v0.4.2: output caps and error recovery hints

output caps and error recovery hints

Result-shaping caps for high-cardinality VEP and homology output, plus recovery hints on every declared error.

Added:

• ensembl_predict_variant: max_transcript_consequences (default 10), max_pubmed_ids_per_variant (default 10), include_all_colocated_pubmed; output gains transcriptConsequencesTotal/pubmedTotal (#15)
• ensembl_get_homology: max_results (default 25); sentinel 0 uncaps either tool (#15)
• ctx.recoveryFor(reason) now spread into all 24 declared ctx.fail call sites across 8 tool/resource files, surfacing data.recovery.hint (#16)

Changed:

• Default output for ensembl_predict_variant/ensembl_get_homology is now capped with a composed omission notice; ensembl_get_homology's totalCount reports the true available count, not the returned page length (#15)

139 tests pass; bun run devcheck clean.

CHANGELOG v0.4.2

v0.4.1: get-sequence expand/region fixes, mcp-ts-core 0.10.14

get-sequence expand/region fixes, mcp-ts-core 0.10.14

ensembl_get_sequence stable-ID lookups now forward expansion params,
and region mode accepts a bare chr:start-end id. Framework maintenance
adds a Bun supply-chain guard and Dockerfile hardening.

Added:

• ensembl_get_sequence accepts id as a bare chr:start-end region when
  species is set, alongside the existing species:chr:start-end form.
  A bare region without species throws the new missing_species
  ValidationError. (#14)

Fixed:

• ensembl_get_sequence stable-ID genomic lookups now forward
  expand_5prime/expand_3prime to Ensembl, gated to type=genomic. (#13)

Changed:

• bunfig.toml supply-chain guard: install.minimumReleaseAge (3 days,
  @cyanheads/mcp-ts-core excluded) and
  install.security.scanner = "@socketsecurity/bun-security-scanner"
• Dockerfile pins oven/bun:1.3.14, adds BuildKit cache mounts to both
  install stages, and runs the build-stage install with
  --ignore-scripts
• .github/SECURITY.md and .gitattributes added; LICENSE copyright
  year 2025 -> 2026
• 12 skills re-synced to the framework ^0.10.14 set

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.10 -> ^0.10.14
• tsc-alias ^1.8.17 -> ^1.9.0
• vitest ^4.1.9 -> ^4.1.10
• @socketsecurity/bun-security-scanner ^1.1.2 added

118 tests pass; bun run devcheck clean.

CHANGELOG v0.4.1

v0.4.0: rsID variant input, exon parent context, and workflow docs

rsID variant input, exon parent context, and workflow docs

Adds dbSNP rsID input to variant prediction and parent-transcript context to exon queries; corrects chromosome-name and gene-dossier prompt documentation.

Added

• ensembl_predict_variant accepts dbSNP rsIDs (e.g. rs334), routed to a new VEP GET /vep/{species}/id/{id} endpoint. (#11)
• ensembl_query_region exon features carry parentId and rank, explaining why the same exon ID can appear on multiple rows — once per parent transcript. (#9)

Changed

• Chromosome-name guidance in ensembl_query_region and ensembl_predict_variant no longer claims chr-prefixed names are unsupported; Ensembl normalizes them and accepts either form. (#10)

Fixed

• ensembl_gene_dossier prompt's variant workflow now attributes functional impact to VEP, not ensembl_query_region. (#7)

108 tests pass; bun run devcheck clean.

v0.3.0: species division resource, homology queryId, mcp-ts-core 0.10.10

species division resource, homology queryId, mcp-ts-core 0.10.10

New division-addressable resource, a homology bug fix, and a security patch clearing 7 transitive vulnerabilities.

Added

• ensembl://species/{division} resource — division-addressable counterpart to ensembl://species, templated by division. (#8)

Changed

• ensembl_get_homology symbol-mode queryId now returns the resolved Ensembl stable gene ID instead of the echoed symbol. (#6)
• ensembl://species drops its unreachable division filter param — always returns the endpoint default division; use ensembl://species/{division} for a named division. (#8)
• ensembl_list_species description corrected to state the endpoint default division, not "all divisions". (#12)
• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10

Security

• bun audit: 7 vulnerabilities → 0 — js-yaml quadratic-complexity DoS (GHSA-h67p-54hq-rp68), 5 hono advisories on the SDK's now-collapsed nested resolution (CORS wildcard-with-credentials, high; 4 moderate Lambda/serve-static advisories), and a dev-only esbuild Windows advisory cleared by dropping esbuild from the tree.

99 tests pass; bun run devcheck clean.

v0.2.0: get_sequence length field + exactly-one input contracts

get_sequence length field + exactly-one input contracts

Two breaking changes to the tool surface; consumers must update on upgrade.

Breaking

• ensembl_get_sequence output field lengthInBp renamed to length — every caller received this field.
• ensembl_get_homology and ensembl_lookup_gene now reject a call providing more than one of symbol/id/ids/symbols; previously one input silently won.

Changed

• ensembl_get_sequence format() labels length by molecule type (residues for protein, bp for genomic/cdna/cds) instead of bp/aa. (#4)
• Conflicting inputs now fail with a conflicting_input ValidationError on both tools. (#5)
• symbol/species descriptions corrected: species defaults to homo_sapiens for symbol lookups rather than being required. (#5)

94 tests pass; bun run devcheck clean.

v0.1.5: mcp-ts-core ^0.10.9 maintenance adoption

mcp-ts-core ^0.10.9 maintenance adoption

Framework upkeep — picks up the 0.10.7–0.10.9 devcheck/skill changes: fresh-scaffold and worktree-deletion guards, the new dependency-specifier gate, plugin-manifest packaging checks, and the ctx.content collector skill reference.

Added:

• check-dependency-specifiers devcheck step — rejects floating specifiers (latest/*/dist-tags) in package.json + bun.lock workspaces (#246)
• Plugin-manifest packaging checks in lint-packaging, gated by devcheck.config.json packaging.pluginManifests (#240)

Changed:

• Fresh-scaffold / worktree-deletion guards in devcheck, build-changelog, check-skill-versions, check-framework-antipatterns (#242, #243, #237)
• .codex-plugin/plugin.json interface.longDescription populated
• 14 skills re-synced to the ^0.10.9 set (#238, #239)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

91 tests pass; bun run devcheck clean.

v0.1.4: mcp-ts-core ^0.10.6 adoption, MCPB bundle hardening

mcp-ts-core ^0.10.6 adoption, MCPB bundle hardening

Framework maintenance release. Adopts mcp-ts-core ^0.10.6, sets explicit
name/title identity, and hardens the .mcpb bundle against shipping
dependency agent docs.

Changed:

• createApp() declares name and title as 'ensembl-mcp-server'.
• no_input contract on ensembl_lookup_gene and ensembl_get_homology moved
  from InvalidParams to ValidationError.
• bundle script runs scripts/clean-mcpb.ts to prune dev deps and strip
  node_modules agent docs (skills/, .claude/, .agents/, SKILL.md).
• lint-packaging adds bundle-content, critical-runtime-path, and
  name/title/display_name identity guards.
• check-framework-antipatterns flags z.coerce.boolean() env flags and
  skips comment-line matches.
• Dockerfile adds a Bun-native /healthz HEALTHCHECK and APP_VERSION OCI label.
• Vendored skills synced to the ^0.10.6 skill set.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @types/node ^25.9.2 → ^25.9.3

91 tests pass; bun run devcheck clean.

v0.1.3: ensembl_query_region: invalid region contract + empty-result notice

ensembl_query_region: invalid region contract + empty-result notice

Two fixes to ensembl_query_region error handling and guidance text.

Fixed:

• Ensembl's "No slice found for location" error now raises the invalid_region contract (code -32007, ValidationError) instead of falling through as a generic NotFound with null reason. (#1)
• Empty-result notice expanded to include chr-prefix convention ("13", not "chr13") and a pointer to ensembl_lookup_gene for coordinate lookup. Notice text surfaces in both structuredContent and content[]. (#2)

91 tests pass; bun run devcheck clean.

v0.1.2: Public hosted endpoint

Public hosted endpoint

Public Streamable HTTP instance at https://ensembl.caseyjhand.com/mcp.

Added:

• server.json remotes array with streamable-http endpoint
• README centered hosted-server link block and Public Hosted Instance install snippet

Changed:

• @types/node ^25.9.1 → ^25.9.2 (dev dep)
• @cyanheads/mcp-ts-core held at ^0.9.21; added to devcheck.config.json allowlist

bun run devcheck clean; bun run rebuild succeeded.

v0.1.1: Initial public release — 7 tools, 3 resources, 1 prompt over Ensembl REST API

Initial public release — 7 tools, 3 resources, 1 prompt over Ensembl REST API

First public release of @cyanheads/ensembl-mcp-server. Keyless MCP server over the Ensembl REST API for genomics workflows — species discovery, gene lookup, sequence retrieval, genomic region overlap, variant consequence prediction, cross-species homology, and external database cross-references.

Added:

• ensembl_list_species — species catalog with assembly, taxon ID, division
• ensembl_lookup_gene — resolve gene by symbol or Ensembl stable ID
• ensembl_get_sequence — fetch genomic/cDNA/CDS/protein sequence; dotted scaffold names supported
• ensembl_query_region — overlap features (genes, transcripts, exons, variants, regulatory) within a genomic window
• ensembl_predict_variant — VEP consequence prediction for HGVS or region/allele notation
• ensembl_get_homology — orthologs and paralogs across species via Ensembl Compara
• ensembl_get_xrefs — external DB cross-references (UniProt, RefSeq, OMIM, GO, ...)
• ensembl://gene/{id}, ensembl://transcript/{id}, ensembl://species resources
• ensembl_gene_dossier prompt — comprehensive gene report workflow

Security:

• Strip internal request URL from serviceUnavailable error data

89 tests pass; bun run devcheck clean.