History

docs(wiki): tell how VS Code uses a server through the bridge FAQ.md: an entry "Can VS Code use my server?" that points to zig-bridge-sdk Interoperability.md: a known gap for VS Code and other hosts of revision 2025-11-25 Getting-Started.md: the VS Code page of the bridge under "What to read next" Home.md: the bridge under "Where to start" Dictionary.md: the abbreviation VS, from gen-dictionary

ChristianPresley committed Oct 12, 2026

docs(wiki): correct the 0.5.1 release notes for the lint Release-Notes.md: split the 34-word sentence of the 0.5.1 intro, and replace the -ing form in the HTTP stop item

ChristianPresley committed Oct 12, 2026

docs(wiki): record release 0.5.1 Release-Notes.md: add the section 0.5.1 and move the applies line to 0.5.1 Roadmap.md: add the items of release 0.5.1 and move the applies line to 0.5.1 Getting-Started.md: fetch the tag v0.5.1 and move the applies marker to 0.5.1

ChristianPresley committed Oct 9, 2026

docs(wiki): record release 0.5.0 Release-Notes.md: add the section of release 0.5.0 Roadmap.md: add the items of release 0.5.0 with pull requests 32 to 35 and the tag v0.5.0 Getting-Started.md: fetch the tag v0.5.0 Home.md: add the row of the time limits of the keychain storage of version 0.5.0 Authorization.md: mark the time limits timeout and prompt_timeout of the keychain storage as zig-sdk 0.5.0 Transport-Unix-Socket.md: describe the poll before each read on Windows, which sees a close of the peer that the driver loses

ChristianPresley committed Oct 8, 2026

docs(wiki): add the time limits of the keychain storage Authorization.md: describe the time limits timeout and prompt_timeout of the Secret Service backend, and mark them in the applies-to line as on main after 0.4.0.

ChristianPresley committed Oct 8, 2026

docs(wiki): record release 0.4.0 Authorization.md: add the section on private CAs and proxies (ca_bundle, proxy, Fetcher fields), the reload of the stored record before a refresh, and the section on one storage that more clients share Client-Guide.md: add the sections on HTTP proxies, request metadata (log_level, meta, error.InvalidMeta), notifications (scratch memory, inline_notifications) and errors and diagnostics (router failures, http_status), and the stdio exitStatus Concepts.md: say that the memory link does not obey the client time limits Deprecated-Features.md: add the row of RequestOptions.log_level Getting-Started.md: fetch the tag v0.4.0 Home.md: add the rows of the request options and the HTTP proxies of version 0.4.0, and make the Applies to line apply to each version Interoperability.md: add the scripted HTTP/2 peer with a dynamic HPACK table to the known gaps Limits-and-Security.md: add the limits of the HTTP client for each SSE event, the proxy section, the remembered resets of HTTP/2 and the security defaults of the proxy, ca_bundle, the router log and _meta Release-Notes.md: add the section of release 0.4.0 Roadmap.md: add the items of release 0.4.0 with pull requests 23 to 31 and the tag v0.4.0 Server-Guide.md: describe the listen acknowledgment before the first event and the lock of a listen stream on the memory link Threat-Model.md: add the rows of the client memory, the client router, the proxy, HTTP/2, the shared storage, the CA bundle, the stdio process and _meta, and update the gap of the storage lock Transport-Streamable-HTTP.md: add the limit for each SSE event, the warnings of the client, Diagnostics.http_status and the proxy section Transport-Unix-Socket.md: add the notifications of the client, inline notifications and the frames that the client cannot read Transport-WebSocket.md: add the notifications of the client, inline notifications, the frames that the client cannot read and the status of a refused upgrade Transport-gRPC.md: add the early responses, the streams and resets (stopWaits, CallStream, refused streams), the header blocks after a size error or a reset, and the remembered resets limit Transport-stdio.md: add the on_notification and userdata spawn options, the routed notifications, the frames that the client cannot read, exitStatus and the reap of a server that ends its output Transports.md: give the limits of the in-memory link for use in production

ChristianPresley committed Oct 8, 2026

docs(wiki): record the enforced limits and release 0.3.0 Limits-and-Security.md: describe the overflow of json_max_depth, max_filter_bytes, listen_ack_timeout, http.head_timeout and http.idle_timeout, the shutdown of the HTTP server, and remove the rows of the removed fields Threat-Model.md: move the HTTP time limits and the JSON depth limit from "Not covered yet" to rows with their modules and tests, and add the rows of the filter size and the listen acknowledgment Roadmap.md: mark the row of the declared limits done with pull request 21 and release 0.3.0 Release-Notes.md: add the section of release 0.3.0 Transport-Streamable-HTTP.md: add the time limits to the security defaults and the shutdown behavior to the server Deploy-Reverse-Proxy.md: tell the reader to keep the keep-alive time of the proxy below http.idle_timeout Getting-Started.md: fetch the tag v0.3.0

ChristianPresley committed Oct 1, 2026

docs(wiki): match the gRPC frame size error, the page template exemption and the revision steps to the code Style-Guide-STE.md: say that every page with a name that starts with _ has no page template Transport-gRPC.md: give FRAME_SIZE_ERROR for an oversize frame and for control frames with a wrong length Versioning.md: add the specification fixtures, one UPSTREAM.zon per fixture directory, the fixture paths of the tools, extract-requirements and spec-matrix to the revision steps

ChristianPresley committed Oct 1, 2026

docs(wiki): correct every page against the code of release 0.2.0 API-Reference.md: add the conformance matrix link and the manual start of docs.yml Apps-Extension.md: give the full error message of a hidden tool call Authorization-Server.md: set the reviewed date to 2026-09-30 and tell how an MCP server gets the verification keys Authorization.md: add the WebSocket authorization, the token_type check, the refusal codes of a refresh, the PS256 keys from PKCS#8 and the links to the authorization server, and correct the client_id statement and the users of ClientAuth Client-Guide.md: add the WebSocket and gRPC client transports, correct the HTTP connection model, add the TLS options and log_level, list the other typed methods, add WebSocket to the cache credential, update the Applies-to line Concepts.md: give the SDK versions on the Applies-to line, correct the sentence about the progress rate Conformance.md: name the 0.2.0 parts on the Applies-to line, correct the grpc-interop description and the push trigger Contributing.md: tell that commit-policy also checks the author and the committer, add the spec-matrix step, tell what the nightly wiki-lint job compares Deploy-Reverse-Proxy.md: correct the allowed_hosts rule and the nginx example, add the request timeout, the cancellation at a disconnect, DPoP, the rate limits behind a proxy and the WebSocket upgrade, update the Applies-to line Deprecated-Features.md: tell that the client registers dynamically by default, add the registration of the authorization server, the rate limit of log messages and the HTTP+SSE transport, update the Applies-to line Examples.md: name the 0.2.0 programs and modes on the Applies-to line, tell the gRPC tunnel, ports and defaults, add the file storage of client_cli, tell how to build consumer FAQ.md: name the 0.2.0 answers on the Applies-to line, add WebSocket, the D-Bus client and the new fixtures to the dependency answer Getting-Started.md: fetch the v0.2.0 tag in place of main, say that the fetch adds the dependency mcp, name the executable calc Glossary.md: add WebSocket to Transport, add Authorization server, DPoP, Keychain, Token storage, Tunnel, Typed binding and WebSocket, name the 0.2.0 terms on the Applies-to line Home.md: count five transports and link JSON Schema Support, Examples and Limits and Security Interoperability.md: remove the TLS 1.2 refusal claim from the OpenSSL row, add the 0.2.0 OpenSSL and std client checks, name grpc-js and the test fixtures as exceptions, correct the hybrid key exchange gap JSON-Schema-Support.md: name the regex errors of the validator and the limits.schema location, correct the required fields and the header field of derived schemas, update the Applies-to line Limits-and-Security.md: mark the limits that 0.2.0 does not apply, correct the client handshake limit, add the authorization server limits and the TLS cookie and option limits, update the Applies-to line Release-Notes.md: correct the milestones of 0.2.0 to M10 to M12, add tag links, the documentation site, the lint-docs and build step changes, the API breaks and the security fixes Resource-Templates.md: add the template and URI length limits, correct the "Resource not found" message, add the completion reference rules, update the Applies-to line Roadmap.md: mark M12 as done except the external TLS review, correct the milestones of release 0.2.0, add the open item of the limits that 0.2.0 does not apply Server-Guide.md: correct the default of mrtr, add the option cache, add WebSocket to principal(), add the logging capability to log, add the notify functions, update the Applies-to line Style-Guide-STE.md: give the real default paths of the linter, tell what STE-1.1 finds, exempt _Sidebar.md and _Footer.md from the page template TLS-and-Certificates.md: correct the default chain choice, the Kind values and the chain alerts, add the EKU alert, the TLS users of WebSocket and gRPC, the HelloRetryRequest cookie and the AEGIS and padding HTTPS test Threat-Model.md: replace a test name that does not exist, add the gRPC, TLS record and length rows, add the HTTP time limits and the JSON depth limit to the gaps, correct the Roadmap sentence Transport-Streamable-HTTP.md: add status 429, Mcp-Name for tasks, DPoP and auth_provider, remove the head timeout claim, update the Applies-to line Transport-Unix-Socket.md: add error.AccessControlFailed Transport-WebSocket.md: correct the reviewed date, add the example websocket_server Transport-gRPC.md: correct the error code of the frame limits, tell which errors end a tunnel call in the trailers, add the tunnel interop calls, update the Applies-to line Transport-stdio.md: correct the name of the shutdown flag of the cancel token, update the Applies-to line Transports.md: add the typed gRPC row, describe the typed service, describe the socket protection on POSIX and Windows and the private directory, update the Applies-to line

ChristianPresley committed Oct 1, 2026

Release 0.2.0: release notes, version markers and the closed roadmap items Release-Notes.md: add the section of release 0.2.0 Roadmap.md: mark the release of milestones M7 to M12 as done, record the internal TLS review and the open external review, and link pull request 10 Conformance.md: give the matrix numbers of release 0.2.0, correct the n/a example, and add the steps of the authorization server fixture Home.md: name version 0.2.0 in the status table and link the authorization and TLS pages All other pages: replace the release after 0.1.0 with version 0.2.0 and set the sdk marker to 0.2.0

ChristianPresley committed Oct 1, 2026

Transport gRPC and TLS: the typed binding, the review fixes and the security review Transport-gRPC.md: add the typed binding with its mapping, errors, gaps, limits and steps, and its tests and references TLS-and-Certificates.md: add retry_cookie, the cookie-only HelloRetryRequest, the client option limits, unsupported_extension, the new tests and the security review section Limits-and-Security.md: add the limits of the typed gRPC messages and the request head checks Threat-Model.md: add the row of the request head checks Interoperability.md: add the grpc-js peer of the typed binding Conformance.md: add the typed binding to the gRPC interoperability section Roadmap.md: mark the typed gRPC binding as done in pull request 18 Home.md: add the typed gRPC binding to the status table Dictionary.md: regenerate with CR, DEL, LF and NUL

ChristianPresley committed Oct 1, 2026

Authorization: refresh tokens and token storage in the keychain Authorization.md: add the sections on refresh tokens and on the token storage with the keychain backends, and name the DPoP scheme of the Authorization header Threat-Model.md: add the token storage threats and the open items of the Secret Service transfer and the lock between processes Roadmap.md: mark the token storage as done in pull request 16 Home.md: add refresh tokens and the token storage to the status table Examples.md: add the --oauth mode of client_cli Bibliography.md: regenerate with the keychain sources Dictionary.md: regenerate

ChristianPresley committed Oct 1, 2026

Authorization Server: add the page and the authorization server rows of the other pages Authorization-Server.md: add the page of the embeddable authorization server with its options, security notes, conformance and limits _Sidebar.md: add Authorization Server Authorization.md: link the authorization server and its conformance result Conformance.md: add the results and the steps of the two authorization server scenarios Roadmap.md: mark the authorization server as done in pull request 15 Examples.md: add the authorization_server example Home.md: add the authorization server to the status table Interoperability.md: add the authorization command of the conformance suite Threat-Model.md: add the authorization server threats Bibliography.md: regenerate with RFC 8252 and RFC 9068

ChristianPresley committed Oct 1, 2026

Transport WebSocket: add the page and the WebSocket rows of the other pages Transport-WebSocket.md: add the normative description of the WebSocket binding, its limits and its tests Transports.md: add WebSocket to the overview and a section with a link to its page _Sidebar.md: add Transport WebSocket Limits-and-Security.md: add the WebSocket limits, the address caller of the rate limits and the security default Threat-Model.md: add the WebSocket rows Examples.md: add websocket_server and the steps for the WebSocket pair Interoperability.md: add the Node WebSocket client and the curl check of the websocket-interop job Roadmap.md: mark the WebSocket transport as done in pull request 14 Home.md: add the WebSocket transport, the rate limits and the TLS certificate features to the status table Concepts.md: add WebSocket to the custom transports and to the cancellation rule Getting-Started.md: add WebSocket to the transport pointer Server-Guide.md: add WebSocket to the cancellation note of listen streams API-Reference.md: add the WebSocket transport to the mcp module Bibliography.md: regenerate with RFC 6455 Dictionary.md: regenerate with the WebSocket synonyms

ChristianPresley committed Oct 1, 2026

TLS and Certificates: certificate_authorities, RSA-PSS keys, chain checks, name constraints and revocation TLS-and-Certificates.md: add the sections of pull request 13 and update the support table, the configuration, the tests and the references Threat-Model.md: add the rows of the certificate checks and remove revocation and name constraints from the open items Roadmap.md: mark certificate_authorities, revocation with name constraints, and RSA-PSS keys as done in pull request 13 Bibliography.md: regenerate from docs/bibliography.zon Dictionary.md: regenerate with AEGIS, CRL, OCSP and stapling

ChristianPresley committed Oct 1, 2026

docs(wiki): describe the AEGIS suites and record padding TLS-and-Certificates.md: the AEGIS option with its parameters and order, and the record padding policies with their limits Roadmap.md: the AEGIS and padding items are done in pull request 12

ChristianPresley committed Oct 1, 2026

docs(wiki): describe the rate limits of each caller Limits-and-Security.md: the rate limit table, the caller rules, the error code and the default Server-Guide.md: the rate limit options, the log summary, the error row and the limits list Threat-Model.md: the rate limit default, four request threat rows and no open item for rate limits Roadmap.md: the rate limit item is done in pull request 11

ChristianPresley committed Oct 1, 2026

docs(wiki): describe the checked URI template length limits Limits-and-Security.md: max_template_bytes and max_uri_bytes are checked limits after version 0.1.0

ChristianPresley committed Oct 1, 2026

docs(wiki): describe DPoP and workload identity federation and correct the conformance results Authorization.md: the DPoP and workload identity extensions, the DPoP policy of the resource server, the workload JWT validator and the conformance result Conformance.md: all six extension scenarios pass, the three pending server scenarios, the eight wire-schema-valid failures and the gated unscored runs in CI Tasks-Extension.md: wire-schema-valid fails in the eight scenarios that create a task, and CI permits only this check Interoperability.md: the unscored scenarios run one at a time Threat-Model.md: DPoP and workload identity rows, the claim overflow row and the DPoP token default Roadmap.md: milestone M12 with the later items of the plan, DPoP and workload identity done, and no known limit for them Home.md: the DPoP and workload identity row Bibliography.md: copy of the generated bibliography with RFC 9449, RFC 7638 and the two drafts Dictionary.md: copy of the generated dictionary with DPoP and SPIFFE

ChristianPresley committed Oct 1, 2026

docs(wiki): describe the socket directory check and the protected move of the Unix socket Transport-Unix-Socket.md: describe the directory rules, createPrivateDirectory, the move of the protected socket and the path length during bind, and use a private directory in the examples Examples.md: run the unix_server example with its private directory mcp-run instead of /tmp Limits-and-Security.md: name the 14 bytes of the private directory of bind and the directory check Threat-Model.md: add the socket directory control and the tests of the directory check, createPrivateDirectory and the move Roadmap.md: set the row of pull request 9 to done

ChristianPresley committed Sep 30, 2026

docs(wiki): record the fuzz job and the Windows socket protection as done Roadmap.md: set the fuzz job row to done in pull request 7 and add the rows of pull requests 8 and 9 Transport-Unix-Socket.md: describe the owner-only access control list of the socket file on Windows Threat-Model.md: name the Windows access control list in the socket row and add its test Limits-and-Security.md: name the Windows access control list of the socket file

ChristianPresley committed Sep 30, 2026

docs(wiki): record the fuzz job fix and the defects it found as in review on the roadmap Roadmap.md: set the fuzz job row to in review in pull request 7 and name the HPACK and TLS defects that the first fuzz runs found

ChristianPresley committed Sep 30, 2026

docs(wiki): record the failed nightly fuzz job as an open item on the roadmap Roadmap.md: add the nightly fuzz job that the test runner of Zig 0.16.0 stops from compiling

ChristianPresley committed Sep 30, 2026

docs(wiki): list the open release and the later items of the plan on the roadmap Roadmap.md: add the open release of milestones M7 to M11 and the later items of the plan that no milestone has Threat-Model.md: remove the stale "planned with the client" note and link the items to the roadmap

ChristianPresley committed Sep 30, 2026

docs(wiki): close milestone M10 and the open and later items on the roadmap Roadmap.md: mark M10 done, add milestone M11 with the former open and later items as done with links to their pages, list the known limits and write the page in the active voice

ChristianPresley committed Sep 30, 2026

docs(wiki): regenerate the dictionary with the abbreviation BSD Dictionary.md: regenerate with zig build gen-dictionary, the abbreviation list has BSD

ChristianPresley committed Sep 30, 2026

docs(wiki): describe the issuer-bound credentials, URL checks, scope hierarchies and new threat rows Authorization.md: describe pre_registered as a list of issuer-bound credentials with an example, the client ID metadata document URL and redirect URI checks, application_type, allow_http, lastFailure, the case rules for resource and audience, the gRPC principal, the principal binding of requestState and scope_hierarchy Threat-Model.md: add the defaults for the client cache and the request timeout, and the rows for header values, cancellation, principal binding, URL checks, sampling and form checks, issuer binding, endpoint security, scope hierarchies and the Unix socket path

ChristianPresley committed Sep 30, 2026

docs(wiki): describe the header, cancellation, timeout and client validation rules Transport-Streamable-HTTP.md: add nested x-mcp-header values, the character and safe integer checks, the cancellation at a client disconnect, the tools/list refresh after -32020, the SSE delivery on arrival and the default timeout Transport-gRPC.md: add the default grpc-timeout, the metadata character and safe integer checks, the client refresh after -32020 and the principal on the gRPC server Transport-stdio.md: add the cancellation log scope, the suppressed responses of cancelled requests, the shutdown flag and the default timeout Transport-Unix-Socket.md: give the sockaddr_un path limit of each target and unix.max_path_len, and the suppressed responses of cancelled requests Concepts.md: add the cancellation and timeout section, the principal binding of requestState and the credential scope of the client cache Client-Guide.md: add the header annotations and result cache sections, max_total_timeout, the default timeout, the progress rate limit, the structured content check and the hook input checks Server-Guide.md: narrow allow_unsupported_schema_keywords, add nested header annotations, the completion target check, the input request checks, the principal binding, principal() and the progress rate Limits-and-Security.md: document request_timeout, max_total_timeout, the per-second progress limit, max_auto_pages, the Unix socket path limit, the disconnect cancellation, eval_budget and the new security defaults FAQ.md: add the answers about full JSON Schema 2020-12 support and the default request timeout Deprecated-Features.md: add the deprecated includeContext values with the sampling.context gate and the sampling message checks

ChristianPresley committed Sep 30, 2026

docs(wiki): describe the full JSON Schema 2020-12 support and the gap-free requirement matrix JSON-Schema-Support.md: list the unevaluated, dynamic reference and identifier keywords, add the annotations, schema resources, validator limits and JSON Schema Test Suite sections, narrow allow_unsupported_schema_keywords to regular expressions and count the evaluated locations in eval_budget Home.md: replace the subset statement with the full 2020-12 support of the release after 0.1.0 Conformance.md: give the matrix numbers after the gap fixes (462 tested, 76 n/a, 195 app, 0 gaps) and link the JSON Schema Test Suite run

ChristianPresley committed Sep 30, 2026

docs(wiki): add the JSON Schema preservation scenario to the conformance results Conformance.md: add the result of the unscored client scenario json-schema-2020-12-preservation

ChristianPresley committed Sep 30, 2026