Skip to content

0.9.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Sep 21:18
· 4 commits to main since this release
v0.9.2
ac0fa34

Clearer errors about Cloud ALM scopes, stricter tool input, a CORS fix for the local endpoint, and current dependencies including zod 4.

Breaking for deployments

  • CALM_CORS_ORIGINS no longer accepts a wildcard. *, alone or in a list, and any entry that is not scheme://host[:port] stop calmcp at startup with a message naming the fix. List each browser-based client instead, e.g. CALM_CORS_ORIGINS=http://localhost:6274 for the MCP Inspector. On the local unauthenticated endpoint a wildcard let any website call calmcp through the developer's browser and read Cloud ALM data (#23, code scanning alert #1). Deployments that leave the variable empty, the default, are not affected.
  • Unknown tool parameters are rejected. A parameter outside a tool's schema, such as projectId instead of project_id, now fails the call and is named in the error (Unrecognized key: "projectId") instead of being silently dropped. Every tool schema again advertises additionalProperties: false (#22).

Errors

  • A FORBIDDEN error names the scope the Cloud ALM API service instance is missing, e.g. calm-api.tasks.read, or the write scope for calm_create. For projects and analytics it also mentions calm-api.projects.private.read and calm-api.projects.protected.read (#3).
  • A RATE_LIMITED error without a Retry-After states Cloud ALM's limit of 500 requests per 5 seconds (#4).
  • The Tasks, Defects, Requirements and Features analytics providers note which *.personal.read scope their personal-data field needs, and Tasks notes the scopes for private and protected projects (#3).

Documentation

  • The README has a new "Cloud ALM API scopes" section: which scope each part of calmcp needs, and the private-project and personal-data scopes that are easy to leave out (#3).

Dependencies

  • zod 3 → 4, MCP SDK 1.30, pino 10, dotenv 18, helmet and express-rate-limit updates (#12, #18, #20, #22).
  • Development: TypeScript 7, Vitest 5, Biome 2.5 (#13, #15, #21).
  • calm_create keeps accepting any 8-4-4-4-12 id: zod 4's stricter UUID check is not applied (#22).

Internal

  • Every pull request gets a comment showing what changes in the tool surface: instructions, descriptions and schemas as a model sees them, with sizes (#5, #22).
  • CI adds the e2e tests, a type-check of the tests, mbt validate and an xs-security.json check, a Docker build with a /health check, and dependency review. CodeQL scans every pull request (#6, #7).
  • Dependabot opens weekly updates: minor and patch grouped, majors one per package, Vitest packages together (#6, #11, #17). GitHub Actions are on v7 (#8).
Assets 3
Loading