0.7.0

Breaking changes

This release changes how the MCP server starts in one case. It is described in full under Changed below.

• MCP server over HTTP: on an address other hosts reach, such as 0.0.0.0 in its image, the server no longer starts without MAILBOX_MCP_BEARER_TOKEN and MAILBOX_MCP_ALLOWED_HOSTS or MAILBOX_MCP_ALLOWED_ORIGINS. Set them before you update the image. On 127.0.0.1 and over stdio nothing changes.

The database schema stays the same, no migration runs at the first start.

Added

• MAILBOX_MCP_CATALOGUE=true starts the MCP server without a service
  or a token: it lists every tool and refuses every call but
  server_status. It is meant for directories that read the tool list
  in a sandbox. Beside MAILBOX_SERVICE_TOKEN the server does not
  start. Without the setting nothing changes.
• benethos-mailbox-mcp --list-tools prints every tool of the MCP server
  as a client lists it, as JSON, without a service or a token.

Changed

• Breaking: the MCP server over HTTP on an address other hosts
  reach, such as 0.0.0.0 in its image, no longer starts without
  MAILBOX_MCP_BEARER_TOKEN and MAILBOX_MCP_ALLOWED_HOSTS or
  MAILBOX_MCP_ALLOWED_ORIGINS. Before, it started with a warning and
  admitted anyone who reached the port. On 127.0.0.1 and over stdio
  nothing changes.
• The MCP tools describe every parameter, the ids by the tool that
  answers them. Each tool says when to use it rather than a related
  one, whether it changes anything, and what it answers. What the tools
  do is unchanged.
• The images install fastapi 0.162.2, pypdfium2 5.15.2 and
  publicsuffixlist 1.1.2.20261109 from the lockfile. pypdfium2 brings
  PDFium 8149 and fixes a rare error when its objects are closed while
  the garbage collector runs or the interpreter shuts down.

Fixed

• On Python 3.11 and 3.12 the descriptions of the MCP tools carried the
  indentation of their source code, spaces a client sent to the model
  with every description. They are now the same on every Python version.
• A page of the UI given a return address whose host cannot be read,
  such as next=//[, answered with a plain error 500. It now goes to
  the page's own default, as for any address outside the UI.
• A cursor of a Microsoft account's message list that names a host
  which cannot be read answered with an error 500 outside the error
  envelope. It is now 400 with the code bad_request, as any other
  forged cursor.
• The client raised httpx's own error for an answer it could not read,
  such as a body that is not what its Content-Encoding says. It is now
  an ApiError with the code unexpected_response. The MCP server,
  which asks the service what its token may do while it runs, ended on
  such an answer. It now keeps its tools and asks again.
• The MCP tool get_thread said the bodies together are cut at
  max_chars. Each mail keeps at least 200 characters, so twenty mails
  can bring more. The description now says so. What the tool does is
  unchanged.