v0.16.0

0.16.0 (2026-08-05)

Features

• dynamic: rank and broaden tool search, and teach the server once via MCP instructions (#493) (80d8111)
• modules/base: add shared aggregate-query foundation (#480) (903254f)
• modules/cases: add aggregate tools for case configuration and files (#495) (a533f58)
• modules/detections: add alert aggregation tool (#483) (ab97afd)
• modules/hosts: add Falcon Grouping Tag management tool (#487) (cc2cd6a)
• modules/ngsiem: add CQL authoring guidance to search tool (#475) (bb600ca)
• server: add concurrent request handling (#478) (356d2b5)
• server: add tool-level filtering with --read-only, --tools, and --exclude-tools (#490) (3b76a6b)

Bug Fixes

• modules/detections: rename falcon_aggregate_alerts to falcon_aggregate_detections (#488) (6a6f19e), closes #485
• modules/detections: send include_hidden as a query parameter (#491) (0ad7fff)
• modules: drop redundant offset input from dual-pagination search tools (#474) (778d360)
• tests: unwrap the search envelope in three modules' integration guards (#492) (e9e2175)