483:16)\n' +
      '    at process.processTicksAndRejections (node:internal/process/task_queues:90:21)'
  }
}
2025-06-27T15:02:47.645Z [fluree-mcp-server] [error] spawn /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server EACCES {
  metadata: {
    stack: 'Error: spawn /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server EACCES\n' +
      '    at ChildProcess._handle.onexit (node:internal/child_process:285:19)\n' +
      '    at onErrorNT (node:internal/child_process:483:16)\n' +
      '    at process.processTicksAndRejections (node:internal/process/task_queues:90:21)'
  }
}
2025-06-27T15:02:47.646Z [fluree-mcp-server] [info] Server transport closed { metadata: undefined }
2025-06-27T15:02:47.646Z [fluree-mcp-server] [info] Client transport closed { metadata: undefined }
2025-06-27T15:02:47.646Z [fluree-mcp-server] [info] Server transport closed unexpectedly, this is likely due to the process exiting early. If you are developing this MCP server you can add output to stderr (i.e. `console.error('...')` in JavaScript, `print('...', file=sys.stderr)` in python) and it will appear in this log. { metadata: undefined }
2025-06-27T15:02:47.647Z [fluree-mcp-server] [error] Server disconnected. For troubleshooting guidance, please visit our [debugging documentation](https://modelcontextprotocol.io/docs/tools/debugging) { metadata: { context: 'connection', stack: undefined } }

I can confirm we have lost execute permissions by running the following (notice below the -rw-r--r-- and 644 non-executable perms)

$ ls ~/Library/Application\ Support/Claude/Claude\ Extensions/local.dxt.fluree-pbc.fluree-mcp-server/
fluree_favicon.png      manifest.json           nexus-mcp-server
$ ls -la ~/Library/Application\ Support/Claude/Claude\ Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server 
-rw-r--r--@ 1 ajohnson  staff  13495120 Jun 27 11:02 /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server
$ stat -f "%A %N" ~/Library/Application\ Support/Claude/Claude\ Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server 
644 /Users/ajohnson/Library/Application Support/Claude/Claude Extensions/local.dxt.fluree-pbc.fluree-mcp-server/nexus-mcp-server

The full manifest is as follows:

manifest.json

{
  "dxt_version": "0.1",
  "name": "fluree-mcp-server",
  "version": "1.0.0",
  "description": "An MCP Server for performing GraphRAG against Fluree datasets.",
  "long_description": "This MCP Server allows you to perform GraphRAG operations against Fluree datasets. It connects to the Fluree database using the provided account credentials and datasets. For more information visit https://developers.flur.ee/docs/cloud/how-to/chat/intro/",
  "author": {
    "name": "Fluree, PBC",
    "email": "support@flur.ee",
    "url": "https://flur.ee"
  },
  "icon": "fluree_favicon.png",
  "server": {
    "type": "binary",
    "entry_point": "nexus-mcp-server",
    "mcp_config": {
      "command": "${__dirname}/nexus-mcp-server",
      "args": [
        "--dataset",
        "${user_config.dataset}",
        "--fluree-api-key",
        "${user_config.fluree_username}=${user_config.api_key}"
      ],
      "env": {
        "RUST_LOG": "debug",
        "SERVER_PORT": "3456",
        "MCP_TRANSPORT": "stdio"
      }
    }
  },
  "tools": [
    {
      "name": "get_data_model",
      "description": "Get the data model for the current session's datasets."
    },
    {
      "name": "sparql_query",
      "description": "Execute a SPARQL query against the current session's datasets"
    }
  ],
  "user_config": {
    "fluree_username": {
      "type": "string",
      "title": "Fluree Account Username",
      "description": "e.g. ajohnson",
      "required": true,
      "sensitive": false
    },
    "api_key": {
      "type": "string",
      "title": "Fluree Account-Wide API Key",
      "description": "e.g. ABCD...1234",
      "required": true,
      "sensitive": true
    },
    "dataset": {
      "type": "string",
      "title": "Fluree Datasets",
      "description": "e.g. ajohnson/HardwareSupplyChain",
      "long_description": "The dataset for this MCP server to access. This need to be available to your account (as a public dataset, or with you as the owner or collaborator).",
      "required": true,
      "sensitive": false
    }
  },
  "compatibility": {
    "claude_desktop": ">=0.10.0",
    "platforms": ["darwin"]
  },
  "license": "MIT"
}

[aaj3f]

Uncanny -- exact issue got opened by @ishaq-fynd in #12 while I was submitting this one. Feel free to close this as duplicate as needed

[aaj3f]

@felixrieseberg -- insofar as the code responsibility of this repo is concerned, I believe that merged PR #14 resolves this (and #12), although I think the issue won't be fixed for end users until Claude Desktop also makes the change to preserve unix permissions when unpacking the .dxt & writing the unpacked files to the .../Claude Extensions/local.dxt.[extension]/ dir. Arguably, though, these two issues could maybe be closed if considered as issues for the dxt CLI specifically.

[alocay]

@aaj3f so there are two issues here, one within DXT which was fixed by #14 and another within Claude Desktop which will still strip off the permissions on installation?

[winston-bosan]

@aaj3f so there are two issues here, one within DXT which was fixed by #14 and another within Claude Desktop which will still strip off the permissions on installation?

I think so - as of Claude 0.11.3 (58ae3f) for mac, it is still erasing the exec permission bit.

[aaj3f]

@aaj3f so there are two issues here, one within DXT which was fixed by #14 and another within Claude Desktop which will still strip off the permissions on installation?

@alocay Yes, that is my understanding. My PR #14 fixes the one issue where packing the .dxt was not preserving unix permissions. But it seems clear that the process by which Claude Desktop unpacks that .dxt & writes the files to, for example, .../Claude Extensions/local.dxt.<extension name>/... is also facing an issue w/ preserving those unix permissions.

I don't think there's currently any possible workaround for that (short of asking your users to chmod those extracted files, which seems to undermine the value proposition of this lovely .dxt installation pattern entirely). I've just been trying to keep an eye on new Claude Desktop releases (and, unfortunately, in the meantime I've also just re-written my rust mcp server / .dxt in ts/node instead).

[erik-at-flipside]

Just opened a similar PR to preserve on the unpack side of things as well
#43

[alocay]

Just opened a similar PR to preserve on the unpack side of things as well #43

The unpacking is handled by dxt and not done by Claude Desktop itself?

[erik-at-flipside]

@alocay that I do not know. I suspect that Claude Desktop is probably using this dxt package under the hood, but they could also have their own way of unpacking separate to this repo.

[alocay]

I'm noticing that I'm still seeing this issue on version 0.2.4 (should include the the change from #43 ). Is this expected?

[jochenchrist]

I guess we need to wait for an updated Claude Desktop version.
Seems like latest version is 0.11.6 (0aa9ce) 2025-06-29T21:59:05.000Z

[korotovsky]

@aaj3f

I don't think there's currently any possible workaround for that (short of asking your users to chmod those extracted files, which seems to undermine the value proposition of this lovely .dxt installation pattern entirely).

In my MCP I workarounded using node wrapper and checking permissions and adding fs.constants.S_IXUSR | fs.constants.S_IXGRP | fs.constants.S_IXOTH; if missing 😥 Super ugly but it works quite smooth with my go binaries.

[jochenchrist]

Still having the issue with Claude Desktop 0.12.16 (fae442) 2025-07-14T19:10:28.000Z