v0.4.1: mcp-ts-core 0.12.3 adoption and expanded test coverage

mcp-ts-core 0.12.3 adoption and expanded test coverage

• Adopt framework error factories and whole-exchange catalog fetch timeouts
• Add smoke, contract-integration, fuzz, and coverage test lanes
• Fix Bun 1.4 audit classification and preserve typed response-body Timeout errors; sync protocol metadata, container tooling, MCPB config, framework skills, and repository guidance
• deps: @cyanheads/mcp-ts-core ^0.11.0 → ^0.12.3 (+ dev-dep bumps)

CHANGELOG v0.4.1

v0.4.0: Breaking tool rename, input bounds, self-description fallback

Breaking tool rename, input bounds, self-description fallback

• Breaking: cyanheads_search → cyanheads_search_catalog, cyanheads_describe → cyanheads_describe_entry, no compatibility aliases (#10)
• cyanheads_search_catalog.query capped at 500 chars, cyanheads_describe_entry.name at 64 (#9)
• cyanheads_describe_entry now resolves cyanheads-mcp-server itself via a local fallback record, superseded automatically if the remote catalog ever adds it (#7)
• docs/design.md reconciled with current output schema, error contract, and ICatalogService shape (#11)
• internal: CatalogService accessor moved to service-instance.ts to break an import cycle

CHANGELOG v0.4.0

v0.3.4: config bounds fix, mcp-ts-core ^0.11.0 adoption

config bounds fix, mcp-ts-core ^0.11.0 adoption

• Enforce documented bounds on catalog and similarity env vars — SIMILARITY_FLOOR, CATALOG_FETCH_TIMEOUT_MS, CATALOG_REFRESH_SECONDS, CATALOG_URL, EMBEDDING_MODEL_ID (#8)
• Adopt @cyanheads/mcp-ts-core ^0.11.0 with a bunfig.toml supply-chain install guard (minimumReleaseAge) and Socket security scanner
• New devcheck checks: floating dependency specifiers (latest/*/dist-tags) and plugin-manifest identity/install-arg validation
• Strip native @duckdb/node-bindings entries from built .mcpb bundles
• Add Claude Code / Codex plugin marketplace manifests, .gitattributes, SECURITY.md, FUNDING.yml; canonicalize package.json author
• deps: @cyanheads/mcp-ts-core ^0.10.6 → ^0.11.0, typescript ^6.0.3 → ^7.0.2 (+ dev-dep bumps)

CHANGELOG v0.3.4

v0.3.3: Adopt mcp-ts-core ^0.10.6

Adopt mcp-ts-core ^0.10.6

Maintenance release tracking the framework jump to 0.10.6 — server identity, container health, and bundle hygiene.

Added:

• Server name/title identity pair (cyanheads-mcp-server) on every surface (#231)
• Dockerfile HEALTHCHECK (bun-native fetch on /healthz) + APP_VERSION -> image.version label (#217)
• scripts/clean-mcpb.ts post-pack bundle cleaner, wired into bundle (#230)
• lint-packaging checks 8-9: post-bundle content + identity guards (#230, #231)
• coerce-boolean-env-flag antipattern rule (#201)
• techniques skill (#204)

Changed:

• cyanheads_describe ambiguous_kind code InvalidParams -> ValidationError
• Build scripts tsx -> bun run; tsx dropped from devDependencies (#205)
• .mcpbignore dev-dir patterns root-anchored (#207)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 -> ^0.10.6
• @types/node ^25.9.1 -> ^25.9.3

177 tests pass; bun run devcheck clean.

v0.3.2: Tool list in cyanheads_describe server branch

Tool list in cyanheads_describe server branch

cyanheads_describe now returns a tools array on the server branch — each entry
carries name and description — so an agent learns a server's full tool surface
from a single call without a second lookup.

Added:

• cyanheads_describe server branch returns tools array (name + description per tool, from serverEntry.tools) (#6)
• format() renders ## Tools section after Description block

177 tests pass; bun run devcheck clean.

v0.3.1: Adopt mcp-ts-core 0.9.21 — per-request context, secret-stripping, fail-fast retry

Adopt mcp-ts-core 0.9.21 — per-request context, secret-stripping, fail-fast retry

Adopts @cyanheads/mcp-ts-core ^0.9.21. Notable framework changes since 0.9.16:

Changed:

• HTTP transport per-request log context — per-request logs and traces now carry fresh requestId + traceId/spanId instead of the frozen boot context.
• fetchWithTimeout strips query-string secrets (e.g. ?api_key=…) from error messages and logs before surfacing them.
• withRetry fails fast on non-retryable errors; ctx.fail auto-populates the retryable flag.
• scripts/devcheck.ts extended with skill-version and packaging checks from updated framework template.
• scripts/release-github.ts and scripts/check-skill-versions.ts added (new framework scripts).
• Skills (8 updated + api-mirror + orchestrations added) synced to 0.9.21 surface.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.16 → ^0.9.21
• vitest ^4.1.7 → ^4.1.8
• tsx ^4.22.3 → ^4.22.4

177 tests pass; bun run devcheck clean.

v0.3.0: local (stdio) install snippets + remote (HTTP) grouping in cyanheads_describe

local (stdio) install snippets + remote (HTTP) grouping in cyanheads_describe

cyanheads_describe now returns local (stdio) install snippets via npx -y for every published server, grouped separately from remote (HTTP) snippets. Each snippet carries a transport field for typed filtering.

Added:

• Local (stdio) install snippets for every published server: claude-code, codex, cursor, gemini, generic Claude Desktop / Cline configs
• InstallSnippet.transport field (stdio | http) for typed filtering without string inspection
• CatalogRecord.requiredEnvVars optional field — env vars scaffolded as empty-valued keys in local JSON configs

Changed:

• cyanheads_describe groups snippets into 'Local install (stdio)' and 'Remote install (HTTP)' sections
• CatalogRecord.endpoint is now optional (forward-compatible with local-only servers)
• curl probe emitted only when endpoint is present

Dependency bumps:

• tsx ^4.22.3 -> ^4.22.4
• vitest ^4.1.7 -> ^4.1.8

177 tests pass; bun run devcheck clean.

v0.2.0: servers roll-up + structured-empty on zero matches

servers roll-up + structured-empty on zero matches

cyanheads_search gains a server-level summary alongside tool results, and returns a structured empty on zero matches instead of throwing.

Added:

• cyanheads_search scope tools now includes a servers roll-up: distinct servers across the full match set, each with matchedTools and topScore, ordered by score, capped at 10. serversTotal surfaces the true count when the cap fires. (#4)

Changed:

• cyanheads_search zero-match path returns { results: [], scope } with enrichment populated instead of throwing no_results. The no_results error reason is removed from the tool contract. (#3)

Fixed:

• .mcpbignore directory excludes anchored to repo root — unanchored names were recursively matching inside node_modules/, stripping @opentelemetry/api/build/src/ from the .mcpb bundle (bundled server crashed on load). (#2)

62 tests pass; bun run devcheck clean.

v0.1.9: cyanheads_search enrichment adoption

cyanheads_search enrichment adoption

Query echo, true result total, and empty-result guidance now surface in a typed enrichment block reaching both structuredContent and content[].

Changed:

• cyanheads_search enrichment: query echo (effectiveQuery), total (totalCount), and contextual notice on empty results in both channels
• structuredContent keys: totalMatched → totalCount, query → effectiveQuery (values and semantics unchanged)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.11 → ^0.9.16

57 tests pass; bun run devcheck clean.

v0.1.8: Await embedding warm-up at setup

Await embedding warm-up at setup

Fixes the 0.1.7 regression where 'void embedQuery(warmup)' yielded to the microtask queue and lost a race with @opentelemetry/instrumentation-http installing its fetch wrap. The wrapped fetch can't complete the cold-cache HF Hub download — every fresh container failed its first cyanheads_search with 'Unable to get model file path or buffer'.

Fixed

• CatalogService.initialize() now awaits the warm-up embedQuery('warmup', …), keeping pipeline() inside the pre-OTEL setup window where the model fetch succeeds.

Changed

• Server startup blocks on model warm-up — same profile as 0.1.5 (~2 s warm-disk / ~15 s cold-disk, ~710 MB resident before transport listens).

The 0.1.6 lazy-no-evict design is sound in isolation but conflicts with the current mcp-ts-core OTEL setup order. A framework-level fix (delay HTTP instrumentation, or scope it to the MCP endpoint) would unlock lazy-load; tracked separately.

57 tests pass; bun run devcheck clean.