Skip to content

v0.1.9: mcp-ts-core ^0.9.9 → ^0.9.13: HTTP hardening, quieter logs, GET /mcp keywords

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 29 May 05:02
v0.1.9
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
e053949
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

mcp-ts-core ^0.9.9 → ^0.9.13: HTTP hardening, quieter logs, GET /mcp keywords

Adopts four framework releases covering HTTP transport hardening and
polish. Server-level source changes: MCPB placeholder fix for optional
email config and explicit public-catalog landing page opt-in.

Added:

  • MCP_HTTP_MAX_BODY_BYTES — 413 body cap (default 1 MiB) before SDK parsing
  • GET /mcp now surfaces package.json keywords in the status JSON
  • .claude-plugin/ and .codex-plugin/ — plugin metadata for Claude Code and Codex discovery

Changed:

  • HTTP session-init gate: non-initialize requests without Mcp-Session-Id rejected with 400
  • 4xx log level: expected client errors (400, 401, 403, 404) logged at warning, no stack traces
  • CROSSREF_MAILTO config: z.preprocess strips MCPB ${user_config.X} placeholders to undefined; manifest.json gains "default": ""
  • landing.requireAuth: false — explicit opt-in to serve full tool inventory unauthenticated

Dependency bumps:

  • @cyanheads/mcp-ts-core ^0.9.9 → ^0.9.13
  • @biomejs/biome ^2.4.15 → ^2.4.16

27 tests pass; bun run devcheck clean.

Assets 3
Loading