v0.5.0

Adds support for MCP SDK v2, which renamed FastMCP to MCPServer. Closes #33.

This fixes a broken install. The dependency was pinned only as mcp[cli]>=1.8.0, so a fresh install resolved to mcp 2.x, where mcp.server.fastmcp no longer exists. The server fell back to mock objects and exited claiming the SDK was "not installed", when it was, just a version it could not use.

Fixed

• SDK import is now tried v2-first (from mcp.server.mcpserver import MCPServer, Context), with a fallback to the v1 FastMCP path for environments pinned to mcp<2. (#33)
• Host and port were silently dropped on the HTTP transports under v2, which removed them from mcp.settings. The existing hasattr(mcp, 'settings') guard did not catch it, because .settings still exists and only lost those two fields. They now pass as run() keyword arguments on v2 and set on settings on v1.
• requires-python corrected from >=3.7 to >=3.10. This was already wrong before v2: every supported SDK, v1 from 1.8.0 onward and all of v2, has required 3.10 or newer.
• The startup failure message distinguishes an absent SDK from an unusable one, instead of telling you to install a package you already have.
• The manual test client works on both majors; v2 dropped the streamablehttp_client spelling.

Changed

• mcp[cli]>=2.0.0 is now the declared dependency (was >=1.8.0). compat.MCP_SDK_V2 reports which API is live.
• The server advertises its own version (0.5.0) to clients, which v2 defaults to an empty string.
• compat exports MCPServer, with FastMCP kept as an alias.
• CI runs against both SDK majors and asserts the SDK was actually detected and that all tools registered. The previous job would have passed while the server silently degraded to mocks, which is how this shipped.

Upgrading

pip install --upgrade "mcp[cli]>=2"

No tool or API changes: all 20 MCP tools are unchanged. Verified against mcp 2.1.1, mcp 1.29.1 and no SDK; 148 unit tests pass in each, and the integration suite passes 47/47 over stdio and streamable-http against a live server with a 112,712-event capture.

Full changelog: CHANGELOG.md

v0.4.0

Reliability / efficiency / stability hardening pass (full code review). Closes #23–#30.

Fixed

• A mid-stream parse error no longer reports success or caches a truncated capture — it raises and skips the cache write. (#23)
• Backend-correct compat.XMLSyntaxError alias (stdlib ElementTree has ParseError, not XMLSyntaxError) so malformed XML on the no-lxml path surfaces the real error.

Changed

• Loading runs off the event loop (asyncio.to_thread) — the server stays responsive during a long parse on HTTP/SSE. (#24)
• Parsed-capture cache is size-bounded with LRU eviction (default 5 GiB; PROCMONMCP_CACHE_MAX_BYTES override). (#25)
• export_query_results streams rows to disk (bounded memory). (#26)
• User filter regexes use Google RE2 when the optional re2 extra is installed (ReDoS-safe), falling back to stdlib re. (#27)
• find_file_access heap-merges per-path index lists and stops at limit. (#28)
• Hot scan loops read the clock only periodically. (#29)
• Event-detail formatting uses a shallow ProcessInfo.to_dict(). (#30)

No breaking API changes.

Full changelog: CHANGELOG.md

v0.3.1

Added

• filter_pid on query_events and export_query_results — select a single process by numeric PID (index-backed). Useful when a process name is hard to type exactly, e.g. non-ASCII names. (#21)

Fixed

• Non-ASCII process/path names were unreadable mojibake (e.g. 温度ã¹ã¤ãã.exe instead of 温度スイッチ.exe) and couldn't be matched by filter_process. Procmon's XML export double-encodes such text (UTF-8 → Latin-1 → UTF-8); the parser now repairs it on load for names, paths, image paths, command lines, owners, descriptions, and event detail. Conservative (only the exact double-encoding fingerprint is touched). Cache version bumped so existing caches re-parse. (#21)

Full changelog: CHANGELOG.md

v0.3.0

Added

• close_file tool — closes (unloads) the currently loaded capture and frees its memory, so a client can explicitly release a file before opening another or leave the server idle. Analysis tools refuse until another file is loaded; the on-disk cache is left intact. get_status now lists close_file as an available action while a file is loaded. (#19)

Full changelog: CHANGELOG.md

v0.2.2

Fixed

• --transport streamable-http crashed immediately with FastMCP.run() got an unexpected keyword argument 'host'. The MCP SDK's run() signature is run(transport, mount_path); host and port belong on mcp.settings. The Streamable HTTP branch now configures host/port/log level via settings (matching the SSE branch) before calling run(). stdio (the default) was unaffected. (#17)

Full changelog: CHANGELOG.md

v0.2.1

Fixed

• get_process_lifetime returned create_timestamp: null for processes that started during the capture. Procmon records a process's own start as a Process Start event (with that PID), while Process Create is logged by the parent (with the parent's PID); matching only Process Create against the requested PID never found the process's own creation. The tool now considers both operations and uses the earliest, so a process's own Process Start is used when present. (#14)

Full changelog: CHANGELOG.md

v0.2.0

First tagged release of the modular procmon_mcp package.

Added

• Parsed-capture cache — reloading an unchanged file is near-instant (29×–146× faster on real captures). New clear_cache tool, no_cache option (+ from_cache in the response), and --no-cache / --clear-cache CLI flags.
• list_network_connections — capture-wide network triage across all processes.
• get_network_top_talkers — ranks remote endpoints across the whole capture by event count.
• Enriched network records — host/ip/hostname/port, operations, inferred directions, results, count, and first/last-seen timestamps.
• Packaging — pyproject.toml with a procmon-mcp console script and lxml/psutil/all/dev extras; MIT LICENSE.
• CI — GitHub Actions across Python 3.10–3.13 with and without lxml, plus an sdk-smoke job that imports the server against the real MCP SDK. Tests grew 78 → 123.

Changed

• BREAKING: find_network_connections now returns enriched structured records ranked by count, not bare host:port strings.
• Endpoint parsing accepts resolved service-name ports (domain, https, …) and DNS hostnames.
• requirements.txt lists only mcp[cli] as required; lxml/psutil are optional.

Fixed

• Critical: event fields were read on the iterparse start event, silently dropping/nulling events on large captures; now read on end.
• Exact-match filters returned all events instead of zero for an absent value.
• Server failed to import on current MCP SDKs (description= → instructions=).
• Minor error-handling and load-ordering cleanups.

Security

• Cache files are serialized with Python's pickle module and read back only from the user-owned ~/.procmonmcp/cache directory.

Full details in CHANGELOG.md.