Repository navigation
0.12.0
0.12.0 — MCP command and validation fixes
9 October 2026. Minor on 0.11.0.
The opentide-mcp console script is gone. The stdio server is opentide mcp start. Regenerate editor config with opentide setup mcp. Re-run opentide setup ci so a live query job runs only when every required credential variable is set. Regenerate schemas with opentide generate so object lists such as threat.chaining are not given a string vocabulary enum.
Install
pip install opentide==0.12.0
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide validate --strictRemoved
- The
opentide-mcpconsole script. The stdio server isopentide mcp start. There is no alias (#460).
Changed
opentide setup mcpwritescommand: opentideandargs: ["mcp", "start"].opentide mcpwith no subcommand prints help and exits. The editor owns stop and reload (#460).
Fixed
- Splunk
[[modifiers]]loads as an array of tables. A configValueErrorduring engine load is no longer reported only as a missingdeclare(#466). - Generated schemas no longer put a string vocabulary enum on
threat.chainingitems or on the array node.list[str]vocabulary fields still getitems.enum(#468). - Stage-prefix suggestions strip using the field name, including when the caller passes
surface::1.0. MISP actor UUIDs still get no suggestion (#467). - A retired
[tenants.setup] proxykey fails the live query check with a message namingopentide --proxy. That retirement covers platform tenant config, not only[cve].proxy(#469). --livefails when a credential is still an unsubstituted$VARIABLE. Generated CI runs that job only when every required credential variable is set (#471).- Validate findings for vocabulary and cross-object checks record
yaml_line, including list indexes such asactors[0]. Lint findings are unchanged (#470).
Verify
python -c "import opentide; print(opentide.__version__)"
opentide mcp --helpExpect 0.12.0.