Chumbo 0.11.0

Chumbo 0.11.0 adds bounded collection response contracts for agent-friendly lists.

• Adds collectionResult, collectionInputSchema, collectionOutputSchema, and collectionLimits.
• Enforces configurable item and byte limits with stable cursor pagination and actionable continuation metadata.
• Lets builders expose explicit sort options while keeping ordering and cursor semantics application-owned.
• Updates the bundled skill, generated guidance, documentation search, living reference, and examples to demonstrate compact list/detail/receipt contracts.
• Preserves structured and hybrid MCP result modes for typed clients and deliberate renderers.

Validation includes the full package and living-reference suites, packed Node/TypeScript/Deno consumers, generated-project smoke tests, and pagination boundary challenges.

Chumbo 0.10.3

Adds safe result composition and a complete local Supabase MCP proof loop. Builders can append or prepend bounded model-facing guidance without corrupting structured results, apply optional fail-open result middleware, and use chumbo dev plus chumbo doctor to initialize, discover, and explicitly call a real local Edge Function capability before deployment. Local URLs honor the project’s configured Supabase API port.

Chumbo 0.10.2

Adds an optional builder-owned onSurface hook that emits a bounded, canonical, redacted proof after a complete successful tools/list response. The proof captures the effective tool surface without caller identity, scopes, credentials, traffic, or arbitrary protocol metadata, and adds no work when unconfigured.

Chumbo 0.10.1

A smaller first-tool experience for Supabase builders. New projects now start with one immediately runnable identity capability and an explicit application replacement seam, while the wider MCP showcase remains available as executable reference material. This release also refreshes the public README and clarifies API-key data authority. Runtime APIs and authentication behavior are unchanged.

Chumbo 0.10.0

Chumbo 0.10.0 adds explicit application-run correlation for multi-tool work.

• Mint signed, expiring run handles scoped to one installation, MCP surface, and authorized partition.
• Carry a handle through controlled MCP request metadata or an explicit field on selected tools.
• Recover the same bounded run fact inside capability handlers and lifecycle v2 events.
• Reject malformed, expired, cross-scope, unknown-key, and conflicting handles before capability code executes.
• Preserve existing behavior for unconfigured servers, including lifecycle v1.

Run correlation is optional. It does not authorize access, execute background work, or infer workflows from MCP sessions, credentials, connections, IP addresses, or timing. Supabase Auth, scopes, grants, RLS, and application checks remain authoritative.

Install with:

npm install chumbo@0.10.0

Chumbo 0.9.0

Chumbo 0.9.0 adds an optional builder-owned lifecycle-event sink for invoked tools, Resources, and prompts.

• Receive versioned start and terminal events with redacted request, caller, server, and capability metadata.
• Distinguish success, tool-declared error, input-required, and thrown-failure outcomes with terminal duration.
• Preserve request isolation and keep MCP calls fail-open when an event sink throws or rejects.

Chumbo 0.8.1

A cosmetic package release that completes the Chumbo repository transition.\n\n- Publishes canonical elsheppo/chumbo repository, homepage, and issue links in npm metadata.\n- Carries the merged Chumbo documentation, roadmap, and living-reference cleanup.\n- Preserves the existing runtime behavior and compatibility aliases.\n- Leaves the deployed living reference pinned to its verified 0.8.0 receipt.\n\nThere are no runtime behavior changes in this patch.

Chumbo 0.8.0

Chumbo is now the canonical package and CLI name for the MCP layer for Supabase apps.\n\n- Renames the npm package and primary CLI command to chumbo.\n- Generates new projects against chumbo and uses Chumbo-branded runtime diagnostics.\n- Retains the supa-mcp CLI alias and established technical identifiers where compatibility requires them.\n\nThe npm artifact was published on August 26, 2026. This release attaches the verified source tag to that existing artifact; the release workflow confirms the published version without republishing it.

supa-mcp 0.7.0

SupaMCP 0.7.0 adds opt-in durable coordination state for authenticated MCP capabilities while preserving the stateless default.

Highlights:

• allowlisted, credential-partitioned state with deployment-keyed HMAC identity
• bounded get, revision-checked put, and revision-checked delete
• private service-role-only Postgres storage and bounded expiry reclamation
• optional separate Supabase project for state storage
• --state-namespace generator support
• executable observation-before-action reference with atomic resource CAS
• corrected package declaration/runtime output across Node, strict TypeScript, and Deno

The release deliberately does not introduce a resident actor/Durable Object runtime, queues, alarms, leases, or make state part of the ordinary starter path.

Release candidate provenance:

• commit: 6657abf133f468f5ff38c1d55bec11ddf9120ea2
• tarball SHA-256: f65127a8352cfc14db64627873c2842f026096e0c3aa2af2dda3d35d8ce1b1e9
• npm integrity: sha512-GWw76MPFVJxeyzsti2wx7ZkOEQPtKCeMceKyPtS/PcjCdGnrFYpm5E8N7wUQ0jwovnbc8d98JMcnBr0kQ7s61Q==

Full changes: https://github.com/elsheppo/supa-mcp/blob/v0.7.0/CHANGELOG.md

supa-mcp v0.6.6

Compatibility fix for mixed-generation Supabase Edge environments. Empty modern key dictionaries now fall through to configured singular or legacy keys, with an assembled OAuth regression for that exact runtime shape.