Get started
One local process, started by your client. It needs PHP 8.2 or newer and a TYPO3 project it can read — no daemon, no database of its own, and no account anywhere.
# in the project the server must read $ composer require --dev typo3/support-app ✓ registered 8 tools in .mcp.json
The published files
Three files, and two of them are only there so the first can be checked. The hashes stand short here and in full in checksums.txt.
| File | What it is | Size | SHA-256 |
|---|---|---|---|
| typo3-support-app.phar | The server, self-contained. PHP 8.2+ and nothing else. | 4.1 MB | a3f1…9c2e |
| typo3-support-app.phar.asc | The signature over the file above. | 833 B | — |
| checksums.txt | Every published file and its hash, signed with the same key. | 1.2 kB | 7b04…11af |
Check what you got
One command, and it answers about the file on your disk rather than about the page you downloaded it from. A signature is worth more than a hash on the same server as the file — the key ships with the releases and changes on a rotation, never quietly.
# compare what you got against the published file $ sha256sum -c checksums.txt ✓ typo3-support-app.phar: OK
No answer
Neither of those is a bug to report until you have read the scope — it says which sources were reachable, and that is the answer to both questions.