v0.5.0

An audit release. Nothing here adds a feature — it removes two things that were reporting success while doing nothing, and one hand-synced duplicate.

Changes that affect callers

list_forums now returns {id, name} instead of {id, name, depth}.

depth was broken and had already shipped that way. It counted indentation by looking for non-breaking spaces, but at some point those were normalized to ordinary spaces in the source — so it counted the spaces in the forum's name instead. Verified against the live forum: 61 of 76 nodes reported a wrong depth. Other Peptides / Stacking / Etc. claimed depth: 6 while sitting at hierarchy level 2, purely because its name contains five spaces.

Nothing read the field and no test covered it, so it stayed green through all of v0.4.0. Rather than repair a field with no consumer, it's gone. name is unaffected and was never at risk — the reason it survived the same normalization is that JS \s already matches a non-breaking space.

If you were reading depth, you were reading noise. There is no replacement.

Internal

The search mutex now has a test that can actually fail. The old one asserted against a hand-copied duplicate of the mutex rather than the mutex itself, so it would have passed no matter how badly searchForum regressed. The chaining is now a named serialize() export that the selftest drives directly, and it additionally covers the rejection path — that one matters, because the server rejects routinely on rate limits and a poisoned chain would break every later search for the life of the process.

manifest.json no longer carries a tools array. It was optional display metadata (the MCPB v0.3 schema requires only name/version/description/author/server), hand-synced against src/index.js with nothing checking the two agreed. All five tools still register exactly as before — verified by driving the shipped bundle over MCP stdio.

Also fixed: package-lock.json carried a bin path pointing at dist/index.js, a file that has never existed.

Install

Download glp1forum-mcp.mcpb below and double-click it (Claude Desktop), or use the plugin marketplace — see the README. You still need system curl on your PATH.

v0.4.0

Deletions only. One tool-schema change; everything else is internal cleanup found by a repo-wide over-engineering audit.

Changes for callers

• search_forum.prefixes is removed. Its own description told you to skip it — the numeric prefix IDs were not discoverable from any tool, so the param could not be used correctly. Nothing else about search_forum changes: same rows, same filters, same truncated/lastPage semantics. If you were passing prefixes, it was being ignored in practice; drop it.

No other tool changes. get_thread, get_thread_images, list_threads, and list_forums are untouched, and output size is unchanged.

Internal

• The stale-cookie-jar reaper (a tmpdir scan on every import, reclaiming ~1KB files from crashed siblings) is replaced by a one-line exit handler that removes only its own jar.
• allowScripts dropped from package.json — it configured a tool that was never a dependency, and its esbuild@0.24.2 pin contradicted the declared ^0.24.0 range.
• getToken/sniffMime un-exported; neither had an external consumer.
• package-lock.json resynced (it had drifted a version behind).

Net −19/+7 lines in src/. Selftest passes in full against the live forum.

v0.3.1

Every tool param now describes itself

The server's param guidance lived only in SKILL.md, which .mcpbignore excludes from the .mcpb — so Desktop one-click users got a schema of bare types with no prose, and had to guess. A blind-execution test showed three agents independently guessing wrong at the same four things: searchType vs groupByThread, order direction, url-vs-threadId, and prefixes.

All 5 tools now carry .describe() on every param, so the advice arrives in tools/list itself:

• keywords — AND-matched. On 0 hits, drop a term, never add one.
• nodes — IDs come from list_forums; a guessed ID silently returns 0 rows rather than erroring.
• includeChildNodes — required true for parent/category sections, which hold no posts of their own.
• searchType / groupByThread — omit searchType (= post) plus groupByThread: true is the discovery default; "thread" matches titles only.
• order — omit for relevance, "date" for current/in-stock questions, "replies" for reputation.
• prefixes — skip; the numeric IDs aren't discoverable from any tool.
• get_thread.page — for current status read lastPage; the opening post may be months stale.
• get_thread_images.max — each image is one throttled request and ~4.6k tokens.

No behavior or output-size change. Same 5 tools, same params, same required fields, same return shapes — this only adds text to the schema. Callers need no changes.

Discoverability

keywords across all four manifests gain mcp, mcp-server, model-context-protocol, and claude; the previous five said nothing about what this actually is. The GitHub repo's description and topics were empty and are now set.

v0.3.0

First packaged release. An MCP stdio server that searches and reads
glp1forum.com — no API keys, no account.

Install

Claude Desktop (one click): download glp1forum-mcp.mcpb below and double-click it. No paths to
edit, no npm install — the server is bundled into a single dependency-free file.

Claude Code: /plugin marketplace add Sedation6612/glp1forum-mcp, then install the
glp1forum-mcp plugin. This channel also installs a skill that teaches Claude the forum's traps
(node scoping, AND-matched keywords, image-only pricing) — the .mcpb ships the tools without it.

Either way you need Node 18+ and system curl on your PATH.

Tools

• search_forum — full-text XenForo search: keywords, node scoping, author, date range, min
  replies, prefixes, ordering, pagination.
• get_thread — a thread's posts with author, timestamp, body, and permalink. Quotes are
  collapsed to readable snippets and links are preserved rather than flattened away.
• get_thread_images — downloads a thread's attachments at full size so vision can read
  them. Much of the forum's pricing and stock information is image-only and invisible to
  get_thread's text.
• list_threads / list_forums — browse sections and discover the numeric node IDs that
  search_forum needs.

Notes for callers

• Attachments come back full-size, not thumbnails. Worth stating because the difference is
  large: a representative attachment is 8,502 B as a thumbnail and 182,420 B (2584×1392) at full
  size — fine print like per-warehouse stock tables and COA purity figures is legible only in the
  latter. The cost is ~4.6k tokens per image, so get_thread_images is opt-in and defaults to 4
  images (max 5) to stay under a 25k output budget.
• Every request is globally throttled ≥2.5s apart, across all processes on the machine. Plan few
  calls. On a rate-limit error, wait ~60s and retry that one call once — don't loop.
• Verified on Windows curl 8.18 (Schannel). Cloudflare fingerprints TLS; Linux/macOS curl
  presents a different fingerprint and may get a 403. If every request 403s, that's why.

Known limitations

• Read-only. There is no posting, voting, or authentication — guest sessions only.
• The HTML parsers track XenForo's current templates. If the forum re-themes, npm run selftest
  is the tripwire.