v0.8.0: Maintenance status indicator, SSRF hardening, DNS output fixes

Maintenance status indicator, SSRF hardening, DNS output fixes

• Maintenance status indicator carried end to end through devops_status_check, devops_watch_stack, and devops_suggest_action (#44)
• IPv6 SSRF guard matches by prefix length instead of string prefix, closing real bypasses (#38)
• devops_check_dns elides per-resolver records that agree with the domain-level set (#41)
• devops_get_incidents guides an empty filter: "all" to the vendor's status page (#43)
• degraded-component output is uncapped and grouped by status (#39)
• README backend-list correction (gcp is a native adapter, not out of the registry)

CHANGELOG v0.8.0

v0.7.0: Google Cloud status adapter

Google Cloud status adapter

• Google Cloud joins the vendor registry as a native status adapter — devops_status_check, devops_get_incidents, and devops_watch_stack now cover Google Cloud Service Health alongside AWS Health, GitLab/Neon, Slack, and Redis Cloud (#37)
• backendHistory() gains a gcp case: no incident ceiling, full resolved history (resolution read from end), no scheduled-maintenance feed
• Registry, docs, and tool/resource descriptions updated for the 51-vendor count

CHANGELOG v0.7.0

v0.6.0: DNS outcome typing and TLS hostname/chain validation

DNS outcome typing and TLS hostname/chain validation

• devops_check_dns: NXDOMAIN, SERVFAIL, and a missing record type are now distinguishable per resolver via a typed status, instead of collapsing to "no records found" (#31)
• devops_check_dns: geo-steered/anycast domains are no longer flagged as a propagation mismatch — resolver disagreements are now split into partial_resolution (flagged) and value_variation (recorded, not flagged) (#35)
• devops_check_certs: hostname mismatch and chain-trust failures (self-signed, untrusted root) now surface as critical instead of reporting ok (#26)
• devops_check_certs: chain_depth is now number | null instead of a confident 1 for chains the runtime cannot traverse (#27)

CHANGELOG v0.6.0

v0.5.7: incident paging, upstream ceiling disclosure, and notice enrichment

incident paging, upstream ceiling disclosure, and notice enrichment

• devops_get_incidents gains nextOffset and upstreamCeiling enrichment fields, and empty-result guidance that reflects the filter/offset/backend that produced it instead of one static suggestion (#24, #25, #34)
• devops_status_check and devops_watch_stack declare the notice field for their already-composed capped-component guidance (#24)
• backendHistory() states each vendor backend's incident ceiling, resolved-history reach, and maintenance-window support

CHANGELOG v0.5.7

v0.5.6: resilient vendor batches, capped detailed output

resilient vendor batches, capped detailed output

• devops_status_check / devops_watch_stack no longer discard the whole batch when one vendor is unresolvable or SSRF-blocked; an all-failed batch still throws, naming every failing entry in one message (#33)
• devops_watch_stack persists only the resolvable subset of a stack, reporting the rest via omitted_vendors (#33)
• devops_status_check's summary gained an unavailable bucket so operational + degraded + down + unavailable = total always holds (#23)
• Detailed-mode component lists bounded by component_limit (default 50, max 500) and narrowable with component_filter, disclosed via a new truncated/shown/cap/totalCount enrichment block (#36)

CHANGELOG v0.5.6

v0.5.5: SSRF guard hardening, statuspage_unavailable reachability

SSRF guard hardening, statuspage_unavailable reachability

• SSRF guard now blocks 0.0.0.0/8, the bare IPv6 unspecified address (::), and ip:port resolver forms that previously bypassed the private-target check (#29)
• Redirects are re-validated against the SSRF guard on every hop instead of being followed unchecked, capped at 5 hops (#30)
• Vendor fetch failures now map onto the declared statuspage_unavailable contract instead of surfacing raw JavaScript errors; devops_status_check's unreachable contract entry removed, Statuspage responses gain runtime shape validation (#32)
• mcp-ts-core 0.11.0 adoption: bundle strips native bindings too, packaging/devcheck tooling and skill docs synced
• deps: @cyanheads/mcp-ts-core ^0.10.14 → ^0.11.0

CHANGELOG v0.5.5

v0.5.4: Uncapped incident history paging + empty-state guidance

Uncapped incident history paging + empty-state guidance

FireHydrant-backed vendors (Redis Cloud) no longer cap at 50 incidents; empty listings now guide the next step.

Changed:

• Empty results in devops_get_incidents and devops_list_vendors explain the result and name a broader filter or category to try (#17)

Fixed:

• devops_get_incidents returns the full incident history behind a new offset input — the FireHydrant adapter no longer slices to the 50 newest, and a truncated page discloses the true totalCount and next offset (#22)

229 tests pass; bun run devcheck clean.

CHANGELOG v0.5.4

v0.5.3: structured probe-tool errors for bad domains and blocked resolvers

structured probe-tool errors for bad domains and blocked resolvers

devops_check_certs and devops_check_dns now surface their declared error contracts instead of raw Zod / unstructured failures.

Fixed:

• devops_check_certs — protocol-prefixed domains now return the declared invalid_domain error with its recovery hint; schema relaxed .regex(...) → .min(1) so the PROTOCOL_RE guard fires (#18)
• devops_check_dns — private/loopback resolver IPs now return the declared target_blocked error, translating the SSRF_BLOCKED throw like devops_status_check (#19)

Dependency bumps:

• @biomejs/biome ^2.5.2 → ^2.5.3
• @types/node ^26.1.0 → ^26.1.1

226 tests pass; bun run devcheck clean.

CHANGELOG v0.5.3

v0.5.2: incident-context tailoring + display-name vendor resolution

incident-context tailoring + display-name vendor resolution

devops_suggest_action now tailors its playbook to the incident context and resolves a vendor by display name as well as slug.

Added:

• Incident-context tailoring — affected_components / incident_summary prepend a targeted subsystem section (CI/CD, DNS, replication/failover, login/sessions) ahead of the generic playbook and add a detailed devops_status_check re-check (#21)

Fixed:

• Vendor resolution accepts a display name ("Amazon Web Services"), not just a slug, so vendor_category and the pre-filled follow-up args stay valid; an ambiguous bare word stays unresolved (#20)
• incident_snippet carries the full incident_summary instead of clipping it to 200 characters (#21)

224 tests pass; bun run devcheck clean.

CHANGELOG v0.5.2

v0.5.1: watch_stack health & persistence fixes, mcp-ts-core 0.10.14 adoption

watch_stack health & persistence fixes, mcp-ts-core 0.10.14 adoption

Bug fixes for devops_watch_stack plus routine framework maintenance.

Fixed:

• Errored vendors never roll up as all_operational — new unknown health state and summary.unavailable count so the buckets partition the stack (#15)
• Stack list persisted only after target resolution + SSRF validation — a failed call no longer poisons a saved stack (#16)

Changed:

• Supply-chain install guard: bunfig minimumReleaseAge (3-day quarantine) + Socket install scanner
• Added .github/SECURITY.md and .gitattributes; packageManager + Dockerfile base pinned bun@1.3.14

Dependencies:

• @cyanheads/mcp-ts-core ^0.10.10 → ^0.10.14
• @socketsecurity/bun-security-scanner ^1.1.2 (added)
• tsc-alias ^1.8.17 → ^1.9.0
• vitest ^4.1.9 → ^4.1.10

212 tests pass; bun run devcheck clean.

CHANGELOG v0.5.1