2026.9.3

What's Changed

• docs: say the main ruleset is active and pin its id by @danathar-atomic-hive[bot] in #188
• test: resolve every README link target by @Danathar in #190
• fix: emit book_id as a string so one tool's output feeds the next by @Danathar in #194
• docs: explain ci.yml's per-commit concurrency group on main pushes by @danathar-atomic-hive[bot] in #192
• fix: refuse pytest @file argument files in the Bash guard by @danathar-atomic-hive[bot] in #196
• test: join the book_id round trip to the tool registry and name it in the add-tool recipes by @danathar-atomic-hive[bot] in #199
• fix: refuse a glob at the start of a pytest or git word in the Bash guard by @danathar-atomic-hive[bot] in #200
• fix: require mcp 1.14 or newer by @Danathar in #220
• docs: set up the dev venv with Python 3.11 by @Danathar in #226
• fix: raise when Goodreads fails a GraphQL root field by @Danathar in #215
• fix: refuse a bad year and a negative limit in popular_books and get_reviews by @Danathar in #216
• fix: refuse an ISBN or malformed id instead of reading its leading digits by @Danathar in #218
• fix: refuse a shelf name the user has no shelf by in get_shelf by @Danathar in #217
• fix: stop a cancelled tool call from making more Goodreads requests by @Danathar in #219
• fix: convert pre-1970 publication dates without the C runtime by @Danathar in #224
• fix: read config.json saved with a BOM or as UTF-16/UTF-32 by @Danathar in #225
• fix: report the package version in the MCP initialize response by @Danathar in #227
• ci(release): push the release branch and link its PR instead of opening it by @Danathar in #221
• ci: judge only the test check in the release gate and skip an outsider's /ai-fix by @Danathar in #222
• ci(release): let a re-run finish a release that failed after its tag was pushed by @Danathar in #223
• docs: record the #202–#214 sweep in the session summary by @Danathar in #228
• chore(release): 2026.9.3 by @Danathar in #230

Full Changelog: 2026.9.2...2026.9.3

2026.9.2

What's Changed

• docs: make README links absolute so they work on PyPI by @Danathar in #185
• chore(release): 2026.9.2 by @Danathar in #186

Full Changelog: 2026.9.1...2026.9.2

2026.9.1

What's Changed

• docs: thank the upstream author at the top of the README by @Danathar in #183
• chore(release): 2026.9.1 by @Danathar in #184

Full Changelog: 2026.9.0...2026.9.1

2026.9.0

What's Changed

• Add tests/e2e/ for live smoke tests by @Danathar in #31
• Add PR template by @Danathar in #32
• Add issue templates by @Danathar in #33
• Add CONTRIBUTING.md by @Danathar in #34
• Add .editorconfig by @Danathar in #35
• Add coverage gate to CI by @Danathar in #36
• Add agent instruction files (AGENTS.md, CLAUDE.md, Copilot, Cursor) by @Danathar in #37
• Add prompts catalog by @Danathar in #38
• Add repo skills (check-live-endpoints, add-mcp-tool) by @Danathar in #39
• Add correction capture (.claude/memory/) by @Danathar in #40
• Add .claude/settings.json (layered permissions, structural gates, test hook) by @Danathar in #41
• Add docs/review-rubric.md by @Danathar in #43
• Add docs/metrics.md by @Danathar in #42
• Add docs/quality.md by @Danathar in #44
• Add .claude/session-summary.md by @Danathar in #45
• Add nightly live-endpoint compliance run by @Danathar in #46
• Add human-triggered AI fix workflow by @Danathar in #48
• Add path-based PR labeler by @Danathar in #49
• Add docs/risk-tiers.md by @Danathar in #50
• Add docs/SECURITY-AI.md by @Danathar in #51
• Add docs/reflections/ for cross-session knowledge by @Danathar in #52
• Add auto-QA tuning config, consumed by the nightly run by @Danathar in #53
• docs: relicense fork under GPL-3.0 and add status badges by @Danathar in #56
• test: cover list_shelves, the user-id gate, and main() by @Danathar in #57
• test: cover client.py retry, config-discovery and GraphQL error paths by @Danathar in #58
• docs: record what the allow list reaches, and pin the permission rules by @Danathar in #62
• test: cover the server guards and pagination exits neither suite reaches by @Danathar in #61
• docs: correct the coverage snapshot and pin the gate against drift by @Danathar in #64
• security: guard the allowed Bash verbs with a PreToolUse hook by @Danathar in #65
• test: execute the tool bodies only the live suite reaches by @danathar-atomic-hive[bot] in #68
• test: execute release.yml's steps, gate and tag check included by @danathar-atomic-hive[bot] in #70
• security: make the Bash guard read the command the shell runs by @danathar-atomic-hive[bot] in #72
• test: execute nightly-compliance.yml's steps, retry loop and drift issue by @danathar-atomic-hive[bot] in #74
• docs: tell agents how to write issues and PRs for people by @Danathar in #75
• docs: follow the PR template in the writing guidance by @Danathar in #78
• test: execute ai-fix.yml's gate, condition and acknowledgement by @danathar-atomic-hive[bot] in #77
• test: run the check-live-endpoints skill against the code it documents by @danathar-atomic-hive[bot] in #80
• docs: list all five read surfaces in client.py's module docstring by @Danathar in #82
• test: run the server the way the manifest launches it by @danathar-atomic-hive[bot] in #84
• test: pin docs/quality.md's test-count and CI rows by @danathar-atomic-hive[bot] in #86
• ci: scope the CI workflow token to contents: read by @Danathar in #88
• test: join SERVER_INSTRUCTIONS and prompts/research-a-book.md to the tools they describe by @danathar-atomic-hive[bot] in #98
• release: ship a bundle that starts on every platform it declares by @Danathar in #99
• fix: read shelf names from the profile page, fail loudly on a sign-in wall by @Danathar in #100
• fix: run tool calls off the event loop so pings and parallel calls get through by @Danathar in #101
• docs: record the list_shelves sign-in wall in the live-endpoints runbook by @Danathar in #103
• fix: name this fork in the manifest's author, homepage and repository by @Danathar in #104
• fix: give series_books and popular_books the shared discovery shape by @Danathar in #102
• fix: refuse out-of-range tool inputs instead of answering as if they were valid by @Danathar in #106
• fix: keep a bad config.json from killing the server at import by @Danathar in #105
• test: check the tree against .editorconfig by @danathar-atomic-hive[bot] in #108
• fix: keep .coverage out of the packed bundle by @danathar-atomic-hive[bot] in #110
• test: check the three GitHub templates against what they describe by @danathar-atomic-hive[bot] in #113
• ci: bound every workflow job with timeout-minutes by @Danathar in #114
• test: read docs/reflections/ as a subject and correct its client.py claim by @danathar-atomic-hive[bot] in #119
• fix: read the variable assignments in front of an allow-listed command by @danathar-atomic-hive[bot] in #116
• test: read the Copilot and Cursor rule files as subjects by @danathar-atomic-hive[bot] in #123
• #121 is already fixed by #116 — pin the one row #116 didn't cover by @Danathar in #124
• Decide the whole command-reach corpus in one pass by @Danathar in #125
• Refuse a dotted warning category in pytest -W by @Danathar in #126
• guard-bash: refuse noglob in front of a guarded verb by @Danathar in #127
• guard-bash: refuse a wrapper spelled with a backslash, read as typed by @Danathar in #128
• security: hold changes to the agent permission boundary for a human by @danathar-atomic-hive[bot] in #130
• test: check review-rubric.md and risk-tiers.md against the code by @danathar-atomic-hive[bot] in #132
• security: write down what each workflow's token may do by @Danathar in #136
• docs: add a dated metrics snapshot under docs/metrics/ by @Danathar in #137
• docs: name the repository in every docs/metrics.md command by @Danathar in #138
• test: read quoted keys and any indent in the permissions policy test by @Danathar in #139
• test: join docs/SECURITY-AI.md's guard description to the guard by @danathar-atomic-hive[bot] in #141
• docs: guard docstring lists six divergences, not three by @Danathar in #142
• ci: skip ai-fix.yml when a bot sends the event by @Danathar in #145
• test: fail if an allow row could run a grouped command unprompted by @Danathar in #146
• test: catch allow rows that name an if, for or while command by @Danathar in #147
• security: commit a ruleset that keeps main behind a pull request by @danathar-atomic-hive[bot] in #149
• test: read the add-a-tool recipes as subjects and name every registry copy by @danathar-atomic-hive[bot] in #151
• docs: say the Hive here runs at ACMM L5 by @Danathar in #154
• fix: cap get_reviews paging and stop on a repeated cursor by @Danathar in #155
• test: route the diagnose prompt's GraphQL failures to their real causes by @danathar-atomic-hive[bot] in #158
• test: pin has_more on the repeated-c...

v0.1.1

Full Changelog: https://github.com/Danathar/goodreads-mcp/commits/v0.1.1