v0.6.2

Patch Changes

• ce74bb5: OAuth conformance with MCP spec revision 2026-07-28.

  Dynamic Client Registration now declares application_type: 'native'. The CLI is
  a native app authorizing through a loopback redirect, and saying so keeps an
  OIDC-compliant server from rejecting the http://127.0.0.1 redirect URI that web
  clients are not allowed to use.

  The authorization response's iss is now validated against the issuer found
  during discovery (RFC 9207), which closes the mix-up case where a callback is
  replayed from a different authorization server. A callback that omits iss
  still completes, since not every server sends it and rejecting those would break
  otherwise-valid logins.

v0.6.1

Patch Changes

• Publish with a provenance attestation.

  The repository is now public, which npm requires before it will accept a provenance attestation. Every release from here carries a signed, publicly verifiable link from the tarball on npm back to the exact commit and CI run that produced it — check it with npm audit signatures.

v0.6.0

Minor Changes

• 61d267b: Track the 85-tool Every MCP surface.

  The server surface grew from 78 to 85 tools: custom fields (define, read, set and search, including tags), scheduled tasks (list, create, cancel), record timelines, entity counts, read-only pipeline settings, and pending-deal approval. The six retired Bookings tools are gone.

  Tools are discovered at runtime, so they were already reachable — this release brings the local state that does not auto-update into line:

  • approve_pending_deal is pinned to the write tier by an explicit name-based override. It activates a deal and queues its plan, which is hard to undo, and the server marks it non-destructive — so without this its safety tier would depend entirely on that annotation staying correct.
  • The bundled use-every skill no longer teaches the removed booking tools, and documents the custom-fields and scheduled-task workflows.
  • Test fixtures now mirror the real 85-tool surface with annotations read from the live server rather than hand-written.