Skip to content

UVCS MCP 1.3.0

Choose a tag to compare

View all tags
@ProAnima ProAnima released this 07 Oct 20:03
· 4 commits to main since this release
v1.3.0
8e39539

UVCS MCP 1.3.0 is a hardening release. It closes an option-injection gap in path-scoped writes, makes cm execution reliable on Windows and with non-ASCII paths, and makes first-time setup work without manual fixes. Upgrading is recommended for every installation that uses the standard or guarded profile.

Security

  • Paths, branch names, and labels that start with - are rejected. In 1.2.x an item path such as -r reached cm undo as an option, which could widen uvcs_undo to a recursive undo of the workspace root.
  • @modelcontextprotocol/sdk 1.32.1 and zod 4.6.5; npm audit reports zero known vulnerabilities.
  • Every tool carries MCP annotations, so clients can auto-approve read-only tools while keeping manual approval for *_confirm tools. The server also sends instructions describing the prepare → approval → confirm workflow.

Reliability

  • Cyrillic and other non-ASCII paths and comments from cm are decoded correctly on Windows (OEM/ANSI code pages are detected automatically; UVCS_CM_OUTPUT_ENCODING overrides).
  • cm never waits for interactive input, and timeouts terminate the whole process tree before the write lock is released.
  • Private and ignored files no longer block switch or merge or count toward the checkin limit.
  • The current branch and repository identity come from cm wi, which also works while the server is unreachable.
  • Write locks use a heartbeat and recover immediately from crashed processes.

Setup

  • init writes project configs into the workspace (or --project-dir), detects the absolute cm path, uses cmd /c npx on Windows only for clients not confirmed to resolve npx.cmd, validates every target before writing, keeps timestamped backups, and never prints other servers' settings.
  • doctor distinguishes a wrong workspace path from a missing cm.
  • Node.js 22 or newer is required.

Quality gate

  • 135 automated tests (one POSIX-only test skipped on Windows), ESLint, and syntax validation.
  • Fake single-workspace and fleet MCP smoke flows with real pending-change tracking.
  • npm run smoke:pack installs the packed tarball into a clean project and starts the installed server.
  • CI on Ubuntu, Windows, and macOS with Node.js 22, 24, and 26.
  • Read-only live validation on Plastic SCM 10.0.16.6656: doctor, status with Cyrillic paths, locks, changeset analytics, branch detection for branch- and changeset-loaded workspaces, and offline repository detection.

Upgrade

npx -y @proanima/uvcs-mcp@1.3.0 init --client=claude-code --workspace="D:/Repositories/YourWorkspace" --safety=guarded
npx -y @proanima/uvcs-mcp@1.3.0 doctor --workspace="D:/Repositories/YourWorkspace"

Restart the MCP client after upgrading. See the changelog, configuration reference, and security model.

Assets 2
Loading