Skip to content

v2.0.2 — URL hardening, MCP schemas, and docs

Choose a tag to compare

View all tags
@TheStreamCode TheStreamCode released this 02 Aug 09:45
· 12 commits to main since this release
v2.0.2
2755a9f

Security

  • Redact query strings and fragments from network-error messages so signed asset URL credentials cannot leak into MCP or CLI logs.
  • Reject additional IPv4 and IPv6 special-purpose ranges as asset download targets, including documentation, ORCHID, site-local, and deprecated 6to4 addresses.

Fixed

  • Document the complete generate_media result, including schemaHash and provenancePath, in the README and bundled Agent Skill.

Changed

  • Publish explicit MCP output schemas and matching structuredContent for clients supporting typed tool results.
  • Mark read-only MCP tools as non-destructive.
  • Add a repository-specific AGENTS.md and strengthen ignore rules for npm tarballs and local npm configuration.

Verification

  • CI passed on Node.js 20, 22, and 24.
  • CodeQL passed for Actions and JavaScript/TypeScript.
  • 75 tests passed; 3 opt-in live tests skipped.
  • Coverage: 84.75% statements, 77.42% branches, 90.99% functions, 89.34% lines.
  • npm audit reports no vulnerabilities; Gitleaks reports no leaks.
  • Tarball SHA-256: 999B7498D642E6B5907D55A183DD0475132F35605F55CCC4745CB3C206D0DBD2.
Assets 3
Loading