Skip to content

v0.3.0 - Production hardening

Choose a tag to compare

View all tags
@VictorNain26 VictorNain26 released this 19 May 07:42
· 29 commits to main since this release
v0.3.0
776e8c4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Production hardening release. Bundles the Critical/Blocker findings from the May 2026 security + DevOps audits.

Highlights

  • Stateless streamable HTTP — stateless_http=True, json_response=True on FastMCP. Horizontal scaling on Koyeb / Fly / Cloud Run without sticky sessions. Aligns with the MCP draft spec direction (sessions removed).
  • Mandatory MCP_AUTH_TOKEN in HTTP mode (BREAKING) — process exits with code 2 if unset. Closes the gap where an operator could ship an open /mcp endpoint and silently burn the fallback Pexels quota. Local dev override: MCP_ALLOW_UNAUTHED=1.
  • Graceful shutdown — timeout_graceful_shutdown=8 so in-flight tool calls survive Koyeb's ~10s SIGTERM window during rolling deploys.
  • Dockerfile cache fix — split COPY src from the lockfile copy so the deps-only uv sync layer caches independently of source changes.
  • Visual-pick tool (pexels_preview_media) and per-request Pexels key via X-Pexels-Api-Key consolidated from Unreleased.

Breaking changes

Set MCP_AUTH_TOKEN on the Koyeb env before deploying this version, or boot fails immediately.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.3.0/CHANGELOG.md

Assets 2
Loading