2.0.5

Reissued the MCP Description validator integration from 2.0.3 & 2.0.4 as a fix-forward release after that version failed during npm publication, switched the npm publish workflow from the obsolete NPM_TOKEN path to npm Trusted Publishing with GitHub Actions OIDC.

Updated to @mcpdesc/validator 0.13.0 and adopted its maintained default
selector for MCP Description 0.8.0 validation. Explicit immutable selector
pins remain only where exact-contract operations require them.

MCP Description 0.8.0 validation now accepts documents without $schema,
while continuing to reject unknown schema identities and unsupported format
versions.

Legacy MCP contract dumps now preserve unknown and custom JSON Schema
keywords, including x-mcp-header, without treating their inactive modern
MCP semantics as invalid. MCP-specific x-mcp-header validation still
applies to protocol version 2026-07-28.

Security fixes: dependabot critical, high and moderate

2.0.2

• FIXED: The dump wizard now launches the generated command without a shell, removing
  Node.js [DEP0190] warnings and preserving user-supplied arguments without
  shell interpretation.

2.0.1

v2 stable release with security patch

CLI

• Updated to @mcpdesc/core 0.11.0 and @mcpdesc/validator 0.12.0; new
  dumps, validation, projection, splitting, and migration now
  target MCP Description 0.8.0 and its canonical schema URI.

• dump now warns about server capabilities that MCP Description cannot
  represent and omits them instead of generating an invalid document.

• Simplified `dump --help` into a concise grouped reference and expanded
  `agents --command dump` as the detailed guide for advanced connection,
  OAuth, CORS, and pagination behavior.

• Dump diagnostics now use consistent [LOG], [WARN], and [VERBOSE]
  prefixes, and servers without prompts no longer emit an SDK debug trace.

• Stateful Streamable HTTP dumps now fall back to the canonical
  `Mcp-Session-Id` header name when raw response-header inspection is
  unavailable, instead of failing after capability extraction.

• Added dual-era MCP negotiation for legacy initialize/session servers and
  stateless MCP 2026-07-28 discovery, with --protocol auto, legacy, and
  2026-07-28 modes across CLI help and shell completions.

• Added --protocol-version selection to diff, compare, and document for
  processing one effective view of a multi-version MCP Description.

• Breaking: dump now emits MCP Description 0.8.0 with its exact
  immutable $schema URI instead of mcpdesc 0.7.0, and no longer generates
  x-cisco-metadata

• split now preserves all protocol-scoped variants of selected tool identities
  and document-wide content without generating split metadata.

• The deprecated convert command now validates and migrates mcpdesc 0.7.0
  documents to MCP Description 0.8.0

• Breaking: the minimum supported Node.js version is now 22.

• Replaced the legacy MCP SDK integration with @modelcontextprotocol/client
  2.0.0

• Adopted @mcpdesc/validator for exact v0.8 validation, and @mcpdesc/core` to 0.4.0 for shared semantic operations.

• Validation now dispatches MCP Description 0.8.0 documents by exact snapshot without falling back to a mutable latest schema; historical 0.7.0 validation remains available.

• split now preserves all protocol-scoped variants of selected tool identities
  and document-wide content without generating split metadata or altering an
  existing extension.

• The deprecated convert command now validates and migrates mcpdesc 0.7.0
  documents to MCP Description 0.8.0

Security

• Updated the transitive development dependency override for js-yaml to
  ^4.3.2, resolving GHSA-2883-xcg3-v3hh / CVE-2026-84375 (unbounded CPU use
  when parsing empty merge sources).

Docs

• Updated MCP Description documentation to direct readers to
  mcpdesc.org and contributors to the canonical
  mcpdesc/mcpdesc-specification
  repository. The bundled v0.7 specification and schemas are now clearly marked
  as historical compatibility material.

2.0.0 RC 3

• Documented MCP Description v0.8 as the current CLI target and established
  v1/main as the maintenance line for v0.7-era output.

• Updated new dumps and v0.7 migrations to MCP Description 0.8.0-rc.3 with
  @mcpdesc/core 0.9.1 and @mcpdesc/validator 0.10.1. RC.2 documents remain
  supported for validation, projection, and splitting.

• dump now warns about server capabilities that MCP Description cannot
  represent and omits them instead of generating an invalid document.

• Updated new dumps to MCP Description 0.8.0-rc.2 with
  @mcpdesc/core 0.8.0 and @mcpdesc/validator 0.9.0. Validation now warns
  when servers advertise extension negotiation before MCP 2026-07-28.

• Simplified `dump --help` into a concise grouped reference and expanded
  `agents --command dump` as the detailed guide for advanced connection,
  OAuth, CORS, and pagination behavior.

• FIX: Dump diagnostics now use consistent [LOG], [WARN], and [VERBOSE]
  prefixes, and servers without prompts no longer emit an SDK debug trace.

• FIX: Stateful Streamable HTTP dumps now fall back to the canonical
  `Mcp-Session-Id` header name when raw response-header inspection is
  unavailable, instead of failing after capability extraction.

• SECURITY: Updated transitive browserslist and fast-uri dependencies to patched
  versions.

What's Changed

• Release v2.0.0-rc.2 by @ObjectIsAdvantag in #46
• Release v2.0.0-rc.3 by @ObjectIsAdvantag in #48

Full Changelog: v2.0.0-rc.1...v2.0.0-rc.3

2.0.0-rc.1

Summary

• add dual-era MCP negotiation for legacy initialize/session servers and stateless MCP 2026-07-28 discovery
• emit and validate MCP Description 0.8.0-rc.1 using exact immutable schema selection
• preserve v0.7 validation and migration while removing generated x-cisco-metadata
• use @mcpdesc/core@0.4.0 for RC.1 protocol projection, declaration selection, and migration
• use @mcpdesc/validator@0.5.0 for exact RC.1 validation
• prepare @cisco_open/mcptoolkit-contract@2.0.0-rc.1 for npm next

Breaking changes

• default dump format advances from mcpdesc 0.7.0 to 0.8.0 RC.1
• minimum Node.js version advances to 22
• release tags must exactly match the reviewed package version

Validation

• npm run prerelease: documentation links, build, 14 suites, 206 tests
• npm run test:manual: passed; external live-server cases skipped when unavailable
• user-verified Everything server dump and validation over MCP 2026-07-28
• isolated tarball installation and RC.1 fixture validation passed with zero errors and warnings
• exact dependencies resolve to @mcpdesc/core@0.4.0 and @mcpdesc/validator@0.5.0

1.2.3

OAuth interoperability release

• OAuth flows are more robust and compatible with strict providers, with fixes for redirect URI consistency, callback URL/port/path handling, and token exchange errors that were blocking real-world IdPs
• the CLI now makes authentication behavior explicit for dump and the interactive wizard, reducing silent fallbacks and making generated commands clearer and more reliable.
• added stronger OAuth configuration support with the explicit callback URL override and better retry/port handling when the default loopback port is busy.
• quality and documentation were improved with security remediation, cleaner docs/examples, and better release workflow support for RC publishing and badge/version consistency

1.1.3

Housekeeping patch. No CLI or schema changes.

1.1.2

Remediated npm audit vulnerabilities to zero.

1.1.1

Documentation-only patch release. No CLI or schema changes.

1.1.0

What's Changed

• feat: add compare command, CI/CD guide, remove changelog.sh (v1.1.0) by @stsfartz in #20
• docs: add mcpdesc badge by @stsfartz in #23
• ci: reduce dependabot noise with grouping, cooldown, monthly cadence by @stsfartz in #16
• core: Adopt oss-scaffold methodology (dogfood, drift-gated) by @stsfartz in #17
• fix: add oss-scaffold.agent.md, update to oss-scaffold 0.2.1 by @stsfartz in #19

Full Changelog: v1.0.0...v1.1.0