Skip to content

v0.1.5: mcp-ts-core ^0.10.6 adoption, dataframe_query catalog deny, container hardening

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 13 Jun 03:49
v0.1.5
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
7b064dc
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

mcp-ts-core ^0.10.6 adoption, dataframe_query catalog deny, container hardening

Framework adoption plus a DataCanvas hardening, Docker healthcheck, and MCPB bundle cleaner.

Security:

  • openmeteo_dataframe_query runs with denySystemCatalogs: true — SQL touching information_schema, sqlite_master, pg_catalog, or duckdb_*() is rejected (new system_catalog_access error) so callers cannot enumerate other staged canvases.

Added:

  • Dockerfile HEALTHCHECK (bun-native fetch on /healthz) + org.opencontainers.image.version label from APP_VERSION.
  • scripts/clean-mcpb.ts — post-pack cleaner strips dependency-shipped agent-doc trees under node_modules/.

Changed:

  • createApp() sets explicit name/title of open-meteo-mcp-server; .codex-plugin displayName aligned.
  • .mcpbignore patterns root-anchored; vendored skills synced to 0.10.6.

Dependency bumps:

  • @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
  • @biomejs/biome ^2.4.16 → ^2.5.0
  • @types/node ^25.9.1 → ^25.9.3
  • typescript ^5.9.3 → ^6.0.3
  • tsc-alias ^1.8.16 → ^1.8.17
  • vitest ^4.1.0 → ^4.1.8

79 tests pass; bun run devcheck clean.

Assets 3
Loading