diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e3ffb54..f4133b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,8 +2,6 @@ name: Release
 
 on:
   push:
-    branches:
-      - main
     tags:
       - 'v*'
 
@@ -20,49 +18,27 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Determine Version Tag & Generate Notes
+      - name: Prepare Release Notes
         id: versioning
         run: |
-          PREV_TAG=$(git tag -l "v*" --sort=-v:refname | head -n1)
-          echo "Previous tag: $PREV_TAG"
-
-          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
-            TAG="${GITHUB_REF#refs/tags/}"
-          else
-            if [ -z "$PREV_TAG" ]; then
-              TAG="v1.0.0"
+          TAG="${GITHUB_REF#refs/tags/}"
+          git fetch --tags --force
+          PREV_TAG=$(git tag -l "v*" --sort=-v:refname | grep -Fxv "$TAG" | head -n1 || true)
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          {
+            echo "### 🚀 What's Changed in ${TAG}"
+            echo
+            if [ -n "$PREV_TAG" ]; then
+              git log "${PREV_TAG}..${TAG}" --pretty=format:"- %s (%h by @kyaring)"
             else
-              VER_NUM="${PREV_TAG#v}"
-              IFS='.' read -r MAJOR MINOR PATCH <<< "$VER_NUM"
-              PATCH=$((PATCH + 1))
-              TAG="v${MAJOR}.${MINOR}.${PATCH}"
+              git log -n 10 --pretty=format:"- %s (%h by @kyaring)"
             fi
-            echo "Auto incremented patch version to $TAG"
-            
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git tag "$TAG"
-            git push origin "$TAG"
-          fi
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-
-          # 生成详细的 Release Changelog 正文
-          cat << NOTES > release_notes.md
-          ### 🚀 What's Changed in ${TAG}
-
-          NOTES
-
-          if [ -n "$PREV_TAG" ]; then
-            git log "${PREV_TAG}..HEAD" --pretty=format:"- %s (%h by @kyaring)" >> release_notes.md
-          else
-            git log -n 10 --pretty=format:"- %s (%h by @kyaring)" >> release_notes.md
-          fi
-
-          echo "" >> release_notes.md
-          echo "" >> release_notes.md
-          if [ -n "$PREV_TAG" ]; then
-            echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...${TAG}" >> release_notes.md
-          fi
+            echo
+            echo
+            if [ -n "$PREV_TAG" ]; then
+              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...${TAG}"
+            fi
+          } > release_notes.md
           cat release_notes.md
 
       - name: Set up Go
@@ -81,6 +57,9 @@ jobs:
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w" -o dist/vps-commander-hub-linux-arm64 ./cmd/hub
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w" -o dist/vps-commander-agent-linux-arm64 ./cmd/agent
 
+          # MCP stdio（与 Gitea 本地发布保持一致）
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "-s -w" -o dist/vps-commander-mcp-stdio-linux-amd64 ./cmd/mcp-stdio
+
           # Checksums
           cd dist
           sha256sum * > checksums.txt
diff --git a/deploy/upgrade-agent.sh b/deploy/upgrade-agent.sh
index 4175924..f7d697b 100755
--- a/deploy/upgrade-agent.sh
+++ b/deploy/upgrade-agent.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e
+set -euo pipefail
 
 # VPS-Commander Agent 一键安全升级脚本
 # Repo: https://github.com/kyaring/vps-commander
@@ -7,28 +7,19 @@ set -e
 REPO="kyaring/vps-commander"
 INSTALL_DIR="/opt/vps-commander"
 GITHUB_URL="https://github.com"
+API_URL="https://api.github.com"
 
-# 颜色输出
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m'
-
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
 info() { echo -e "${BLUE}[INFO]${NC} $*"; }
 success() { echo -e "${GREEN}[SUCCESS]${NC} $*"; }
 warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
 
-# 检查 root 权限
 [[ $EUID -ne 0 ]] && error "必须使用 root 权限运行此脚本"
+[ -f "${INSTALL_DIR}/vps-commander-agent" ] || error "未检测到已安装的 Agent (${INSTALL_DIR}/vps-commander-agent)，请先使用 install.sh 完整安装。"
+command -v curl >/dev/null 2>&1 || error "系统缺少 curl"
+command -v sha256sum >/dev/null 2>&1 || error "系统缺少 sha256sum，无法安全校验 Release"
 
-# 检查是否安装过 agent
-if [ ! -f "${INSTALL_DIR}/vps-commander-agent" ]; then
-    error "未检测到已安装的 Agent (${INSTALL_DIR}/vps-commander-agent)，请先使用 install.sh 完整安装。"
-fi
-
-# 架构检测
 ARCH=$(uname -m)
 case "$ARCH" in
     x86_64|amd64) TARGET_ARCH="amd64" ;;
@@ -36,45 +27,48 @@ case "$ARCH" in
     *) error "暂不支持的系统架构: $ARCH" ;;
 esac
 
-info "正在获取最新 Release 版本信息..."
-LATEST_TAG=$(curl -fsSL -k "https://api.github.com/repos/${REPO}/releases/latest" 2>/dev/null | grep '"tag_name":' | head -n1 | sed -E 's/.*"([^"]+)".*/\1/')
-if [ -z "$LATEST_TAG" ]; then
-    warn "无法通过 GitHub API 自动获取 Tag，回退至 v1.1.5"
-    LATEST_TAG="v1.1.5"
-fi
+info "正在获取最新正式 Release 版本信息..."
+LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 \
+    "${API_URL}/repos/${REPO}/releases/latest" |
+    sed -n 's/^[[:space:]]*"tag_name": "\\([^"]*\\)".*/\\1/p' | head -n1)
+[ -n "$LATEST_TAG" ] || error "无法从 GitHub 获取最新正式 Release，已停止升级；不会回退到旧版本"
 info "目标升级版本: ${LATEST_TAG} (${TARGET_ARCH})"
 
 BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
 DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
-TMP_BIN="${INSTALL_DIR}/vps-commander-agent.tmp"
+CHECKSUM_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
+TMP_BIN=$(mktemp "${INSTALL_DIR}/vps-commander-agent.tmp.XXXXXX") || error "无法创建临时文件"
+TMP_SUM=$(mktemp "${INSTALL_DIR}/vps-commander-checksums.tmp.XXXXXX") || { rm -f "$TMP_BIN"; error "无法创建校验文件"; }
 BAK_BIN="${INSTALL_DIR}/vps-commander-agent.bak"
+cleanup() { rm -f "$TMP_BIN" "$TMP_SUM"; }
+trap cleanup EXIT
 
 info "正在下载新版本二进制文件..."
-curl -fsSL -k -o "${TMP_BIN}" "${DOWNLOAD_URL}" || error "下载失败，请检查网络或 Release 是否存在"
+curl -fL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 600 -o "$TMP_BIN" "$DOWNLOAD_URL" || error "下载失败: ${DOWNLOAD_URL}"
+[ -s "$TMP_BIN" ] || error "下载结果为空"
 
-# 完整性校验：文件大小不能小于 1MB
-FILE_SIZE=$(stat -c%s "${TMP_BIN}" 2>/dev/null || stat -f%z "${TMP_BIN}" 2>/dev/null || echo 0)
-if [ "$FILE_SIZE" -lt 1000000 ]; then
-    rm -f "${TMP_BIN}"
-    error "下载的文件不完整或损坏 (大小: ${FILE_SIZE} 字节)，已终止升级"
-fi
-
-chmod +x "${TMP_BIN}"
+info "正在校验 SHA256..."
+curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 -o "$TMP_SUM" "$CHECKSUM_URL" || error "无法获取 Release 校验文件"
+EXPECTED=$(awk -v f="$BIN_NAME" '$2 == f {print $1; exit}' "$TMP_SUM")
+[ -n "$EXPECTED" ] || error "Release 校验文件中缺少 ${BIN_NAME}"
+ACTUAL=$(sha256sum "$TMP_BIN" | awk '{print $1}')
+[ "$ACTUAL" = "$EXPECTED" ] || error "SHA256 校验失败: ${BIN_NAME}"
+info "SHA256 校验通过: ${ACTUAL}"
 
+chmod +x "$TMP_BIN"
 info "备份旧版本并原子替换..."
-cp -f "${INSTALL_DIR}/vps-commander-agent" "${BAK_BIN}" 2>/dev/null || true
-mv -f "${TMP_BIN}" "${INSTALL_DIR}/vps-commander-agent"
+cp -f "${INSTALL_DIR}/vps-commander-agent" "$BAK_BIN" 2>/dev/null || true
+mv -f "$TMP_BIN" "${INSTALL_DIR}/vps-commander-agent"
 
 info "重启 vps-commander-agent 服务..."
 systemctl restart vps-commander-agent
 sleep 2
-
 if systemctl is-active --quiet vps-commander-agent; then
-    success "Agent 成功平滑升级至 ${LATEST_TAG} 并已恢复运行！"
-    rm -f "${BAK_BIN}"
+    success "Agent 成功升级至 ${LATEST_TAG}，SHA256 已验证并恢复运行。"
+    rm -f "$BAK_BIN"
 else
     warn "服务启动异常，正在自动回滚原版本..."
-    mv -f "${BAK_BIN}" "${INSTALL_DIR}/vps-commander-agent"
+    mv -f "$BAK_BIN" "${INSTALL_DIR}/vps-commander-agent"
     systemctl restart vps-commander-agent
     error "升级失败，已安全回滚至上一版本，请查看日志: journalctl -u vps-commander-agent -n 20"
 fi