v0.7.0

Breaking

• In STATIC mode every client now gets its own McpServer and orchestrator, like DYNAMIC mode. Module loaders run once per client instead of once per process, with each client's merged session context. (#27)
  • Migration: anything you register on the server returned by createMcpServer after it is created (prompts, resources, extra tools) no longer reaches STATIC clients. Register it inside your createServer factory instead, so every per-client server gets it.

Fixed

• STATIC mode supports concurrent clients. Before, a second client's initialize closed the first client's connection, and its next request failed with Session not found or expired. (#27)
• Per-session context (?config=) now reaches module loaders in STATIC mode. (#27)
• Tools defined with a JSON Schema inputSchema load and receive their arguments on MCP SDK 1.28+, which rejects plain JSON Schema objects. (#25)

Changed

• Now depends on @modelcontextprotocol/sdk ^1.32.1 and fastify ^5.12.5. (#25)
• The zod dependency floor is now ^3.25, matching the MCP SDK's peer range. (#26)
• Every tool, meta-tools included, registers through McpServer.registerTool instead of the deprecated server.tool() overloads. annotations.title is also sent as the tool's top-level title. (#26)
• JSON Schema inputs are accepted but not advertised to clients; use Zod shapes to advertise a tool's parameters. (#25, #26)

Security

• Patched vulnerable dependencies: MCP SDK (GHSA-6qxp-vccf-f47h), fastify, and transitive packages (proxy-addr, hono, path-to-regexp, qs, fast-uri, ip-address). Dev tooling moved to vitest 5. (#25)

What's Changed

• fix(deps): patch vulnerable dependencies and keep JSON Schema tools working on MCP SDK 1.31+ by @imbenrabi in #25
• Register all tools with registerTool by @imbenrabi in #26
• fix: give every STATIC-mode client its own server by @imbenrabi in #27
• chore(release): 0.7.0 by @imbenrabi in #28

Full Changelog: v0.6.3...v0.7.0