v0.2.5

What's Changed

Added

• MCP client setup instructions for Codex, Cursor, Windsurf, VS Code + GitHub Copilot, and Gemini CLI
  • Updated docs/guides/mcp-clients.md and README with config snippets for each agent

Fixed

• npm run scan now runs npm run build first and disables auto-clone to match CI behavior
• Simplified mcp-scan.yml workflow to use npm run scan script (removes duplicate build step)
• README integration test docs now warn about FEDRAMP_DOCS_AUTO_UPDATE when using own checkout

Full Changelog: v0.2.4...v0.2.5

v0.2.4 — Automated Upstream Sync

What's New

Automated Upstream FedRAMP/docs Sync (ENG-541)

Added a weekly GitHub Actions workflow that monitors the upstream FedRAMP/docs repository for changes, validates compatibility, and creates a GitHub issue assigned to Copilot for triage.

How it works:

• Lightweight git ls-remote check runs weekly (Mondays 06:00 UTC) — exits in ~5 seconds when nothing changed
• When upstream changes are detected: clones the repo, runs unit + integration tests against the new data, generates a change summary (commit log, diffstat, changed files)
• Creates a GitHub issue with full context so Copilot can propose any needed code updates
• Duplicate issue prevention via upstream-sync label check
• SHA-pinned actions following existing supply chain security conventions

Integration Test Suite

Added npm run test:integration — 6 tests that validate the indexer against the real upstream FedRAMP/docs repository:

• FRMR document indexing
• KSI item extraction with valid IDs
• Control mapping population
• Document type validation against known set
• Error handling verification
• Repo info availability

Changes:

• .github/workflows/upstream-sync.yml — weekly sync workflow
• .github/upstream-commit.sha — baseline upstream commit tracker
• tests/integration.test.ts — integration test suite
• vitest.integration.config.ts — separate vitest config (no fixture override, 60s timeout)
• vitest.config.ts — exclude integration tests from default npm test
• package.json — version bump + test:integration script
• CHANGELOG.md — release notes
• README.md — integration test documentation

Full Changelog: v0.2.3...v0.2.4

v0.2.3 — MCP Security Scan CI Pipeline

What's New

MCP Security Scan (ENG-511)

Added an automated security scanning workflow using Cisco's MCP Scanner to the CI pipeline. This establishes a trust baseline for the MCP server by running YARA-based analysis on every push and PR to main.

Changes:

• New GitHub Actions workflow (.github/workflows/mcp-scan.yml) with SHA-pinned actions
• npm run scan convenience script for local scanning
• Scan results uploaded as workflow artifacts (30-day retention)
• CI badge added to README
• Workflow hardened with explicit permissions: contents: read and timeout-minutes: 10

Full Changelog: v0.2.2...v0.2.3

v0.2.1

Added

• Okta/Duo phishing-resistant MFA evidence sources for KSI-IAM-01
  • 3 new Okta WebAuthn/FIDO2 specific APIs
  • 5 new Duo WebAuthn/Passkey sources
  • Total: 8 new automation sources for phishing-resistant MFA compliance

Enhanced

• health_check tool now returns repository version info and auto-update status
  • New repoInfo field with commitHash, commitDate, and lastFetchedAt
  • New autoUpdate field with enabled status and check interval
• MCP SDK updated to 1.25.1 (spec 2025-11-25 compliant)
• MCP Inspector documentation expanded with usage examples

Fixed

• README configuration example completeness
• Plugin command documentation with enhanced output examples

---

Full Changelog: v0.2.0...v0.2.1