Release v0.1.12 — external-data fetch tool · cejor6/kalshi-mcp-server

Adds a narrowly-scoped external-data fetch tool for research-agent consumers, plus MCP-conformance linting and dependency updates.

Highlights

feat: new kalshi_fetch_external_data tool — a read-only, GET-only, https-only, exact-host-allowlisted fetch of a handful of public data feeds (Polymarket gamma/clob, NWS api.weather.gov, Open-Meteo incl. ensemble, Tennis Abstract, Deribit public). No credentials attached (trust_env=False), redirects not followed, body size- and wall-clock-capped, and returned wrapped in UNTRUSTED-EXTERNAL-DATA delimiters. It exists because consumers whose own egress is restricted (e.g. claude.ai cloud routines) can't reach these public feeds directly; the allowlist is the load-bearing control and additions are a code change. Forks that don't want the surface can delete the module + its registration line (#59).
ci: lint the MCP setup with mcpconform (0.2.0 flags), dropping the old shell guard + suppressions (#43, #44).
docs(tools): document tool params and fit the safety-tool description under OpenAI's 1024-char limit (#42).
fix(live): document the intentional TimeoutError swallow flagged by CodeQL (#41).
deps: routine dependency and GitHub Actions bumps (cryptography, starlette, python-multipart, pydantic-settings, and pinned action SHAs).

pipx install kalshi-mcp-server

Multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.12 (and :latest).

Full changelog: v0.1.11...v0.1.12