v0.9.0 - confirm gate on all live write tools

0.9.0 - 2026-09-17

This is a security release. @tmhs/steam-mcp 0.8.0 and earlier are affected.

Security

• All five default-bin Partner API write tools (steam_grantInventoryItem, steam_setAchievement, steam_clearAchievement, steam_uploadLeaderboardScore, steam_updateWorkshopItem) now default to dry_run: true and refuse to contact Steam unless confirm: true.
• steam_getReviews, steam_queryWorkshop, steam_getWorkshopItem, and steam_getNewsForApp label untrusted free text (user-authored or third-party) so agents treat it as data to summarize, not as commands. The label is defense in depth. The confirm gate is the control. steam_getPlayerSummary and steam_getAppDetails are deliberately unlabeled.
• Reported by Syed Anas Mohiuddin, Independent Researcher, Maintainer of mcp-safeguard

Changed

• Package copy now counts 5 write tools and 2 SDK code-example generators, instead of grouping both as 7 write tools.
• Shared confirm/dry-run helpers live in src/utils/confirm.ts and are used by both the default bin and the Partner-admin process.

BREAKING CHANGE: write tools no-op by default. Callers that invoked them with no flags previously sent a live POST. They now receive a dry-run plan and send nothing. To execute for real, pass dry_run: false and confirm: true.

Old call:

{ "appid": 480, "steamid": "76561197960435530", "achievement": "ACH_WIN_ONE_GAME" }

New call (sends for real):

{ "appid": 480, "steamid": "76561197960435530", "achievement": "ACH_WIN_ONE_GAME", "dry_run": false, "confirm": true }