v1.7.2

Patch release. Every listing now states the 194 metrics the catalog ships (README, llms.txt, npm, MCP Registry, .mcpb, LobeHub): the app added 5 derived CGM metrics (time in, below and above range, glucose CV, GMI). A new test pins every "N metrics" claim to the catalog so it cannot drift again. README badge lists opencode and VS Code. Server behaviour unchanged from 1.7.1.

Install: npx -y health-export-mcp

Verify: SHA256SUMS and SHA256SUMS.minisig are attached (minisign public key: minisign.pub in the repo).

1.7.1: npm description + registry sync

Patch release. Phrase-optimized npm description (66 keywords), server.mjs/server.json/manifest/lhm version sync, and a registry-valid description so the official MCP Registry can publish 1.7.1. Server behaviour unchanged from 1.7.0.

Install: npx -y health-export-mcp

1.7.0: mid-trial relay, per-source attribution, always-on app link

1.7.0

• get_mcp_status now names the mid-trial unlock link, so a user at the midpoint of the trial sees the one-time unlock instead of silence.
• Per-source attribution: tool responses carry a sources block (schema minor 2), so an agent can cite which HealthKit sources fed each metric.
• The campaign-tagged app link is returned on every get_mcp_status.

Server only, read-only, zero runtime network calls.

npm: npx -y health-export-mcp@1.7.0

v1.6.8

Docs-only release. The README now points wellness and coaching platform builders at MetricBridge for platforms (https://www.healthexport.dev/platforms/): the same iOS app that writes the file this server reads can POST signed JSON (Standard Webhooks v1, published JSON Schemas) straight to a platform's endpoint, with a zero-dependency conformance kit at https://www.healthexport.dev/docs/platforms/. No server behaviour changes. SHA256SUMS and the minisign signature follow once npm has published the tarball.

v1.6.7

App Store links open the builder-focused Custom Product Page. When no export is found, the freshness recommendation and the get_mcp_status app card (app.appStoreUrl) carry a direct App Store link (ct=mcpserver) that opens the MCP-focused product page, next to the existing website link. The README, AGENTS.md, llms.txt and .mcpb manifest links open the same page. npm test requires it on every shipped App Store link. Text only: still zero runtime network calls. Assets signed with minisign key 951BA54856154FBA; see SECURITY.md.

v1.6.6

Docs and guard release: the App Store link in llms.txt (shipped in the npm package) now carries campaign attribution (ct=githubreadme), and npm test checks every App Store link on every shipped surface, including the packed .mcpb manifest. No server behaviour change. Assets signed with minisign key 951BA54856154FBA; see SECURITY.md.

v1.6.5

When there is no usable export, get_freshness's plain-language recommendation now names the companion app's website, so agents relay it. No export: 'Export from the MetricBridge iOS app ()'. Stale beyond the server's own window and readable: notes that exports stop when the free trial ends. Fresh, demo, locked, encrypted-without-passphrase and stricter caller windows get no link. Text only: still zero runtime network calls. Assets signed with minisign key 951BA54856154FBA; see SECURITY.md.

v1.6.4

Docs-only release: the npm README now carries the campaign-tagged App Store links (ct=githubreadme, #13). No server code changes. Assets signed with minisign key 951BA54856154FBA; see SECURITY.md.

v1.6.3: companion-app link in get_mcp_status when there is no export

get_mcp_status now points a new install at the companion app.

• When there is no usable export (none found, a stale one, or --demo data), get_mcp_status includes an app block with the website of the MetricBridge iOS app that writes the export. With a fresh export, a pairing lock or an undecryptable export the block is absent.
• The link carries fixed campaign labels (utm_source=mcp, utm_medium=agent-tool, utm_campaign=mcp-unlock), identical for every user. The server still makes no network requests. Disclosed in the README privacy section.
• Additive: no existing key in the result changed.
• Rebuilt health-export.mcpb; server.json carries its new fileSha256.

SHA256SUMS lists the npm tarball (byte-identical to the one on the npm registry) and the bundle, and SHA256SUMS.minisig is its minisign signature made with the key in minisign.pub. See SECURITY.md to verify. npm provenance and the MCP Registry entry are published from this tag by the release and registry workflows.

v1.6.2: refreshed GitHub Actions pins (Dependabot)

Maintenance patch. No server behavior change.

• ci: bump actions/checkout to v7.0.1 and actions/setup-node to v7.1.0 across ci.yml, release.yml and registry.yml (#10, #11), keeping every step pinned to a full commit SHA.
• Keep the release version strings in sync: package.json, server.json (root, npm and mcpb packages), manifest.json, lhm.plugin.json, server.mjs SERVER.version and the .mcpb manifest.
• Rebuilt health-export.mcpb; server.json carries its new fileSha256.

npm and the official MCP Registry are published from this same tag by the release and registry workflows.