v0.5.0

This release changes who is responsible for keeping credential endpoints away from agents. Read the first section before upgrading.

Credential endpoints are now governed by DISALLOWED_ACTIONS

Earlier releases kept credential endpoints out of the manifest with a hardcoded EXCLUDED_ENDPOINTS blocklist in the splitter. That blocklist is removed, and the manifest now carries every endpoint in the Fivetran API. Seven endpoints come back into reach:

create_system_key, rotate_system_key, update_system_key, delete_system_key, create_user_api_key, rotate_user_api_key, delete_user_api_keys

These read, mint, rotate, or re-permission API keys that outlive the session, and they are reachable within whatever FIVETRAN_SCOPE you grant. DISALLOWED_ACTIONS is now the only thing holding them back.

Set the recommended denylist:

system-keys:read,users:read:get_user_api_key,users:read:list_api_keys,users:write:create_user_api_key,users:write:rotate_user_api_key,users:delete:delete_user_api_keys

The server logs a startup warning for as long as any of them remain callable. system-keys:write and system-keys:delete are also valid tokens if you prefer to deny by tier.

Writes get a longer read timeout and a readable timeout error

Endpoints whose upstream work runs setup tests — create_destination, create_connection, run_setup_tests — can exceed the 30s read budget, and Fivetran applies the write even after the server stops waiting. The old budget therefore reported a failure for a change that had actually landed. The budget is now selected per call: GET keeps the 30s timeout, everything else gets a 180s read timeout.

A timeout raised httpx.ReadTimeout, whose str() is empty, so it reached the caller as an error with no text at all. Timeouts now raise UpstreamTimeout — an httpx.TimeoutException subclass, so transport-level handling is unchanged — carrying a message telling the caller the action may have succeeded upstream and to check before retrying.

Scope configuration is the same in both transports

build_http_app() now calls the same _parse_scope_and_denies_from_env() helper that stdio uses, rather than hardcoding a read/write ceiling and reading denials from a code constant. FIVETRAN_SCOPE, DISALLOWED_ACTIONS, and FIVETRAN_ALLOW_WRITES configure a streamable-http deployment exactly the way they configure a stdio one, including the read-only default when nothing is set. A self-hosted HTTP instance gets the same env-var configurability as stdio, and Fivetran's own deployment sets these at deploy time like any other operator's.

The unused HOSTED_DISALLOWED_ACTIONS constant and _STDIO_ONLY_ENV_VARS tuple are removed.

Also in this release

• The HTTP docs use the fivetran-mcp console script, which both uvx and pip install . provide, instead of a direct server.py path.
• README gaps found in review are fixed.