Signal K MCP Operations 1.0.1

Signal K MCP Operations 1.0.1

Fix the Signal K App Store README display: remove the duplicate HTML logo, which its Markdown renderer showed as literal text, and start directly with the example questions. The app icon in the Store header is unchanged.

Clarify version-specific registry audit results and stale cached indicators. On 2026-10-29 the published 1.0.0 registry scan reported zero high/moderate/critical findings and score 85; the old 0.1.0 record carried two high findings and score 75. Refreshing the reference server's App Store metadata replaced the stale warning with Security OK. This patch does not suppress audit results or change dependencies.

Validation

• All 18 tests, clean consumer package/MCP checks, full npm audit and documentation link checks passed.
• Project CI and official Signal K platform CI passed on the tested source. Post-merge workflows passed as well.
• All 12 compiled files, declared runtime dependencies and the app icon are identical to 1.0.0. The packaged README contains no raw HTML image tag.

Tested source: 89e82aebd1f367a84ac0a74e7b82785cda0f09c3, merged through PR #6 as 78ed82ddfb3e1fdcf53973269a9604850117e00f. Both commits have identical source trees.

Artifact SHA-256: c5e9eaa207d9ff80419ba8b138f41bba7433884c10b8788c9a84cbb315b51280.

Install signalk-mcp-ops@1.0.1 from npm or update through the Signal K App Store, then restart Signal K. Existing credentials and plugin settings can be reused. App Store metadata may need a refresh to show the newest README and indicators.

The documented hosting limitations from 1.0.0 remain in effect; see SECURITY.md. This documentation-only patch adds no MCP capabilities or host dependency changes.

Signal K MCP Operations 1.0.0

Signal K MCP Operations 1.0.0

Ask a compatible AI assistant why a reading is missing, whether data is fresh, where a value comes from, and which configured connections report errors. Nine read-only MCP tools expose permitted telemetry, path/source information, plugin inventory and bounded provider diagnostics through the existing Signal K HTTPS connection.

Changes since 0.1.0

• Update MCP SDK to 1.32.2, Zod to 4.6.7, Express to >=4.22.3 within major 4, and refresh compatible locked dependencies.
• Return generic errors from the plugin's JSON parser and derive MCP/OpenAPI versions from package metadata.
• Add production dependency auditing and clean consumer tarball verification.
• Start the README with practical example questions and link focused setup/validation guides.
• Include an original app icon and declare it through Signal K app metadata.
• Document recent server-log access and provide a development-only verification probe that returns no log text. The installed MCP plugin has nine tools and does not expose server logs.

Validation and compatibility

• Node.js 22 or newer; automated platform coverage on Node 22 and 24.
• Explicit Signal K server integration targets 2.31.0 and 2.35.1.
• Live candidate acceptance on Signal K 2.31.0 / Node 22.23.2 / OpenPlotter Raspberry Pi through Codex desktop on Windows: nine tools, missing/invalid/non-admin credentials, MCP-key rejection, Host/Origin restrictions, request-size rejection, restart, disable/re-enable and key rotation.
• The final 1.0.0 tarball was installed on the reference server and all nine tools passed again. Server metadata confirmed 1.0.0, telemetry was fresh and denied-path handling remained enforced with the saved credentials.
• The final 1.0.0 artifact's 12 compiled files and declared runtime dependencies match the live-tested candidate. Its package version, icon, nine read-only schemas, telemetry exchange and denied-path handling were verified through a clean consumer installation without install scripts.
• Exact source commit, artifact hash and final CI links are recorded in the attached VALIDATION.md. The final artifact is built from commit 288896ee0396e5b84019433ff49d7b040b246858, merged through PR #5; the merge has an identical source tree.

Authentication and hosting limits

Clients must support Streamable HTTP MCP with both a Signal K admin bearer token and X-MCP-Ops-Key. Keep Signal K security enabled and use HTTPS for remote access. Configure exact allowed hosts/origins and the paths the assistant may read. OAuth discovery and write/control operations are outside this release.

On the tested Signal K 2.31.0 host, malformed JSON can fail before the plugin route and receive a stack trace from Signal K's own error middleware. Both host development and production configurations install that middleware; changing NODE_ENV alone is not a verified fix. This remains a documented hosting limitation reviewed for the 1.0 release. The plugin does not patch the host error handler. See SECURITY.md and docs/LIVE-ACCEPTANCE.md in the package for details.

Installation

From the Signal K configuration directory, install signalk-mcp-ops@1.0.0 with lifecycle scripts disabled and restart Signal K. Follow docs/INSTALLATION.md for first-time key and client setup. Signal K App Store availability depends on indexing.

The attached signalk-mcp-ops-1.0.0.tgz is the exact tested publication artifact. SHA-256: 9a586fd842aaab44c6ce625f105a9df8ab39b71c937fa546de56ef5087babcbf.

v0.1.0 — Initial public release

Initial public release of signalk-mcp-ops.

Highlights:

• Read-only MCP endpoint integrated directly into Signal K
• Streamable HTTP transport
• Uses existing Signal K HTTP/TLS server; no additional listening port
• Signal K authentication plus separate MCP Ops key
• Nine read-only MCP tools
• Telemetry path discovery and source inspection
• Provider connection inventory and provider status diagnostics
• Evidence-only missing-path diagnostics without unproven root-cause claims
• Strict configuration projection and secret-withholding controls
• No write operations, shell access, arbitrary code execution, or raw config/log export

Validation:

• Live validated on Signal K Server 2.31.0 / Node.js 22.23.2 / OpenPlotter / Raspberry Pi
• Remote MCP client validated over authenticated HTTPS
• Official Signal K Plugin CI passed on Linux, Linux ARM64, macOS, and Windows
• Node.js 22 and 24 tested
• Signal K integration tests passed on 2.31.0 and latest with Node.js 22 and 24

Compatibility note:
Provider diagnostics use a runtime-checked internal adapter based on Signal K 2.31.0 internals. Unsupported internal shapes fail closed rather than returning misleading results.