v2.8.0

Added

• Antigravity plugin, listed as Delegate to Cursor:
  agy plugin install https://github.com/andreilungeanu/cursor-delegate-mcp. It sets
  timeoutSeconds to 21660 s, a minute past the hard cap; Antigravity otherwise ends a tool call
  after 180 s.

Changed

• Copilot CLI installs from the plugin marketplace:
  copilot plugin marketplace add andreilungeanu/cursor-delegate-mcp, then
  copilot plugin install cursor-delegate@cursor-delegate-mcp. Copilot deprecates direct
  repository installs. Copilot's manifest moved from the repository root to
  .github/plugin/plugin.json.

Fixed

• The Copilot plugin's server starts. Copilot runs it inside the plugin folder, a copy of this
  repository, where npx -y cursor-delegate-mcp@X.Y.Z matched the pin to the folder's own
  package.json and failed with 'cursor-delegate-mcp' is not recognized. The Copilot, Codex and
  Antigravity configs pin npm:cursor-delegate-mcp@X.Y.Z, which npx always fetches. Existing
  installs pick it up with copilot plugin update cursor-delegate.

Internal

• The test suite passes under Windows' default PowerShell execution policy and removes its
  temporary plugin folders.

v2.7.0

Changed

• The default hard cap on a single delegation (CURSOR_DELEGATE_HARD_CAP_MS) is 6 h, up from 1 h,
  so long research and refactor runs fit in one call. Longer work continues in another run with
  resumeSessionId.

Fixed

• Codex lets a delegate call run to the hard cap. Codex times an MCP tool call by wall clock,
  300 s by default, whatever progress the server reports; the Codex plugin now sets
  tool_timeout_sec to 21660 s, a minute past the hard cap, so the bridge's hard-cap error
  arrives first. A server added by hand under [mcp_servers.cursor-delegate] in Codex's
  config.toml takes the same key. Reported in #20.

Security

• Lockfile bumps of zod to 4.6.7, body-parser to 2.4.0, fast-uri to 3.1.9, ip-address to
  10.7.6, qs to 6.17.1 and @hono/node-server to 2.1.6, clearing the high advisories
  GHSA-mrhx-c7xc-m3w5 and GHSA-27r3-jxmh-p828, the moderate GHSA-rmxm-3fg6-px4f,
  GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-rxp7-6hxx-x8q5 and GHSA-6pq8-jhm2-2vcw, and the
  low GHSA-333x-w4r6-6crp and GHSA-xhq7-xmqj-769h.

v2.6.0

Fixed

• /cursor-delegate:delegate loads the delegate skill. Claude Code loaded a slash command of the same
  name instead, and that command only pointed back to the skill, so the workflow never reached the
  caller. The command is removed; the skill takes the task as its argument.

Security

• Lockfile bumps of the MCP SDK to 1.32.1 and hono to 4.13.13, clearing the high advisories
  GHSA-22jm-h49p-29qw and GHSA-46jr-4wx8-v453 and the moderate GHSA-6prh-2h8m-c8cw,
  GHSA-rvq5-wwqv-78pq and GHSA-5r4p-p66f-jhc7.

v2.5.2

2.5.1 was tagged but not published: its release run failed the dependency audit. Its fix
ships in this release.

Security

• Lockfile bump of proxy-addr to 2.0.8, clearing the critical audit advisory
  GHSA-jqcg-44mw-7w3h in the MCP SDK's dependencies.

Internal

• The release workflow also retries the MCP Registry publish on registry 5xx responses.
  2.5.0 reached npm but not the MCP Registry after a 504.

v2.5.0

Changed

• Zod 4. The minimum supported @modelcontextprotocol/sdk is now 1.23.0, the first
  release that accepts Zod 4 schemas; 1.22.x requires Zod 3.

Security

• Lockfile bumps of fast-uri to 3.1.8 and ip-address to 10.7.3, clearing the two
  moderate audit advisories in the MCP SDK's dependencies.

Internal

• Lockfile bumps of @modelcontextprotocol/sdk to 1.31.0 and the dev dependency
  @types/node to 26.6.4.
• The release workflow retries the MCP Registry publish while npm is still processing
  the new version, instead of failing the run. npm serves a new version a minute or two
  after accepting it, and the registry validates against npm.

v2.4.0

Added

• effectiveEffort in the delegate result: the current value of each option recognized as
  effort, keyed by option id, as the agent reported it when the prompt went out. It is
  present even when effort is omitted, because the model then runs at the level Cursor
  saved for it, and absent when no reply confirmed a value. Read from replies the bridge
  already receives, so it adds no ACP requests.
• doctor with deep: true reports each currentModelOptions entry's name, ACP
  category and currentValue when the agent sends them as strings. The id and values
  alone could not show that grok-4.7's reasoning_effort is its effort setting, or which
  level Cursor had saved for it.

Fixed

• effort reaches a model that advertises it under an unfamiliar id. An option the agent
  marks with ACP's thought_level category counts as effort whatever its id or name, and
  the fallback for agents that send no category also knows reasoning_effort and names
  containing "effort". grok-4.7 declares reasoning_effort ("Effort"), which was missed, so
  effort: "high" failed with invalid-effort claiming the model had no effort setting.
• invalid-effort no longer says Accepted: none when no option is recognized as effort.
  Missing an option is not proof the model has none, so the error lists the options the
  model advertised, with their names, categories and values.

Security

• Lockfile bump of hono to 4.13.7, clearing a moderate audit advisory.

Internal

• Lockfile bumps of @modelcontextprotocol/sdk to 1.30.1 and the dev dependency
  @types/node to 26.6.3.

v2.3.0

Fixed

• JSON that is not an object is ignored on the ACP stream. null threw in the frame
  reader — an uncaught exception that took down the server — and arrays or primitives
  counted as activity, holding the idle guard open the way a launcher banner used to.
• Malformed tool content blocks are dropped and reported once in protocolWarnings.
  A null block, a block with no string type, or a diff whose path is missing or
  not a string threw in the update handler or recorded a non-path in touchedFiles.
• cursor/update_todos sent as a JSON-RPC notification is merged and not answered. A
  reply to a notification is invalid JSON-RPC and aborted the turn.
• An image contextFile that cannot be read is skipped with a warning. A permission
  error or a locked file used to fail the whole delegation after the other attachments
  were already accepted.
• The Codex plugin interface drops supportURL. Codex's validator rejects unknown
  keys, so a listing that kept that field would not validate.

Changed

• README usage copy names the Cursor Models pool and links Cursor's usage-limits help
  instead of calling the allowance generous enough that most people never hit it.

Internal

• The production npm audit CI step retries three times with a five-minute timeout, so
  a registry blip no longer fails the whole test workflow.

v2.2.1

Changed

• README client snippets that shared a config shape now point at one example.
• Skill defaults table dropped duplicated field notes; security wording tightened.

v2.2.0

Added

• Registry and protocol icons: server.json icons[] and the MCP initialize payload
  advertise the light and dark logos as HTTPS URLs (SEP-973). Codex interface.logoDark.

Changed

• README client list checked against vendor docs (3 Sep 2026): OpenCode and Google
  Antigravity added; Kiro, Kilo Code, and Zed no longer share one portable snippet;
  Visual Studio covers 2022 17.14+ and 2026. npm description/keywords and
  llms-install.md match that list; OpenCode, Kilo Code, and Zed are called out
  as not using mcpServers.

v2.1.1

2.1.0 was tagged but did not publish (audit + Windows CI). This release is that work plus the two CI blockers.

Fixed

• cancel with force: true can be retried after a kill that did not observe an exit. stop() no longer memoizes that false, which had made every later force a no-op.
• Force-kill unregisters only the handles it actually stopped, so a resume that registers during teardown stays cancellable instead of running untracked.
• Todo cancelled is kept and counted in todoProgress.cancelled instead of being stripped.
• contextFiles aliases (Win32 case, realpath) are sent once.
• doctor reports agent.error when --version exits non-zero, probes .mjs/.cjs launchers with Node, quotes the resolved command, and includes launcher/timeout env knobs.
• Transitive fast-uri and qs advisories that failed npm audit --audit-level=high.
• Stderr capture slices an oversized first pipe read so retained memory stays one cap.

Changed

• Permission notes in TECHNICAL.md match the router: no allow option → cancelled, never the first offered reject.