v0.0.11

• New read-only tool pnpTestConnection: connects to a SharePoint site and reads its title and URL to verify access, without returning tokens or credentials. It uses the configured --url automatic connection, or takes siteUrl with either clientId or a persisted-connection profile.
• Catalog rebuilds are now serialized, and the catalog cache file is written atomically (temporary file, then rename), so concurrent rebuilds no longer duplicate work or leave a partially written cache.

v0.0.10

• The risky-operation check now works as an allowlist: any command that is not a PnP.PowerShell cmdlet or a known-safe formatting cmdlet, any static .NET member call outside a small safe set (e.g. [System.IO.File]::..., [Diagnostics.Process]::Start), dynamic or code-running method calls ([scriptblock]::Create(...), .Invoke()), $env: reads and $ExecutionContext access now require confirmation.
• Privilege-changing cmdlets (Grant-PnP*, Register-PnP*, Set-PnPTenant*, *Permission*, site collection admin and owner changes, app deployment) and sharing parameters such as -SharingCapability now require confirmation.
• PowerShell only inherits a safe subset of the environment (PATH, HOME, proxy and certificate settings, managed identity variables, ...). Use --pass-env (or PNP_MCP_PASS_ENV) with a comma-separated list of names to pass more, e.g. AZURE_CLIENT_ID,AZURE_CLIENT_SECRET.
• pnpRefreshCmdlets with update=true now requires confirmation, like risky expressions.
• Cache files are written with owner-only permissions (0600, directories 0700). Cache files created by earlier versions keep their old mode until deleted or chmod 600.
• Commands outside the safe list that used to run silently (for example Get-Content, Get-ChildItem, Import-Module, Export-Csv) now ask for confirmation first.

v0.0.9

• Persisted connections: --persisted-connections (or PNP_MCP_PERSISTED_CONNECTIONS) takes a JSON array of {"tenant","clientId"} (or @file). When an expression runs Connect-PnPOnline -Url for a listed tenant without -ClientId, the server adds the configured client ID and -Interactive to reuse the persisted login. Unlisted tenants behave as before.
• Persisted connections accept an optional name, and pnpRunCmdlet takes a profile argument to select one explicitly (unknown profiles fail with [UNKNOWN_PROFILE]).
• --strict-connections (or PNP_MCP_STRICT_CONNECTIONS=1) refuses Connect-PnPOnline -Url to a tenant that is not in the persisted connections ([TENANT_NOT_CONFIGURED]). It only has an effect together with --persisted-connections.

v0.0.8

• Optional automatic connection: --url, --client-id and --tenant (or PNP_MCP_URL, PNP_MCP_CLIENTID, PNP_MCP_TENANT) make pnpRunCmdlet connect to the site before every run, reusing a login persisted with Connect-PnPOnline -PersistLogin. Without --url behaviour is unchanged.
• A failed automatic connection returns a message with the command to sign in again.
• Get-PnPAccessToken and Get-PnPConnection now require confirmation; with automatic connection enabled, so does Connect-PnPOnline to another site.
• Added the version subcommand (--version still works).

v0.0.7

• fix: warning message

v0.0.6

• pnpRunCmdlet returns PowerShell warnings from successful runs ([WARNINGS] block and warnings field) instead of dropping them.
• Long-running pnpRunCmdlet calls send MCP progress notifications every 5 s when the client supplies a progress token.
• Added a Dockerfile (with PowerShell and PnP.PowerShell), make docker / make docker-run, and a README section on testing with Docker.

v0.0.5

• Added the pnp://best-practices resource and the prompts pnpAuditSitePermissions, pnpInventoryLists, pnpFindCmdlet and pnpTeamsOverview.
• pnpRunCmdlet accepts offset to page through truncated output (item index for JSON arrays, character offset otherwise); the [TRUNCATED] notice names the next offset.
• pnpSearchCmdlets ranks exact verb/noun matches first, also matches parameter names, accepts verb/noun filters and returns related cmdlets.
• Docs: fixed stale references in best-practices.md and documented the variable-assignment pitfall, paging and search.

v0.0.4

• Tools now return structured content with a published output schema (ok flag, parsed JSON in data, truncated, confirmation fields, etc.); the text output is unchanged.
• Added human-readable titles and refined annotations for all tools.
• Narrowed the network error detection to avoid false positives.
• pnpRunCmdlet notes when timeoutSec or maxChars was capped at its maximum.
• pnpGetCmdletDocs returns a clear error when a cmdlet does not exist.

v0.0.3

• Management of destructive actions.
• Performance optimizations.

v0.0.2

• Release pipeline fixes.