v0.2.1

@backblaze-labs/b2-mcp v0.2.1

Added

• glama.json repo-root maintainer manifest for the Glama org server claim,
  plus a README Glama score badge. (#300)
• lhm.plugin.json LobeHub marketplace manifest and a README LobeHub badge;
  the release version lifecycle now stamps its version alongside server.json.
  (#300)
• mcpb/manifest.json (MCPB 0.3) plus a pnpm run build:mcpb pack script for
  the Claude Desktop extension bundle; the release version-sync now stamps the
  MCPB manifest alongside server.json and lhm.plugin.json. (#300)
• Reproducible b2-mcp.mcpb desktop-extension bundle built and attached to every
  GitHub Release: publish.yml runs build:mcpb, records the bundle SHA-256 in
  SHA256SUMS, and the release job verifies it; a contract test gates manifest
  version parity, the pinned npx launcher, privacy_policies, and archive
  reproducibility across OSes. This is the artifact the Claude Connectors
  Directory submission (#385) consumes. (#387)
• Flat, visible ## Tools list of all 40 tools in the README so directory
  auto-extractors (mcp.so, Glama, ...) can populate the tool section. (#300)
• docs/references/discoverability.md runbook documenting the registry/directory listings
  and per-release steps (Glama, LobeHub, mcp.so). (#300)
• Privacy policy surface: root PRIVACY.md, hosted GitHub Pages
  privacy.html / privacy/, README and discoverability links, and MCPB
  privacy_policies metadata for Claude and OpenAI directory submissions.
  (#379)
• README "official server" note and an Official … MCP Registry manifest
  description to distinguish backblaze-labs/b2-mcp from community forks. (#301)
• Read-only MCP resources for non-secret server config, credential
  capability/tool profile, and a capability-gated b2://bucket/{bucketName}
  template with notification webhook secrets redacted. The server now advertises
  the MCP resources capability. (#165)
• Opt-in MCP workflow prompts (prompts/list / prompts/get), gated behind
  B2_ENABLE_MCP_PROMPTS=true. Prompts return structured message templates only
  and never execute B2 tools, so the destructive gate and elicitation remain
  authoritative; availability is derived from the committed tool registry and
  resolved capability set. (#362)

Changed

• Deferred Smithery from the discoverability roadmap: removed the README Smithery
  badge and reframed docs/references/discoverability.md so the MCPB bundle now
  targets the Claude Connectors Directory / GitHub Release. smithery.yaml is
  retained (and kept in sync by the release-scripts contract) for a possible
  future submission if a hosted Backblaze MCP endpoint ever exists. (#300)
• BREAKING: Renamed four tools to the standard <prefix>_<verb>_<noun>
  naming convention for server coherence; the old names are removed with no
  aliases, so existing integrations must switch to the new names. Old → new:
  b2_usage_growth → b2_report_usage_growth,
  b2_egress_leaders → b2_rank_egress_leaders,
  b2_largest_files → b2_list_largest_files,
  s3_presign_upload_part → s3_get_presigned_upload_part_url. The naming
  convention is now documented in docs/design-docs/tool-contract.md and
  referenced from AGENTS.md. (#365)
• The stdio and HTTP transports now support credential-free discovery for
  directory scanners and MCP inspectors: initialize / server/discover /
  tools/list can run without B2 credentials, placeholder header credentials
  that B2 rejects still enumerate tools for scanner compatibility, and every
  tools/call in discovery mode returns missing_credentials. Discovery
  responses use a zero cache TTL, and rejected server-owned/principal credentials
  still surface as credential errors instead of a silent no-op fleet. (#356,
  #363)

Fixed

• Point the README MCP Registry badge at $.servers[0].server.version to match
  the registry API's 2025-12-11 response shape, so it renders the published
  version again. (#297)

Removed

• Breaking: dropped the deprecated credential env-var and HTTP header
  aliases; only the canonical names are read anywhere now. (#386)
  • B2_APP_KEY_ID / B2_APP_KEY (and the X-B2-App-Key-Id / X-B2-App-Key
    plus namespaced X-B2-MCP-App-Key-Id / X-B2-MCP-App-Key headers) are gone
    → use a non-master B2_APPLICATION_KEY_ID / B2_APPLICATION_KEY. This
    retires the legacy "sign S3 with a separate non-master key" override; the
    application key now signs S3 directly, so callers on the old path must switch
    to a non-master application key.
  • The principal-mode B2_CREDENTIAL_<REF>_APP_KEY / B2_CREDENTIAL_<REF>_APP_KEY_ID
    override is gone → use B2_CREDENTIAL_<REF>_APPLICATION_KEY /
    B2_CREDENTIAL_<REF>_APPLICATION_KEY_ID.
  • The customer-hosted _FILE secret-file variants of all the above
    (B2_APP_KEY_FILE, B2_APP_KEY_ID_FILE, and
    B2_CREDENTIAL_<REF>_APP_KEY(_ID)_FILE) are no longer loaded by the
    container entrypoint → use the matching B2_APPLICATION_KEY(_ID)_FILE /
    B2_CREDENTIAL_<REF>_APPLICATION_KEY(_ID)_FILE names.
  • B2_OAUTH_INTROSPECTION_CACHE_MAX_ENTRIES / _TTL_SECONDS / _SKEW_SECONDS
    are gone → use B2_OAUTH_TOKEN_CACHE_MAX_ENTRIES / _TTL_SECONDS /
    _SKEW_SECONDS.
  • The short X-B2-* credential headers (X-B2-Key-Id, X-B2-Key,
    X-B2-Master-Key-Id, X-B2-Master-Key) are gone → use the canonical
    X-B2-MCP-* form (X-B2-MCP-Key-Id, X-B2-MCP-Key,
    X-B2-MCP-Master-Key-Id, X-B2-MCP-Master-Key).
  • Rollout: migrate clients to X-B2-MCP-* before deploying. During a
    rolling deploy, old replicas still accept the short headers while new
    replicas reject them, so legacy-header requests can intermittently fail for
    the duration of the rollout. On startup the server now logs a warn-level
    config.removed_alias message when a removed alias env var
    (B2_APP_KEY_ID / B2_APP_KEY, the principal-mode
    B2_CREDENTIAL_<REF>_APP_KEY(_ID), their _FILE secret-file variants, and
    B2_OAUTH_INTROSPECTION_CACHE_*) is still set, naming the canonical
    replacement. Log-redaction sets still scrub the
    retired header/env names for the migration window so a still-in-flight
    legacy secret is never written to logs in cleartext.

v0.2.0

What's Changed

• evals: add harness foundation by @goanpeca in #263
• evals: add Anthropic Haiku 4.5 driver by @goanpeca in #265
• evals: add OpenAI provider comparison by @goanpeca in #266
• evals: cover full tool profile by @goanpeca in #267
• evals: gated CI workflow and pass-rate artifact by @goanpeca in #268
• docs: EVALS.md — running the LLM eval suite by @goanpeca in #269
• build(deps): consolidate Dependabot bumps (Actions + non-AWS npm) by @goanpeca in #282
• test(oauth): cover token-validation failure branches by @goanpeca in #286
• test(security): cover secret redaction branches by @goanpeca in #292
• test(b2/client): cover native edge branches by @goanpeca in #290
• test(http-server): cover failure and shutdown paths by @goanpeca in #289
• test(auth,retry): cover token lifecycle and retry/backoff branches by @goanpeca in #288
• test(s3/objects): cover object edge branches by @goanpeca in #287
• test(index): cover CLI dispatch and fatal errors by @goanpeca in #295
• test(coverage): ratchet coverage thresholds by @goanpeca in #296
• docs: add TypeDoc tooling by @goanpeca in #310
• docs: add Deploy API Docs workflow by @goanpeca in #311
• build(deps): consolidate Dependabot bumps (Actions + non-AWS npm) by @goanpeca in #330
• docs: document public API modules by @goanpeca in #331
• docs: add tsdoc lint script by @goanpeca in #333
• docs: enforce strict TypeDoc validation by @goanpeca in #335
• Fix/issue 315 316 317 error classification by @ffumero2003 in #334
• Publish b2-mcp to the MCP Registry by @goanpeca in #336
• Improve GitHub repo SEO metadata by @goanpeca in #337
• fix: bound stdio capability bootstrap by @goanpeca in #339
• Fix empty egress report snapshot response by @goanpeca in #338
• fix: attribute destructive confirm source by @goanpeca in #342
• Fix native write timeout classification by @goanpeca in #341
• build: raise Node floor to 22.22.2, bump eslint-plugin-jsdoc to 64.2.1 by @goanpeca in #346
• fix: close QA F12-F20 detection gaps by @goanpeca in #345
• ci: fail evals when Anthropic secret is missing by @goanpeca in #347
• build(deps): bump aws-sdk to 3.1119.0 and @smithy/types to 4.17.2 by @goanpeca in #349
• evals: exercise Streamable HTTP transport by @goanpeca in #348
• Fix GHCR package pull command by @goanpeca in #351
• docs: add API-docs Pages badge and fill 0.2.0 changelog by @goanpeca in #352
• test: deterministically freeze time in rate-limiter burst drain by @goanpeca in #354
• Upgrade b2-sdk 0.4 Partner shapes by @goanpeca in #353

New Contributors

• @ffumero2003 made their first contribution in #334

Full Changelog: v0.1.2...v0.2.0

v0.1.2

@backblaze-labs/b2-mcp v0.1.2

Changed

• Renamed the outbound User-Agent product token from backblaze-b2-mcp to
  b2-mcp (b2-mcp/<version> on a published release, b2-mcp/dev otherwise)
  across every SDK that talks to the B2 API. Operators must sequence this
  with the analytics side: expand any Backblaze-side dashboards, alerts, and
  token-keyed rate-limiting to accept BOTH backblaze-b2-mcp and b2-mcp
  before rolling the fleet, then retire the old token only after every pod has
  cycled onto b2-mcp. During a rolling deploy both tokens are emitted
  simultaneously, so a dashboard keyed solely on the old token would otherwise
  decay toward zero and page as a false partial outage. (#236)

Fixed

• s3_put_bucket_lifecycle now clears the bucket's S3 lifecycle configuration
  when passed an empty rules array, routing the clear through the destructive
  gate and AWS DeleteBucketLifecycle. (#214)
• Scope b2_list_buckets to authorized bucket IDs for bucket-scoped keys when
  no bucketId/bucketName filter is supplied, and reject out-of-scope explicit
  bucket filters before calling B2 (fixes #211).
• Resolve b2_largest_files and b2_unfinished_uploads through the authorized
  bucket scope instead of an unfiltered listBuckets(), so bucket-scoped keys
  no longer receive HTTP 401; out-of-scope input is reported clearly without
  enumerating the key's bucket namespace. (#212)
• Return a stable 400 bad_request instead of HTTP 500 when s3_get_presigned_url
  PutObject (or inline s3_put_object) is called without a valid signed
  contentType. (#213)
• Validate and document the reserved bucketInfo key and corsRuleName naming
  constraints so invalid inputs are rejected with a clear message. (#215)
• Align the server-issued skills instructions with the shipped skills pack so
  clients are pointed at the tools that are actually available. (#205)
• Classify destructive confirmation/policy refusals as stable non-500 tool
  outcomes: destructive_confirmation_required and
  destructive_confirmation_refused as HTTP 409, and
  destructive_policy_blocked as HTTP 403, with tool.call audit logs
  recording those codes/statuses instead of internal_error/500.
• S3-compatible and report tools now derive their endpoint/signing region from
  the authorized b2_authorize_account s3ApiUrl; B2_REGION is only a
  fallback/default for pre-authorization paths or temporary authorize failures.
• Aligned the package engines.node range with the supported Node.js 22.3+,
  24, and 26 lines so it matches the runtime policy and opossum 10 support,
  with drift guards for workflow and deployment documentation claims.
• Publish npm releases from a staged package directory so registry metadata does
  not retain the release runner's local tarball path, with a bounded
  post-publish verification retry and legacy rerun allowance for immutable
  0.1.0 and 0.1.1 metadata.

v0.1.1

@backblaze-labs/b2-mcp v0.1.1

Changed

• Verify the automated OIDC-based npm publish workflow with a patch release; no runtime code changes.

Fixed

• Live B2 contract CI now sets B2_REGION so the S3-compatible live suites
  target the correct account region instead of the default S3 endpoint.
• Pinned a contentType on the live PutObject presigned-URL assertion to match
  the server's required signed-content-type policy.
• The Vitest layer runner always emits the default reporter so live-layer test
  failures are visible in CI logs.
• Run the event-notification write-shape contract in CI against a
  pre-provisioned, notifications-enabled bucket (B2_LIVE_NOTIFICATION_BUCKET)
  instead of an ephemeral one.
• Exercise the Partner API read paths in CI against a Partner-entitled account
  via a master key (B2_MASTER_KEY_ID/B2_MASTER_KEY).

v0.1.0

@backblaze-labs/b2-mcp v0.1.0

Added

• Added docs/AUTHENTICATION.md plus public-claim drift coverage for OAuth
  resource-server behavior, B2 credential custody, CLI/env references, package
  naming, and support-policy claims.
• Added a bundled Phase 1 B2 skills pack with manifest-backed package-surface
  validation for backup/restore, least-privilege keys, Object Lock,
  lifecycle/cost hygiene, migration, and incident response playbooks.
• Added B2_OAUTH_JWKS_URI local JWT access-token verification (using the
  jose library for JWK import and JWS signature verification) against cached
  JWKS with bounded refresh, made B2_OAUTH_INTROSPECTION_ENDPOINT optional
  for JWKS-only deployments, and added JWT/JWKS cache, timeout, retry, and
  clock-skew settings.
• Added the hosted deployment matrix, shared deployment security contract,
  provider guides, troubleshooting checklist, and an experimental Cloudflare
  Worker adapter with a Wrangler runtime smoke gate.
• Added an OAuth-secured Vercel adapter for the shared HTTP MCP pipeline,
  including protected-resource metadata, server-mode hosted deployment
  configuration, and headers / server / principal smoke credential modes.
• Added a digest-pinned production Docker image, container CI smoke coverage,
  signed multi-platform GHCR release publishing, and Docker run docs for HTTP
  and stdio transports.
• Added the supported customer-hosted container reference deployment to the
  published npm package with bounded logs, pinned runtime/proxy images, and
  package/build-context secret exclusion policy.
• Added POSIX B2_LOG_FILE support for redacted structured JSON file logging,
  with owner-only file handling and SIGHUP reopen support for external rotation.
• Added B2_SECRET_SINK=file for durable-secret-producing tools, defaulting to
  an owner-only local JSONL ledger on stdio while HTTP/serverless remains
  fail-closed unless an explicit sink path is configured.
• Added issue #64 release verification for the unified CLI, published package
  docs, changelog release-note extraction, checksums, idempotent trusted npm
  publishing, and GitHub Release creation from the verified tarball.
• Added deterministic test-layer scripts, JUnit/Vitest summaries, coverage
  summaries, packed-package install coverage, and the pnpm run verify
  no-credential quality gate.
• Added live-safe test reporting: live layers keep JSON summaries but avoid
  third-party JUnit reporters while B2 credentials are present.
• Added the official B2 SDK adoption contract, architecture record, and
  drift guard for the 40-tool SDK parity matrix.
• Added an exact @backblaze-labs/b2-sdk@0.2.0 production dependency pin for
  the reviewed SDK migration boundary.
• Added CODEOWNERS, version/build-pinned conda environment metadata, release process
  documentation, and public contract skeleton documents for Phase 1 ownership.
• Added policy coverage for live workflow secret gates and the Streamable HTTP
  smoke helper contract.
• Added explicit environment, per-request header, server-managed, and
  verified-principal B2 credential providers.
• Added central recursive MCP response sanitization for secret-bearing field
  names, labeled tokens, configured B2 credentials, and audit/error paths.
• Added opt-in token-efficient TOON tool-result text for structured successes
  via a repo-owned encoder for spec 4.1, while using compact JSON as the
  unset/default mode (B2_MCP_OUTPUT_FORMAT=json for explicit config).
• Added a checked-in runtime dependency and package-footprint budget with CI
  enforcement and PR/release summary artifacts.
• Added the frozen Phase 1 MCP tool-profile contract artifact, generated
  profile reference, and deterministic modern/legacy tools/list fixtures.
• Added an advisory pnpm run smoke:client external MCP SDK client smoke for
  local stdio negotiation and contract-surface evidence without live B2 calls.
• Added a locked pnpm run smoke:inspector MCP Inspector CLI smoke that runs
  with fake credentials from an isolated environment.

Changed

• Adopted tag-driven release publishing for issue #187: pnpm version now
  promotes the changelog before git push --follow-tags starts the protected
  publish workflow from trusted ci-green resolver code, while keeping the
  existing SBOM, live-contract, package-budget, GHCR, manual publish guard, and
  ci-green gates.
• Bumped @backblaze-labs/b2-sdk to exact-pinned 0.3.0 and moved
  Partner/Groups read/eject/list tooling onto the SDK /partner operations;
  durable-secret create/reserve tools now run when the reviewed secret sink is
  active and remain unavailable stubs when B2_SECRET_SINK=off.
• Restored the transport-independent b2_create_key lockdown: key-management
  grants and unscoped write/delete keys are refused by default, optional
  B2_MAX_KEY_DURATION_SECONDS caps lifetime, and HTTP inline secret responses
  require the dedicated B2_ALLOW_INLINE_SECRETS=true opt-in.
• Defaulted JWT/JWKS verification to RS256; operators can still opt into
  other supported algorithms with B2_OAUTH_ALLOWED_ALGORITHMS.
• Documented the exported OAuth config TypeScript surface change: token-cache
  fields now use tokenCache* names and OAuthResourceServerConfig models
  verifier-specific introspection or JWKS modes. The legacy
  B2_OAUTH_INTROSPECTION_CACHE_* environment variables remain accepted.
• Moved all s3_* data-plane object, presigned URL, multipart, bucket, and
  lifecycle paths onto the AWS S3 SDK configured for B2's S3-compatible
  endpoint, while native b2_* control-plane tools remain on the B2 SDK.
• Require non-browser-executable contentType values for s3_put_object and
  presigned PutObject URLs so upload URLs cannot be minted without a signed
  content-type constraint.
• Added /ready alongside /health for HTTP deployments and gated readiness
  metadata behind the same Host/Origin checks used for MCP traffic.
• Replaced the ts-node dev runner with exact-pinned tsx@4.23.11 and
  explicitly denied esbuild install builds in pnpm-workspace.yaml.
• Split unit, contract, modern protocol, legacy protocol, slow, package, and
  live test files by stable suffix so pnpm test works from a clean checkout
  without relying on dist/.
• Migrated deterministic test layers from Jest to Vitest projects and extended
  coverage to every non-live layer.
• Restored pnpm test typechecking, made package-install
  verification use the pnpm cache offline, and kept it off the ci-green
  deploy-gating path.
• Canonicalized repository, package, workflow, security, and setup metadata for
  backblaze-labs/b2-mcp.
• Aligned package metadata on the 0.1.0 Phase 1 release line.
• Aligned the enforced runtime policy with the official B2 SDK floor:
  engines.node is >=22.3.0, CI verifies production dependencies and the full
  toolchain on Node.js 22.23.1, 24, and 26, local and live 22.x jobs use a
  patched Node 22 LTS release, the packed-package smoke runs on the Node.js
  22.3.0 engine floor, and workflow drift is checked from runtime-policy.json.
• Kept coverage, slow lifecycle, package install, runtime floor, package budget,
  and supply-chain checks as independent required CI gates, with CODEOWNER
  review required for protected files.
• Migrated linting and Biome-supported formatting from ESLint and Prettier to
  Biome while keeping the existing package script names used by CI and
  pnpm run verify; Markdown and YAML files are no longer part of the automated
  format gate.
• Exact-pinned the runtime-sensitive opossum dependency and changed the packed
  consumer smoke gate to exercise a fresh lockfile-less npm install path.
• Migrated HTTP and stdio serving to the MCP TypeScript SDK v2 modern entry
  points for MCP 2026-07-28.
• Removed the unused @aws-sdk/s3-presigned-post dependency because S3 POST
  Object form uploads are not in the Phase 1 MCP contract.
• Made b2-mcp the canonical CLI binary while preserving b2-mcp-server as a
  transition alias.
• Switched the smoke helper to Streamable HTTP /mcp and the generated Phase 1
  tool-profile contract.
• Tightened the smoke helper to require an expected frozen tool profile by
  default and compare normalized tool-contract hashes, with an explicit
  any-profile opt-in for exploratory local runs.
• Read-only credentials no longer expose or allow PutObject on
  s3_get_presigned_url; upload presigned URLs now require the same
  confirmation policy as destructive write paths.
• Reworked live B2 contract workflows to use explicit test:live:b2-*
  commands, protected manual/main/scheduled/release triggers, ci-green
  validation for reusable release calls, test-owned mcp-contract-* resources,
  serialized Node.js 22.23.1/24/26 coverage, best-effort cleanup, and a
  scheduled janitor instead of customer bucket fixtures.
• Hardened live smoke and cleanup by correlating smoke with successful
  deployment SHAs, adding bounded MCP retries/timeouts, requiring a live
  test-account allowlist before janitor deletion, and clearing Object Lock
  protections before bypass-governance version cleanup.
• Made release publishing attach the SBOM only after npm publish succeeds and
  removed whole-suite retries from live B2 contract publication evidence.
• Replaced b2_create_key, b2_create_group_member, and
  b2_reserve_trial_create_account with unavailable compatibility stubs until a
  reviewed out-of-band secret sink exists.
• Structured successful tool results now keep canonical sanitized JSON in
  structuredContent while emitting only one selected text serialization in
  content; the default text JSON changed from 2-space pretty-printed JSON to
  compact JSON, and errors and concise status strings remain plain text.
• HTTP readiness now rejects unsupported B2_MCP_OUTPUT_FORMAT values and TOON
  preflight failures in every credential mode before serving traffic.
• Centralized the remaining AWS S3 peer i...