MCPFlo v0.1.0

Features

• add "All" history tab with unified cross-server activity log (29c1a97)
• add @mcpflo/server-everything test-fixture MCP server (0d89c22)
• add a Tokens tab — response footprint and definition footprint (e506ecf)
• add an OAuth auth details panel to the server detail view (0ca6754)
• add context-budget card to the server details view (e8c44f0)
• add context-budget token-estimation utility (208b7d0)
• add disconnect action to server rows (b773408)
• add expand/collapse all control to sidebar header (e7e17cb)
• add pretty JSON tree view for result panels (78bed3a)
• add protocol version override for MCP connections (85fa484)
• add Tools/Resources/Prompts sections to the server details view (2fac48e)
• cancel an in-flight capability fetch (55077bd)
• encrypt server credentials at rest with safeStorage (33a2cfb)
• keep transport secrets in main, operate on servers by id (29946fa)
• prefill the form when activating a tool/prompt from the "All" tab (2e09e03)
• replace KEY=VALUE textareas with key/value row editor (270d521)
• select a server to open its (placeholder) details view (7cdbef2)
• server details header and action bar (25372d4)
• tooltip and hover affordance on context-budget bar segments (8668acb)
• track token issue time so hydration reports honest auth status (8d00fc5)

Bug Fixes

• allowlist scheme before shell.openExternal (7a578a4)
• block OAuth over cleartext http to non-loopback hosts (c29ab37)
• block top-level navigation to non-app origins in main window (690ae03)
• bundle preload deps so sandboxed preload can load them (7b0229a)
• clear cached capabilities when disconnecting a server (f18b579)
• close spawned MCP server processes on app quit (c948799)
• correct token footprint tokenizer label to o200k_base (a48196a)
• disconnect a server's live process when it's removed (685c916)
• e2e specs broken by the server-row chevron/select split (45a3627)
• enable Chromium renderer sandbox (e7b4f2f)
• exempt MCP-UI resources from the response size cap (490587e)
• initialize captured to satisfy TS definite-assignment check (4110e03)
• prepare server-everything package for npm publish (9253b15)
• report finishAuth failures instead of leaving the row stuck pending (40b463b)
• sign out disconnects the server and restore auth status on launch (9198b27)
• stop misdiagnosing ordinary connect failures as DCR failures (8026ea1)
• stop selecting a server from forcing a connect attempt (24fc755)
• suppress stale re-auth browser tab on mid-session token expiry (52ef73e)
• tooltip colors track the app's actual theme, not OS preference (ca33b60)
• validate OAuth callback state before honoring error/settling the flow (f5cebc2)
• validate server id in IPC handlers before it reaches fs paths (9f8a4ae)