v4.3.0

Security

• Requests only go to the configured DAV account
  (GHSA-hfg5-7h5r-vgfq).
  Tools that take a calendar, address book, event, todo or contact URL
  accepted a URL on any host, and the DAV login (password or OAuth token) was
  sent along with the request. A URL is now accepted only below the
  configured server URL or below a URL that server named itself while logging
  in or listing the account's collections (for example a per-account host).
  Other hosts, other paths on the same host, plain http for a server
  configured over https, and URLs carrying a user name or password are
  refused before a request is made, with an error naming what is allowed.
  The check runs in the tool parameters and again on every request the DAV
  clients make, including each redirect a server answers with; the OAuth
  token endpoint is only used for token requests. The restriction is scoped to
  the configured path: a server URL that is only the bare host
  (https://dav.example.com/) leaves the whole host reachable, so configure
  the DAV path (for example https://dav.example.com/remote.php/dav/).

Added

• Claude plugin (claude-plugin/, #99). dav-mcp can be installed as a
  Claude Code plugin and listed in the Claude directory: it asks for the server
  URL, username and password (stored in the system credential store), starts
  this package pinned to its exact version, and adds a skill on using the tools
  well. npm run plugin:sync writes the pinned version on release.
• Tool annotations. Every tool declares a title and whether it only reads,
  or overwrites or deletes data (readOnlyHint, destructiveHint, …), so
  clients such as Claude can let lookups run and stop changes for approval.
• Privacy policy (PRIVACY.md), linked from the README and the
  MCP Bundle manifest.

Changed

• The tool-call log is off by default (#88). It used to append every tool
  call, with its full arguments (event titles, attendees, contact data), to
  /tmp/mcp-tool-calls.jsonl unless LOG_TOOL_CALLS=false was set: readable
  by other local users, never rotated, and on Windows a C:\tmp folder.
  Set LOG_TOOL_CALLS=true to turn it on. It then writes to
  $XDG_STATE_HOME/dav-mcp/tool-calls.jsonl (~/.local/state/…, on Windows
  %LOCALAPPDATA%\dav-mcp\…) with owner-only permissions, or to
  TOOL_CALL_LOG_FILE. If you ran an earlier version, delete the old log:
  /tmp/mcp-tool-calls.jsonl (on Windows C:\tmp\mcp-tool-calls.jsonl) still
  holds the calendar and contact data it recorded.