chutes-media-mcp v2.0.5

Fixed

• Preserve the case-sensitive TheStreamCode GitHub account name in MCP Registry metadata so the package namespace matches the publisher identity authorized by the official registry.

Verification

• CI passed on Node.js 20, 22 and 24.
• CodeQL passed for Actions and JavaScript/TypeScript.
• Runtime dependency audit reported 0 vulnerabilities.
• The npm package contains the expected 13 files.
• server.json passes the official mcp-publisher validator.

No live GPU generation was run.

Full changelog: v2.0.4...v2.0.5

chutes-media-mcp v2.0.4

Highlights

• Reworked the README around a copy-paste quick start, clearer positioning, and verified support routes.
• Added a project-owned social preview without additional Chutes marks.
• Added official MCP Registry metadata through server.json and the npm mcpName field.
• Expanded npm and GitHub discovery keywords.

Verification

• CI passed on Node.js 20, 22 and 24.
• CodeQL passed for Actions and JavaScript/TypeScript.
• Runtime dependency audit reported 0 vulnerabilities.
• The npm package contains the expected 13 files.

No live GPU generation was run for this documentation and metadata release.

Full changelog: v2.0.3...v2.0.4

v2.0.3 — Security and audit hardening

Security

• Restricts CHUTES_API_KEY to HTTPS chutes.ai and *.chutes.ai management and invocation URLs; custom and loopback management endpoints remain credential-free.
• Bounds management JSON and HTTP error bodies using the configured response limit.
• Replaces remaining catalog-controlled trailing-delimiter regexes with linear scans.
• Refreshes vulnerable transitive URL, IP, middleware, and Nano ID packages.

Reliability

• Bounds the short-lived model description cache.
• Rejects invalid output-directory ancestors before a GPU invocation.
• Keeps generated assets and provenance sidecars within portable filename limits.
• Aligns CLI input limits with the MCP schemas.

Verification

• 84 unit tests passed; 3 credit-spending live tests remained intentionally skipped.
• CI passed on Node.js 20, 22, and 24.
• CodeQL and npm audits passed with no open alerts.
• The npm tarball contains the expected 13 files; isolated CLI and MCP handshake smoke tests passed.

v2.0.2 — URL hardening, MCP schemas, and docs

Security

• Redact query strings and fragments from network-error messages so signed asset URL credentials cannot leak into MCP or CLI logs.
• Reject additional IPv4 and IPv6 special-purpose ranges as asset download targets, including documentation, ORCHID, site-local, and deprecated 6to4 addresses.

Fixed

• Document the complete generate_media result, including schemaHash and provenancePath, in the README and bundled Agent Skill.

Changed

• Publish explicit MCP output schemas and matching structuredContent for clients supporting typed tool results.
• Mark read-only MCP tools as non-destructive.
• Add a repository-specific AGENTS.md and strengthen ignore rules for npm tarballs and local npm configuration.

Verification

• CI passed on Node.js 20, 22, and 24.
• CodeQL passed for Actions and JavaScript/TypeScript.
• 75 tests passed; 3 opt-in live tests skipped.
• Coverage: 84.75% statements, 77.42% branches, 90.99% functions, 89.34% lines.
• npm audit reports no vulnerabilities; Gitleaks reports no leaks.
• Tarball SHA-256: 999B7498D642E6B5907D55A183DD0475132F35605F55CCC4745CB3C206D0DBD2.

v2.0.1 — CodeQL ReDoS hardening

Security

• Replaces polynomial regular-expression operations on API base URLs and model/cord identifiers with linear scans.
• Adds regression coverage using long repeated delimiter inputs.
• Resolves both high-severity CodeQL findings opened after v2.0.0; the repository now has zero open CodeQL alerts.

This patch contains no API changes beyond the v2.0.0 upgrade requirements. Install or upgrade with npm install chutes-media-mcp@2.0.1.

Full Changelog: v2.0.0...v2.0.1

v2.0.0 — enforced network and workspace boundaries

Security

• Restricts credential-bearing invocations to HTTPS Chutes hosts and rejects redirects.
• Blocks private/local asset downloads, unsafe redirects, and DNS resolutions to non-public addresses.
• Enforces real-path workspace containment for inputs and outputs, including symlink and junction escapes.
• Adds configurable size limits for remote responses and local input assets.

Changed

• Existing named assets are preserved unless overwrite / --overwrite is explicitly enabled.
• Adds stricter MCP/CLI validation and MCP safety annotations.
• Adds ESLint, Prettier, coverage gates, Node.js 20/22/24 CI, CodeQL, pinned CI actions, and zero-audit release checks.
• Updates the MCP SDK and vulnerable transitive Hono adapter; reduces the npm package to 13 files (about 138 KB compressed).
• Refreshes README, security policy, contributing guide, bundled Agent Skill, changelog, and citation metadata.

Upgrade from 1.x

Automations that intentionally replace a named output must now pass overwrite: true through MCP or --overwrite through the CLI. Custom management endpoints require HTTPS except for loopback development.

Install or upgrade with npm install chutes-media-mcp@2.0.0.

Full Changelog: v1.2.2...v2.0.0

v1.2.2 — credential scoping and workspace containment

Security

• Credential leak to lookalike domains. isChutesHost matched the asset URL with a bare hostname.endsWith("chutes.ai"), so hosts such as evilchutes.ai satisfied it and the Authorization header — carrying CHUTES_API_KEY — was attached to the download. The asset URL comes from the invoked chute's own response and the server lists public chutes by design, so any third-party chute could harvest the key by returning a crafted URL. The check now requires the apex host or a real subdomain.
• Arbitrary file read and upload. maybeEncodeFile resolved every non-text string param against the workspace with no containment, so an absolute path or a ../ escape (/etc/passwd, ../../.ssh/id_rsa) was read, base64-encoded and sent to the third-party model. Params come straight from the model, so the value was never user-controlled. Resolved paths must now stay inside the workspace root.
• Both are covered by regression tests in test/credential-scope.test.ts.

Fixed

• The server announced version 1.2.0 in the MCP handshake while the package shipped as 1.2.1. The version is now read from package.json instead of being duplicated as a literal.

Users of 1.2.1 and earlier should upgrade. If you ran the server against untrusted public chutes, consider rotating CHUTES_API_KEY.

Full Changelog: v1.2.0...v1.2.2

v1.2.0

Hardening: per-run schema pinning + provenance sidecar, strict params validation, and a response media-type guardrail. See CHANGELOG.md.

v1.1.0

Adds MCP server instructions so any client gets the workflow on connect, a chutes-media install-skill command, and ships the agent skill in the package. See CHANGELOG.md.

v1.0.0

First stable release. See CHANGELOG.md.