v0.6.0

What's Changed

• chore(deps): bump the patch-and-minor group across 1 directory with 4 updates by @dependabot[bot] in #20
• chore(deps): bump motion from 12.43.0 to 13.1.1 by @dependabot[bot] in #16
• ci: bump hashgraph-online/ai-plugin-scanner-action from 1.2.515 to 1.2.551 by @dependabot[bot] in #21
• ci: bump github/codeql-action from 3 to 4 by @dependabot[bot] in #23
• ci: bump actions/github-script from 7 to 9 by @dependabot[bot] in #25
• ci: bump actions/checkout from 4 to 7 by @dependabot[bot] in #22
• ci: bump actions/setup-node from 4 to 7 by @dependabot[bot] in #24
• feat(core): read go.mod and report Go SDKs that cannot serve 2026-07-28 by @AlpayC in #26

Full Changelog: v0.5.2...v0.6.0

v0.5.2 - python & rust support, plugin manifest, social cards, badges

Full Changelog: v0.5.1...v0.5.2

v0.5.1 added Rust, Python support

Full Changelog: v0.5.0...v0.5.1

v0.5.0 added Rust support

What's Changed

• feat(core): add Rust MCP server support by @thexmeta in #6

New Contributors

• @thexmeta made their first contribution in #6

Full Changelog: v0.4.0...v0.5.0

v0.4.0 add Python support

What's Changed

• feat(core): add Python MCP server checks by @AlpayC in #17
• fix(scan): make Python import matching linear by @AlpayC in #18

Full Changelog: v0.3.2...v0.4.0

v0.3.2

What's Changed

• Resume ecosystem probes from checkpoint, add hard deadline by @AlpayC in #8
• Add marketplace manifest for Claude Code plugin distribution by @AlpayC in #9
• feat: publish the ecosystem snapshot across the toolkit by @AlpayC in #10
• chore(ci): add plugin security scan from hashgraph by @AlpayC in #11
• Probe both protocol eras, and date the ecosystem sample by @AlpayC in #13

Full Changelog: v0.2.1...v0.3.2

v0.3.1

What's Changed

• Resume ecosystem probes from checkpoint, add hard deadline by @AlpayC in #8
• Add marketplace manifest for Claude Code plugin distribution by @AlpayC in #9
• feat: publish the ecosystem snapshot across the toolkit by @AlpayC in #10
• chore(ci): add plugin security scan from hashgraph by @AlpayC in #11
• Probe both protocol eras, and date the ecosystem sample by @AlpayC in #13

Full Changelog: v0.2.1...v0.3.1

v0.3.0 - npx, a GitHub Action, and verified citations

Three new ways to run the same checker. The rules themselves are unchanged apart
from MCP007's wording, so a report from v0.2.0 and a report from this one say the
same thing about the same server.

npx mcp-migration-check https://example.com/mcp   # probe a live endpoint
npx mcp-migration-check --source ./my-server      # scan a repository

Or in a workflow:

- uses: AlpayC/mcp-migration-check@v1
  with:
    source: .
    fail-on: critical

The hosted demo is unchanged at
https://mcp-migration-check.alpaycelik.workers.dev, and mcp-migration.skill
is attached below as before.

Added

• npm package. npx mcp-migration-check <url> — also pnpm dlx, yarn dlx
  and bunx. One generated file and a README, empty dependency tree. Exit codes
  are 0 clean, 1 at least one critical finding, 2 inconclusive, so it works
  as a CI gate on its own. Published from CI with provenance.
• GitHub Action. AlpayC/mcp-migration-check@v1. Composite, so there is no
  setup-node and no install step — the engine ships pre-bundled. Writes a graded
  table to the job summary and exposes grade, score, critical, warnings,
  findings and badge-url as step outputs. An endpoint that cannot be reached
  never fails the build: an outage is not the same claim as an unmigrated server.
• Ecosystem report. npm run report:ecosystem walks the official MCP registry,
  probes every remote endpoint and writes an aggregate snapshot — grade
  distribution, how often each rule fires, and how much of the registry answered
  at all. It counts servers rather than naming them.
• Dated citations. Every report now states when the rules were last verified
  against the spec, and a weekly job re-fetches each citation and opens an issue if
  a page stopped saying what the rule cites it for. A 200 does not prove a link is
  right — this project has the receipt for that.

Changed

• MCP007 names the package for your role. It used to say
  @modelcontextprotocol/server / @modelcontextprotocol/client, which reads like a
  path and is wrong for any single project. It now picks by role — /server for a
  server, /client for a client, both only when a project is genuinely both — and
  warns against adding /client reflexively.

Fixed

• A time-of-check/time-of-use gap in the source scan: it called stat on a path
  and then read that path separately, so the file measured need not be the file
  read. Both now go through one file handle.

Repository

CodeQL on every push and weekly, an automated release pipeline, Dependabot,
CONTRIBUTING.md, SECURITY.md and a code of conduct.

Full Changelog: v0.2.0...v0.2.1

v0.2.1

What's Changed

• chore(deps): bump the patch-and-minor group across 1 directory with 5 updates by @dependabot[bot] in #5
• feat: three distribution surfaces over the same bundled engine by @AlpayC in #7

New Contributors

• @dependabot[bot] made their first contribution in #5
• @AlpayC made their first contribution in #7

Full Changelog: v0.2.0...v0.2.1

v0.2.0 - corrected rules, tests, and a hosted demo

Download mcp-migration.skill below and install it in Claude, or try the hosted demo at
https://mcp-migration-check.alpaycelik.workers.dev

Not using Claude? The .skill file is a zip — unpack it and run scripts/mcpcheck.mjs with nothing but Node. Any agent that can run a shell command can use it.

Rules corrected

• All seven spec links were broken. They pointed at anchors like .../2026-07-28#lifecycle, but the specification is split across subpages and has no such anchors, so every link silently resolved to the overview page. All now point at verified subpages.
• MCP007 gave impossible advice. It told you to upgrade @modelcontextprotocol/sdk to ^2 and run a codemod. That package has never published a 2.x — v2 shipped on 2026-07-27 as a rename to @modelcontextprotocol/server and @modelcontextprotocol/client. The rule now keys on the presence of the v1 package and names the real replacements and the real codemod, npx @modelcontextprotocol/codemod@latest v1-to-v2 .
• MCP006 stopped producing false criticals. OAuth metadata discovery now follows the URL a server advertises in its WWW-Authenticate challenge (same-origin only), then both RFC 9728 locations.

Added

• 86 assertions over the engine, weighted toward the SSRF guard
• CI on every push: typecheck, tests, skill-bundle freshness, fixture output
• Hosted demo on Cloudflare Workers with an SSRF guard and rate limiting
• AGENTS.md for agents working in the repository

Fixed

• npm run pack:skill had never worked on Windows