Skip to content

v2.1.0

Choose a tag to compare

View all tags
@sylvesterdamgaard sylvesterdamgaard released this 13 Apr 15:02
v2.1.0
e02c06a

Highlights

Fieldtype process() pipeline — Data saved via MCP now matches the Statamic CP format. All content routers call $fields->process()->values() after validation, ensuring Terms strip prefixes, Bard normalizes nodes, and Relationships wrap values correctly.

ENG-697 fix — Entry updates with terms field type no longer crash. Relationship fields (terms, entries, users, assets) and checkboxes normalize bare strings to arrays before validation.

Security hardening — OAuth auth code/refresh token double-spend prevented, client_name XSS sanitized, HTTPS enforced on OAuth endpoints, default scopes restricted to read-only.

See CHANGELOG.md for full details.

Upgrading

No breaking changes. composer update cboxdk/statamic-mcp is sufficient.

OAuth default scopes changed from * to read-only. If your OAuth clients need write access, set STATAMIC_MCP_OAUTH_DEFAULT_SCOPES in your .env:

STATAMIC_MCP_OAUTH_DEFAULT_SCOPES="content:read,content:write,blueprints:read,entries:read,entries:write"

Existing tokens are not affected — only new OAuth clients created after upgrade will use the new defaults.

Assets 2
Loading