v0.2.0

Not published to PyPI; install from source with uv sync.

• Finding tools. The run_python description keeps every stub while they fit 12,000 characters, then one line per tool. Inside the code, TOOLS[name] shows a stub and search_tools(query) ranks tools by word; neither reaches a wrapped server or uses the call budget. Tool descriptions are cut at 2 KiB.
• Several servers. serve --config FILE wraps every stdio server in an mcpServers file, with allow and private per server. Tools are named server__tool, one call budget covers a run across all servers, and unsupported keys (url, headers, anything else) stop startup by name.
• Private data. --private TOOL, or private in a config entry, marks tools that may see private data. From the first call to one, every tool that is not private is refused, on every server, until mcp-code-mode exits. Unlabelled tools count as outlets.
• Hardening. A schema too deep to check leaves that tool out instead of stopping startup; parameter names that are not short identifiers are quoted and cut.
• Docs. A Related work section, threat model rows for each new control with its tests, the private-data rule's limits, and the agent skill updated for TOOLS, search_tools and private-data refusals. The design and its five reviews are in docs/designs/.

Breaking changes

• The sandbox image tag is now mcp-code-mode-sandbox:2: run mcp-code-mode build-image again.
• A wrapped tool named TOOLS or search_tools now gets a trailing underscore.

Tested with the toy servers end to end; not yet tried with a desktop MCP client.