Get started
One local process, started by your client. It needs PHP 8.2 or newer and a TYPO3 project it can read — no daemon, no database of its own, and no account anywhere.
# in the project the server should read $ composer require --dev typo3/support-app ✓ registered 8 tools in .mcp.json
What is published
Three files, and two of them are only there so the first can be checked. The hashes are shortened here and in full in checksums.txt.
| File | What it is | Size | SHA-256 |
|---|---|---|---|
| typo3-support-app.phar | The server, self-contained. PHP 8.2+ and nothing else. | 4.1 MB | a3f1…9c2e |
| typo3-support-app.phar.asc | The signature over the file above. | 833 B | — |
| checksums.txt | Every published file and its hash, signed with the same key. | 1.2 kB | 7b04…11af |
Check what you got
One command, and it answers about the file on your disk rather than about the page you downloaded it from. A signature is worth more than a hash on the same server as the file — the key is published with the releases and changes when it is rotated, never quietly.
# compare what you got against what was published $ sha256sum -c checksums.txt ✓ typo3-support-app.phar: OK
When it does not answer
Neither of those is a bug worth reporting until the scope has been read — it says which sources were reachable, and that is the answer to both questions.