0.1.3

django-stateless-mcp 0.1.3

Fixed

• The view now works in a default Django project: it is CSRF-exempt. Any
  project running the standard CsrfViewMiddleware — which is to say, any
  conventionally configured Django project — rejected every MCP POST with
  403 "CSRF cookie not set". MCP clients authenticate with a bearer header
  an attacker's page cannot set, not ambient cookies, so CSRF does not apply;
  mcp_view now returns a csrf_exempt view (the same posture DRF takes for
  token-authenticated APIs). Caught by CodeQL when the example project gained
  a realistic middleware stack; a regression test now posts through
  Client(enforce_csrf_checks=True).

Changed

• The example project carries the standard middleware a real project runs
  (sessions, CSRF, auth), so request.user exists on every endpoint —
  AnonymousUser when unauthenticated — instead of a tool touching .user
  crashing with AttributeError on the open endpoints.
• example/README.md is now a reproduction-grade walkthrough of the full
  manual test plan: MCP Inspector setup (including the Protocol Era gotcha),
  the elicitation round-trip, the permission grant/revoke cycle, and the
  statelessness curl proofs — plus the July 2026 client status: Claude Code
  speaks the stateless transport but not SEP-2322 elicitation yet, so MCP
  Inspector is the reference client.