v2.0.0

MCP protocol revision 2026-07-28

This release moves the server to the MCP TypeScript SDK v2 (@modelcontextprotocol/server) and serves protocol revision 2026-07-28. Clients that still speak the 2025-era initialize handshake keep working: the server is built from a factory and one instance is pinned per connection, so the opening exchange picks the era. Verified with the v2 client in auto, pinned-2026 and legacy modes, and end to end from Claude Code against the live SecurityScorecard API.

Breaking changes

• Node.js 20 or later is required. Node 18 is no longer supported.
• Runtime dependency is now @modelcontextprotocol/server ^2.3.0 (was @modelcontextprotocol/sdk ^1.29). Nothing changes for end users of the published package; this matters only if you depend on the server's internals.
• dotenv was removed from dependencies. It was never loaded; the server reads process.env directly and expects the MCP client to supply SECURITY_SCORECARD_API_TOKEN and COMPANY_DOMAIN.

Unchanged

• All 9 tools, their names, descriptions and input schemas.
• stdio-only transport. Streamable HTTP, auth and subscriptions remain out of scope for a local server.

---

What's Changed

• deps(deps): Bump the minor-and-patch group across 1 directory with 52 updates by @dependabot[bot] in #224
• deps(deps): Bump fast-uri from 3.1.5 to 3.1.8 by @dependabot[bot] in #226
• chore: normalise line endings to LF by @CallMarcus in #227
• deps(deps): Bump the minor-and-patch group with 5 updates by @dependabot[bot] in #228
• deps(deps): Bump eventsource-parser from 3.1.0 to 3.1.1 by @dependabot[bot] in #229
• chore: drop unused dotenv dependency by @CallMarcus in #231
• feat: migrate to MCP TypeScript SDK v2 and serve protocol 2026-07-28 by @CallMarcus in #232
• chore(release): bump to 2.0.0 by @CallMarcus in #233

Full Changelog: v1.2.0...v2.0.0