Repository navigation
The optional MCP HTTP gateway now includes patched URI and query parsers. This updates fast-uri to 3.1.7 and qs to 6.16.0, addressing upstream host-normalization flaws, query parsing denial of service, and array-limit bypasses.
Existing Bash converters and configuration remain compatible. The Node wrapper stays private and is not published separately to npm. Reinstall gateway dependencies with npm ci after upgrading the source checkout.
Validation: the repository checks, unit/smoke and functional suites, coverage gate, and all eight Node gateway tests passed. Four local replay-gain/key-tagging cases were skipped because their optional tools were unavailable. Hardware-dependent coverage exemptions remain documented in the repository.
The attached source archive is built from the signed release tag. Verify it with sha256sum -c SHA256SUMS before extracting.