Chumbo 0.10.0
·
62 commits
to 85bb97817c8364d511295d61845faafc8d0a1529
since this release
Chumbo 0.10.0 adds explicit application-run correlation for multi-tool work.
- Mint signed, expiring run handles scoped to one installation, MCP surface, and authorized partition.
- Carry a handle through controlled MCP request metadata or an explicit field on selected tools.
- Recover the same bounded run fact inside capability handlers and lifecycle v2 events.
- Reject malformed, expired, cross-scope, unknown-key, and conflicting handles before capability code executes.
- Preserve existing behavior for unconfigured servers, including lifecycle v1.
Run correlation is optional. It does not authorize access, execute background work, or infer workflows from MCP sessions, credentials, connections, IP addresses, or timing. Supabase Auth, scopes, grants, RLS, and application checks remain authoritative.
Install with:
npm install chumbo@0.10.0