Skip to content

oorep-mcp v1.2.2

Choose a tag to compare

View all tags
@Dhi13man Dhi13man released this 03 Aug 15:38
· 8 commits to master since this release
v1.2.2
0ff9eb3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Open-source maintenance: Added community issue and pull request templates, a Code of Conduct, private vulnerability-reporting guidance, and OpenSSF Scorecard reporting.
  • MCP Registry publishing: Added current registry metadata and automated publication of io.github.dhi13man/oorep-mcp after npm releases.
  • Project metadata: Added citation metadata, GitHub funding configuration, and provenance context for the repertory structure analysis.

Changed

  • Supported runtime: Raised the minimum Node.js version from 18 to 20 to use patched Hono dependencies.
  • Build and test gates: Clean stale build output, run formatting as a non-mutating check, and count live end-to-end assertion failures instead of reporting false passes.
  • Release authentication: Replaced long-lived npm tokens with short-lived GitHub OIDC credentials; npm trusted publishing now emits provenance automatically.
  • Repository access: Changed the OOREP submodule URL from SSH to HTTPS so anonymous clones can initialize it.

Fixed

  • Live repertory search: Support the current grouped OOREP response shape while retaining compatibility with legacy flat results.
  • Metadata validation: Omit unavailable repertory and materia medica author/language fields instead of returning invalid null values.
  • CodeQL findings: Removed unused bindings and scoped SARIF upload permissions to the analysis job.
  • Package surface: Removed a duplicate interface barrel and corrected the public SDK interface/export checks.

Security

  • Updated direct and transitive dependencies to remove all 18 reported npm audit findings, including two critical findings.
  • Pinned third-party GitHub Actions to immutable commit SHAs and disabled persisted checkout credentials.
  • Made CodeQL and OpenSSF failures visible, and removed the inactive Codecov upload path while retaining enforced coverage thresholds in CI.

Dependencies

  • Core: @modelcontextprotocol/sdk 1.25.1 → 1.30.0, zod 4.2.1 → 4.3.5.
  • Toolchain: TypeScript 5.8 → 6.0.3, ESLint 9 → 10, Node.js types 25 → 26, Vitest 4.0 → 4.1, and compatible TypeScript-ESLint, Prettier, and transitive security updates.

Full changelog

Assets 2
Loading