Conversation
All 44 tools now ship a 3-sentence description hitting the six Glama
Tool Definition Quality Score dimensions (purpose, when-to-use vs.
siblings, side-effects/audit/network, parameter semantics, conciseness,
returns). Common parameter schemas (`scope`, `projectPath`, `env`,
`teamId`, `orgId`) and per-tool Zod `.describe()` strings now include
formats, defaults, and concrete examples to lift the per-tool minimum
score that dominates the server-level grade (60% mean / 40% min).
- src/mcp/tools/_shared.ts: enriched commonSchemas describe() strings
- src/mcp/tools/{secrets,project,tunnel,teleport,audit,validation,hooks,
tooling,agent,policy}.ts: 44 tool descriptions rewritten + parameter
describe() strings tightened
- README.md: MCP tables resynced with new one-liners
- CHANGELOG.md: 0.11.7 entry
- package.json / server.json / plugin.json / marketplace.json: 0.11.7
No runtime / MCP wire-format changes — agents will see longer, clearer
tool descriptions on next tools/list refresh; tool names, parameters,
and return shapes are unchanged.
Test plan:
- pnpm run typecheck ✓
- pnpm run lint ✓ (max-warnings 0)
- pnpm run build ✓
- pnpm run test:ci ✓ (24 files / 164 tests)
Made-with: Cursor
feat: v0.11.7 — Glama TDQS overhaul for all 44 MCP tools
…patches (#58) * feat: v0.12.0 — security hardening, dashboard rebuild, dependency patches Security - export_secrets now honors the requiresApproval gate on bulk reads (was bypassable over MCP); skips protected keys lacking a valid grant. - Governance policy is anchored to the MCP server's launch CWD (setPolicyRoot) so an agent can't escape .q-ring.json restrictions via a crafted projectPath. - import_dotenv treats input as literal content for MCP/agent/api callers (file-path convenience is CLI-only), closing a local-file-read vector. - SSRF protection re-validates the resolved IP at connect time (guardedLookup), closing the DNS-rebinding TOCTOU window. - Teleport PBKDF2 raised 100k -> 210k (SHA-512, OWASP); bundles record `iter` so legacy bundles still decrypt. - Status dashboard endpoints require a per-launch, timing-safe token. - Hardened exec network detection (basename) and checkExecPolicy (token/path boundary, not substring); policy cache invalidates on .q-ring.json mtime. - Fixed dotenv inline-comment parsing and the password class guarantee. - New regression tests (176 total). Dashboard - Rebuilt the live status dashboard on Preact + htm with VDOM diffing, so the SSE stream updates data in place: entrance animations run once instead of replaying every 5s (the flicker/"reload" bug), and focus/scroll are preserved. - Still a single self-contained, offline, CSP-clean page: the runtime + app are esbuild-bundled (src/dashboard-client/main.js -> src/core/dashboard-client.ts via scripts/build-dashboard-client.mjs, run by `build`) and inlined. Dependencies - Cleared 23 Dependabot alerts via pnpm overrides (hono, qs, ip-address, fast-uri, esbuild, postcss) + vite pinned as a devDependency. - Added preact/htm/esbuild as devDependencies only; no new runtime deps. Breaking - Dashboard returns 403 without the token; use the printed tokenized URL. - Single MCP server spanning multiple project roots now applies only the launch directory's policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): pin pnpm, trim bleeding-edge deps to satisfy lockfile policy CI ran pnpm@latest (v11), which ships a default minimumReleaseAge supply-chain policy and no longer reads `pnpm.overrides` from package.json — diverging from the local pnpm 10 and failing `--frozen-lockfile` on 18 freshly-published lockfile entries. - Pin pnpm via `packageManager: pnpm@10.32.1`; CI reads it (drop `version: latest`) so resolution matches local exactly. Add pnpm cache to setup-node. - Pin `vite` to 8.0.16 (was floating to 8.1.0, which drags in the just- published rolldown 1.1.3 native-binary stack); 8.0.16 uses aged rolldown 1.0.3 and still fixes the vite advisory. - Pin the `qs` override to 6.15.2 (the patched, aged release) instead of floating to the same-day 6.15.3. - Regenerate a lean lockfile from the develop baseline (no --force churn). Local parity with CI: install --frozen-lockfile, audit --audit-level=high (0; 2 dev-only moderates remain), typecheck, lint, build, 176 tests — all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci: cancel superseded runs on the same ref Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
- Dependabot: weekly npm + github-actions updates; minor/patch grouped into prod/dev batches to cut PR noise, majors/security stay individual. - PR template with type + verification checklist matching CI gates. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…Manager) (#65) pnpm/action-setup errors when both a `version` input and the package.json `packageManager` field are set. ci.yml was already fixed; do the same here so the release publish workflow can run. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The v0.12.0 npm publish succeeded, but the MCP Registry step failed with 'cannot publish duplicate version' because server.json was still at 0.11.7 — sync-versions never updated it. - Bump server.json to 0.12.0 (top-level + npm package entry). - Teach sync-versions to keep server.json in lockstep going forward. - Make the npm-publish step skip when the version already exists, so the release workflow is safe to re-run (e.g. after the MCP step fails). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hotfix for the v0.12.0 MCP Registry publish (stale server.json). 🤖 Generated with Claude Code