v0.7.1

No behaviour change. dist/ is byte-identical to 0.7.0, since src/ and prompts/ are untouched. This release exists to correct the package README.

What's new

Changed

• Bridge family table no longer advertises a retired project - the README listed gemini-mcp-bridge, retired in May 2026 after Google discontinued the Gemini CLI, so the npm package page was pointing readers at a dead repo. The comparison is now the two-way one it should be: claude-mcp-bridge and codex-mcp-bridge.
• CodeGuilds badge added to the README.
• npm audit reports a clean tree - an overrides block raises seven flagged transitive packages to a patched floor, each inside the range its immediate dependent already declares. SECURITY.md gains a "Dependency Audit Posture" section explaining which of them can load in a stdio-only server (only fast-uri, via the ajv validator McpServer builds at construction) and which cannot. Note that npm overrides govern this repo's own tree only and do not reach consumers of the published package.

Added

• Integration tests against the real CLI, guarding the 0.7.0 security fixes by behaviour rather than by argv shape. The existing unit tests mock spawn, so they stay green if an upstream CLI release renames a flag or changes how it binds values. The new tests assert that a flag-shaped --settings= prompt carrying a SessionStart hook does not execute the hook, that a dash-prefixed session id is consumed by --resume rather than parsed as a flag, and that a subprocess granted Read Glob Grep cannot run a shell command. All three were confirmed to fail when the corresponding fix is reverted. Excluded from npm test; run with npm run test:integration. Tests are outside the published files list, so this does not affect the package.

Full Changelog: v0.7.0...v0.7.1

v0.7.0

Upgrade recommended for all users. 0.6.1 and earlier let a crafted query prompt execute arbitrary commands.

What's new

Security

• Caller-supplied values can no longer inject CLI flags - the prompt is passed after a -- separator, and the session id, model and effort bind with the = form. Previously a query whose prompt was a --settings= payload carrying a SessionStart hook ran an arbitrary command in the caller-supplied workingDirectory, with the CLI reporting an input error only after the hook had already fired.
• Subprocesses are restricted to a read-only toolset - every spawn passes --tools, so the defaults withhold Bash, Write and Edit on every path. query and structured get Read Glob Grep, search gets WebSearch WebFetch. Previously query and structured passed no restriction at all, and --allowed-tools (used by search and image-query) only grants permission without restricting the toolset.
• Tool names are validated as identifiers - a dash-prefixed entry would otherwise terminate the variadic --tools list and be parsed as a flag.

Added

• CLAUDE_QUERY_TOOLS, CLAUDE_STRUCTURED_TOOLS and CLAUDE_SEARCH_TOOLS to override the built-in toolset per tool. Accepts a comma or space separated list, default for the CLI's full set, or an empty value for no tools.

Fixed

• SECURITY.md claimed query in --bare mode had "no tool access by default". Verified false against CLI 2.1.220: --bare and --setting-sources "" bound what context the subprocess loads and never restricted its tools. The docs now describe the real mechanism and add an Argument Injection section.

Changed

• spawnClaude rejects argv unless --tools appears before any -- separator and carries a value, enforcing the restriction at the subprocess boundary rather than trusting callers.
• buildClaudeArgs takes a required tools array in place of the optional allowedTools.
• @modelcontextprotocol/sdk 1.30.0, vitest 3.2.7 (clears GHSA-5xrq-8626-4rwp).

Upgrading

Subprocesses no longer get the CLI's full toolset. If you relied on query reaching for Bash, Write or Edit, set the matching CLAUDE_*_TOOLS env var to widen the default.

Full Changelog: v0.6.1...v0.7.0

v0.6.1

What's new

Added

• Docker image for container distribution (PR #22). Runs as non-root, suitable for the Glama MCP server listing. See Dockerfile for the canonical invocation.

Changed

• ADR-001 reframed from "remove review tool" (historical) to "bridge does not bundle reviewer prompts" (forward-looking principle). Renamed to docs/decisions/001-no-bundled-prompts.md. README "Code review" section reworked: three honest sources for the review prompt (built-in REPL command, bridge query / structured with caller-supplied prompt, direct claude -p). PR #21, PR #23.
• Dropped --disable-slash-commands from claude -p invocations on both auth paths. The flag was redundant: --bare (API-key path) disables all skills by design (anthropics/claude-code#37207), and --setting-sources "" (subscription path) excludes the user source where commands live. No user-visible behaviour change. PR #23.

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

• refactor: adopt AGENTS.md convention by @hampsterx in #18
• feat!: drop review tool (ADR-001) by @hampsterx in #20

Full Changelog: v0.5.1...v0.6.0

v0.5.1

What's new

Fixed

• `server.json` description shortened to meet the MCP registry's <=100-char limit (the registry validator rejected v0.5.0's longer description on publish)
• `CLAUDE_MAX_CONCURRENT` default reverted to string `"3"`: the registry's `KeyValueInput` schema requires string defaults regardless of declared `format`, even when `format: "number"`

The v0.5.0 npm tarball shipped with the pre-fix values. v0.5.1 aligns the published tarball with what the registry actually accepts.

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's new

Added

• MCP registry manifest (server.json) conforming to the MCP registry schema, enabling publication to registry.modelcontextprotocol.io (#16)
• mcpName field in package.json linking the npm package to its registry entry (io.github.hampsterx/claude-mcp-bridge)
• Full env var documentation in the manifest: per-tool model overrides (CLAUDE_QUERY_MODEL, CLAUDE_REVIEW_MODEL, CLAUDE_SEARCH_MODEL, CLAUDE_STRUCTURED_MODEL), fallback behaviour, concurrency, budget caps, effort controls

Changed

• BREAKING: Node.js 22+ required. Dropped Node 18 and 20 from the CI matrix and support (#14)
• package.json description updated to cover code review and web search

Full Changelog: v0.4.1...v0.5.0

v0.4.1

What's new

Fixed

• Subscription auth in non-API-key mode - dropped --bare flag that was preventing subscription auth from working correctly (#12)

Changed

• Extracted shared helpers (buildEnv, buildArgs, handleSpawnResult, checkErrorPatterns) to reduce duplication across tool handlers (#13)
• Expanded test coverage to 272 tests (up from 190)
• Updated CI/CD and search tool descriptions

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's new

Changed

• Subscription-first auth — subprocess no longer forwards ANTHROPIC_API_KEY by default. Set CLAUDE_BRIDGE_USE_API_KEY=1 to opt in to API key auth. Prevents accidental API credit consumption when subscription auth is available.
• Secret redaction in error paths — checkErrorPatterns now uses redactSecrets() before throwing, preventing secret leakage in auth/quota/connection errors

Added

• CLAUDE_BRIDGE_USE_API_KEY env var for explicit API key auth opt-in
• Extracted DESIGN.md and SECURITY.md from README for better navigation
• 190 tests (up from 186)

Full Changelog: v0.3.1...v0.4.0

v0.3.1

What's new

Added

• Ping concurrency diagnostics — activeCount, queueDepth, maxConcurrent from live spawn state (no more env re-parsing)
• Auto-scaled agentic review timeout — timeout scales from git diff --numstat file count (3-10 minutes), explicit timeout still overrides
• Bridge family comparison table in README
• CI workflows — lint/typecheck/test/build on Node 18/20/22, OIDC npm publish on tag push

Changed

• 186 tests (up from 166)

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's new

• Tool annotations on all tools (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
• Structured _meta on every response: durationMs, model, sessionId, totalCostUsd, token breakdown
• Rich tool descriptions with capability summaries, cost guidance, and prompt tips
• listSessions tool: list active sessions with cumulative cost, turn counts, and timing
• Session tracking: in-memory store with TTL (24h) and LRU eviction (100 sessions)
• Progress heartbeats: MCP notifications/progress every 15s for query, review, and search tools
• 166 tests (up from 91)

See CHANGELOG.md for details.