v0.1.50

Published as @automattic/mcp-remote@0.1.50.

Changes

Fix hourly browser re-auth against rotating refresh-token servers (#6): silent token renewal always fell back to a browser re-authorization against servers that issue single-use refresh tokens, such as WordPress.com's oauth2-1. Three independent causes, each fixed here.

• OAuth errors were unparseable under a proxy. With --socks-proxy / --enable-proxy we replaced global.fetch with npm undici's fetch, but the SDK checks responses with instanceof Response against the built-in class. Every OAuth error — invalid_grant included — parsed as garbage and was silently swallowed before falling through to a browser flow. Headers, Request and Response are now aliased together with fetch.
• Concurrent refreshes inside one process raced each other. The MCP SDK lets concurrent sends enter authorization independently, all sharing one provider, so two flows would read the same single-use refresh token and one would lose a race with no other process involved. The provider now supplies the fetch the transports use, which the SDK threads into its token request; refresh grants queue behind each other, each is retargeted at whatever token is current on disk, and the rotated pair is persisted before the queue is released.
• Concurrent processes deleted each other's credentials. Where several mcp-remote processes share one tokens.json, the first refresh wins the rotation and the rest fail with invalid_grant; the SDK then deleted the winner's fresh tokens and opened a browser, orphaning a live grant. Those tokens are now kept when the pair on disk was rotated by another party, and the SDK's own retry picks them up.

Also in this release: config files are written atomically (temp file plus rename), since a torn read of tokens.json surfaced as "no tokens saved" and made the rotation guard delete live credentials in exactly the window it exists to protect; an invalid_grant that escapes the SDK's single auth retry reconnects once rather than failing the connection; a failed forward answers the client with a JSON-RPC error instead of leaving the request hanging until its own timeout; and debugLog resolves function-valued arguments only after checking DEBUG, so hot-path callers stop paying for stack captures and JSON.stringify that get discarded.

Known limitations

Refreshes are still not serialized across processes, and the remaining gaps follow from that: the rotation guard's read and delete are not atomic, and recovery is bounded at roughly four attempts before the connection fails rather than degrading to a re-authorization. Both are documented at invalidateTokens in src/lib/node-oauth-client-provider.ts. Closing them is a single change — a lock around read, refresh, write and conditional delete — which would retire the rotation guard, the reconnect and the duplicate-save bookkeeping together.

Install: npx @automattic/mcp-remote@0.1.50 https://remote.mcp.server/sse

v0.1.49

Published as @automattic/mcp-remote@0.1.49.

Changes

• Dependency security updates (#5): in-range pnpm update clearing 52 pnpm audit findings (1 critical, 15 high, 29 moderate, 7 low). Runtime: undici ^7.24.0 → ^7.29.0 (fixes 12 advisories including SOCKS5 TLS-validation bypass GHSA-vmh5-mc38-953g and cross-origin proxy-pool routing GHSA-hm92-r4w5-c3mj, both directly relevant to this proxy's SOCKS support), socks → ^2.8.9 (patched ip-address 10.3.1, SSRF via octal octet confusion), express → ^4.22.2 (patched body-parser). Dev: vitest → 3.2.7 in both the root and E2E projects (fixes critical UI-server arbitrary file read/exec GHSA-5xrq-8626-4rwp), @modelcontextprotocol/sdk → ^1.30.0 (patched hono, fast-uri, ip-address, qs). One low-severity dev-only esbuild advisory remains, pinned by tsup. Lockfiles regenerated against registry.npmjs.org with integrity-only resolutions.

No functional changes — the published dist only picks up the patched undici/socks/express versions via raised dependency floors.

Install: npx @automattic/mcp-remote@0.1.49 https://remote.mcp.server/sse

v0.1.48

Published as @automattic/mcp-remote@0.1.48.

Changes

• --instructions-file flag (#2): load markdown/text from a local file and append it to the upstream server's InitializeResult.instructions, letting operators surface server-level guidance to MCP clients (e.g. Claude Code session context) without requiring an upstream change. If the upstream response already has instructions, the file is appended after a blank line; otherwise the file contents are used as-is. The path is resolved against cwd and read once at startup; a missing/unreadable path or missing flag value exits with an error.
• Fix id-0 correlation in the proxy (#2): the message transformer used if (!messageId), which treated JSON-RPC id 0 as absent. MCP SDK clients increment request ids from 0, so the very first request — typically initialize — bypassed correlation entirely, silently skipping both instructions injection and tools/list filtering. Replaced with explicit undefined/null checks and added regression tests for numeric id 0.

Spec reference: InitializeResult.instructions is a standard, optional field in the MCP 2025-06-18 lifecycle schema.

Install: npx @automattic/mcp-remote@0.1.48 https://remote.mcp.server/sse

v0.1.47

First release published under the @automattic scope on npm: @automattic/mcp-remote@0.1.47.

This is a maintained fork of the unmaintained geelen/mcp-remote (via anandnalya/mcp-remote). The package name and repository now point at Automattic, and the README documents the fork lineage. Original attribution is preserved in the package contributors and the MIT LICENSE.

Install: npx @automattic/mcp-remote https://remote.mcp.server/sse