v0.1.7: mcp-ts-core 0.10.14, Bun supply-chain hardening, find-pokemon + type-matchups fixes

mcp-ts-core 0.10.14, Bun supply-chain hardening, find-pokemon + type-matchups fixes

Added

• Bun supply-chain guards via bunfig.toml: minimumReleaseAge blocks package versions published under 3 days old (@cyanheads/mcp-ts-core excluded, adopted same-day), and @socketsecurity/bun-security-scanner scans every install for malware/typosquats/CVEs
• .github/SECURITY.md and .github/FUNDING.yml

Changed

• pokeapi_find_pokemon's query-only empty-result notice now renders as a blockquote in content[] instead of the generic notice: label (#6)
• pokeapi_get_type_matchups's composedMultipliers description now documents that the map includes net-neutral 1x cancellation entries for dual-type Pokemon (e.g. Charizard vs Ice composes to exactly 1x), not just non-neutral multipliers (#5)
• docs/design.md: corrected two error-contract table entries from InvalidParams to ValidationError, and removed a phantom no_results reason pokeapi_find_pokemon never declared
• Dockerfile: pinned oven/bun to 1.3.14 on both stages, added BuildKit cache mounts, and the build-stage install now runs with --ignore-scripts

Fixed

• pokeapi_find_pokemon accepted negative limit/offset and returned a misleading success; both are now constrained integers, rejected by the SDK's input-schema validation before the handler runs (-32602 InvalidParams) (#7)
• Cleared pre-existing Biome warnings: non-null assertions replaced with explicit guards, a redundant async keyword removed from eleven fetch* methods, bracket-notation switched to dot notation
• scripts/devcheck.ts's outdated-dependency check no longer flags packages held back by the new minimumReleaseAge guard as unexpected

Dependencies

• @cyanheads/mcp-ts-core ^0.10.9 -> ^0.10.14
• typescript ^5.9.3 -> ^6.0.3
• @types/node 26.0.0 -> ^26.0.0 (resolves 26.1.1)
• @socketsecurity/bun-security-scanner (new) ^1.1.2
• @biomejs/biome 2.5.0 -> 2.5.3, tsc-alias 1.8.17 -> 1.9.0, vitest 4.1.9 -> 4.1.10 (lockfile refresh, no package.json range change)

68 tests pass; bun run devcheck clean.

CHANGELOG v0.1.7

v0.1.6: mcp-ts-core ^0.10.9 maintenance

mcp-ts-core ^0.10.9 maintenance

Framework adoption only — no tool or behavior changes.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node 25.9.3 → 26.0.0
• vitest ^4.1.8 → ^4.1.9

Added:

• check-dependency-specifiers devcheck step — rejects floating specifiers (latest/*/dist-tags) in package.json and bun.lock workspaces (cyanheads/mcp-ts-core#246)
• lint:packaging plugin-manifest checks — validates .claude-plugin/.codex-plugin descriptions, unscoped display names, and scoped install args (cyanheads/mcp-ts-core#240)

Changed:

• Re-synced framework scripts (fresh-scaffold + worktree guards) and vendored skills to ^0.10.9 (cyanheads/mcp-ts-core#242, #243, #237, #238)

65 tests pass; bun run devcheck clean.

v0.1.5: mcp-ts-core ^0.10.6 adoption

mcp-ts-core ^0.10.6 adoption

Framework refresh to mcp-ts-core ^0.10.6, with the identity, error-code,
and MCPB bundle-hygiene changes that ride with it.

Added:

• createApp() sets explicit name/title ("pokeapi-mcp-server") so the served server_name carries the machine name, not the scoped npm package name
• scripts/clean-mcpb.ts strips dependency-shipped agent docs from the packed .mcpb; wired into the bundle script
• Dockerfile HEALTHCHECK against /healthz (Bun fetch, no curl) and an OCI version label
• lint:packaging bundle-content + identity guards; check-framework-antipatterns rule flagging z.coerce.boolean() env flags

Changed:

• pokeapi_find_pokemon / pokeapi_get_type_matchups input-guard error contracts now use ValidationError (was InvalidParams)
• .mcpbignore root patterns anchored with a leading / so they don't strip runtime paths under node_modules
• vendored skills re-synced; adds the techniques skill

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @types/node 25.9.2 → 25.9.3
• typescript ^6.0.3 → ^5.9.3 (held to the 5.9 line)

65 tests pass; bun run devcheck clean.

v0.1.4: Three bug fixes: input validation, content[] parity, variant-form species resolution

Three bug fixes: input validation, content[] parity, variant-form species resolution

Fixes three behavioral gaps discovered during field testing.

Fixed:

• pokeapi_get_type_matchups now throws invalid_input when both type and pokemon are supplied, instead of silently ignoring one (#2)
• pokeapi_find_pokemon format() empty-result notice mirrored to content[] with actionable guidance; clients reading only content[] now get the full message (#3)
• PokeApiService.getDossier derives species from pokemon.species.name rather than re-using the caller identifier — variant forms (e.g. pikachu-rock-star) no longer return not_found (#4)

65 tests pass; bun run devcheck clean.

v0.1.3: Public hosted endpoint

Public hosted endpoint

Public instance deployed at https://pokeapi.caseyjhand.com/mcp.

Added:

• server.json declares remotes[{ type: "streamable-http", url: "https://pokeapi.caseyjhand.com/mcp" }] for MCP Registry discovery
• README: centered hosted server link block; Public Hosted Instance subsection under Getting Started with streamable-http client config

Dependency bumps:

• @types/node 25.9.1 → 25.9.2

bun run devcheck clean; bun run rebuild succeeds.

v0.1.2: Self-hosting guidance for POKEAPI_BASE_URL

Self-hosting guidance for POKEAPI_BASE_URL

Documents the self-hosting path per PokéAPI Fair Use Policy — run the official
Docker image locally and point POKEAPI_BASE_URL at it for high-volume or hosted
deployments. The default 6-hour cache covers most workloads.

Added:

• README: new self-hosting section under Configuration (#1)
• .env.example: POKEAPI_BASE_URL comment expanded with Docker link and Fair Use Policy reference (#1)

63 tests pass; bun run devcheck clean.

v0.1.1: Initial public release — 7 tools and 2 resources over PokéAPI v2

Initial public release — 7 tools and 2 resources over PokéAPI v2

First public release of @cyanheads/pokeapi-mcp-server. Provides 7 MCP tools and 2 resources over the keyless PokéAPI v2 (pokeapi.co), covering Pokémon, moves, abilities, items, natures, and type matchups.

Added:

• pokeapi_get_pokemon — full dossier: base stats, types, abilities, held items, moves by version group, evolution chain
• pokeapi_find_pokemon — filtered search by type, generation, stat floor
• pokeapi_get_move — type, damage class, power, accuracy, PP, effect text, TM/HM/TR machines
• pokeapi_get_ability — effect text and Pokémon that carry it
• pokeapi_get_item — category, effect, fling power/effect, sprite URL
• pokeapi_get_nature — stat modifier and berry-flavor affinity; list-all mode without identifier
• pokeapi_get_type_matchups — offensive/defensive effectiveness for single- and dual-type inputs
• pokeapi://pokemon/{identifier} and pokeapi://type/{typeName} URI resources
• PokeApiService — typed fetch layer with in-memory caching, timeout, and retry-on-503

Security:

• normalizeIdentifier applies encodeURIComponent to all path-segment identifiers to prevent path-traversal via crafted inputs

63 tests pass; bun run devcheck clean.