v1.2.0

What's Changed

• chore(deps): regenerate stale package-lock.json root metadata by @CallMarcus in #170
• chore(dependabot): supply-chain cooldown + github-actions monitoring by @CallMarcus in #171
• deps(deps): Bump @hono/node-server from 1.19.13 to 1.19.14 by @dependabot[bot] in #168
• ci(deps): Bump actions/checkout from 4 to 6 by @dependabot[bot] in #172
• ci(deps): Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #173
• deps(deps): Bump the minor-and-patch group across 1 directory with 42 updates by @dependabot[bot] in #175
• deps(deps-dev): Bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #177
• build(deps-dev): upgrade to TypeScript 6 (moduleResolution: bundler) by @CallMarcus in #178
• docs: document setup for all MCP clients, not just Claude Desktop by @CallMarcus in #179
• deps(deps): Bump protobufjs from 7.6.2 to 7.6.4 by @dependabot[bot] in #181
• deps(deps): Bump the minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #183
• ci(deps): Bump actions/checkout from 6 to 7 by @dependabot[bot] in #185
• deps(deps): Bump the minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in #188
• deps(deps-dev): Bump @types/node from 25.9.3 to 26.1.1 by @dependabot[bot] in #187
• deps(deps): Bump protobufjs from 7.6.4 to 7.6.5 by @dependabot[bot] in #192
• deps(deps): Bump fast-uri from 3.1.2 to 3.1.3 by @dependabot[bot] in #191
• chore: drop Node 18 support, require Node >= 20 by @CallMarcus in #202
• ci(deps): Bump actions/setup-node from 6 to 7 by @dependabot[bot] in #194
• deps(deps-dev): Bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in #190
• deps(deps): Bump the minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in #196
• deps(deps): Bump fast-uri from 3.1.3 to 3.1.4 by @dependabot[bot] in #195
• deps(deps): Bump @hono/node-server and @modelcontextprotocol/sdk by @dependabot[bot] in #203
• deps(deps): Bump hono from 4.12.32 to 4.13.0 by @dependabot[bot] in #208
• deps(deps): Bump the minor-and-patch group across 1 directory with 3 updates by @dependabot[bot] in #209
• deps(deps): Bump @hono/node-server from 1.19.14 to 2.0.12 by @dependabot[bot] in #207
• deps(deps): Bump fast-uri from 3.1.4 to 3.1.5 by @dependabot[bot] in #205
• deps(deps): Bump media-typer from 1.1.0 to 1.1.1 by @dependabot[bot] in #206
• deps: override adm-zip and sharp to clear transitive audit highs by @CallMarcus in #210
• Pagination rewrite, real response modes, WSL fix, API spec v1.10.18 — release 1.2.0 by @CallMarcus in #212

Full Changelog: v1.1.1...v1.2.0

v1.1.1

What's Changed

• ci: tag-driven release (npm + MCP registry + GitHub Release) by @CallMarcus in #163
• chore(npm): add MIT license field to package.json by @CallMarcus in #164
• chore(release): bump to 1.1.1 (pipeline smoke test) by @CallMarcus in #165
• fix(npm): add repository field for OIDC provenance validation by @CallMarcus in #166

Full Changelog: v1.1.0...v1.1.1

v1.1.0

What's new

Refreshes the bundled SecurityScorecard API reference and hardens the docs pipeline.

• API spec 1.9.76 → 1.10.1. Discovery surface regenerated: 628 → 507 operations. Adds new areas — intake-vendor, MAX v1 (partner/customer/vendor), SCIM v2, Jira/app integrations, OAuth app management. Drops 198 routes SSC removed upstream (197 are per-issue-type current routes, consolidated in their published swagger).
• Self-cleaning docs pipeline. split_swagger.py and the embeddings step were additive-only, leaving orphaned docs/vectors behind on every refresh (the tree had grown to 1205 .md files for a 628-route spec). They now rebuild to mirror the spec exactly, so re-running is idempotent.

Published to npm as @callmarcus/securityscorecard-mcp@1.1.0 and the MCP Registry as io.github.CallMarcus/securityscorecard-mcp@1.1.0.

Install: npx -y @callmarcus/securityscorecard-mcp

Full changes: #162

🤖 Generated with Claude Code

v1.0.1

Patch release.

Fixed

• Asset comparison recommendations (compareAssets): recommendations were generated from an unsorted list, so the "focus on the riskiest asset" advice depended on the order assets were passed in. They are now derived from the risk-sorted list and are order-independent.

Internal

• Added an offline unit-test suite for asset_management.ts (validation, factor mapping, scoring, recommendations, and compareAssets); test suite is now 37 tests.
• Aligned package.json version with the public release line (1.0.1).

Full Changelog: v1.0.0...v1.0.1

v1.0.0

First public release of the SecurityScorecard MCP server.

A Model Context Protocol server exposing 9 operational security tools over the SecurityScorecard REST API, with a self-contained hybrid-search (semantic + keyword) API reference covering 628 endpoints.

Highlights

• 9 focused tools: dashboard, risk analysis, improvement plans, asset discovery, email security, issue-type analysis, data-completeness validation, API discovery, and direct query access.
• Token-efficient response modes (minimal / standard / detailed).
• 0 known dependency vulnerabilities (npm audit).
• Embedding pipeline on the maintained @huggingface/transformers.
• Offline test suite (23 tests) covering the API client and search ranking; CI across Node 18/20/22.

Disclaimer

This is an independent, community-built open-source project. It is not affiliated with, endorsed by, or associated with SecurityScorecard, Inc. It is built solely against SecurityScorecard's publicly available API documentation. You must supply your own API credentials and comply with SecurityScorecard's terms of service.

Note: the prior pre-1.0 releases and their archives were removed; project history was reset for this public launch.