v4.0.0

A different kind of MCP server

Most MCP servers work the same way: at session start, every tool the server knows about gets loaded into the client's context window. For a small API surface that's fine. For a large one — hundreds of tools across dozens of categories — it means paying the full token cost of the entire API on every call, whether the current task needs any of it.

This release introduces a kernel + domain architecture that changes the economics of that tradeoff.

The kernel is a fixed set of six tools that are always available, regardless of what you're doing in Resolve: activate_domain, deactivate_domain, list_domains, get_version, get_current_page, switch_page. Context cost at session start is bounded by the kernel alone — six definitions, not hundreds.

Domains are the rest of the API, organized by concern: Project Management, Timeline Operations, Media Pool, Clip Properties, Timeline Item Editing, Color Grading, Render & Delivery, AI & Studio, System/Fairlight/Storage. When your workflow needs a domain, you activate it. The server fires a notifications/tools/list_changed event; your MCP client refetches the tool list and the domain's tools are immediately available — no session restart, no configuration change.

Context cost scales with the work, not the server.

---

Why this matters beyond DaVinci Resolve

The kernel + domain pattern isn't specific to this project. Any MCP server with a large API surface faces the same tension: full coverage costs context on every call; selective loading requires the client to know in advance what it needs. Dynamic domain activation — lazy loading via notifications/tools/list_changed — is a middle path that gives the client full coverage on demand while keeping the default session lightweight.

If you're building an MCP server for a large API, this architecture is worth considering.

---

What's in v4.0.0

• 9 domains, 289 tools covering the full DaVinci Resolve Studio scripting API
• 6 kernel tools always in context; domain tools loaded on demand
• Destructive operations gated behind explicit confirm: true parameters
• Compatible with any MCP client that supports notifications/tools/list_changed

Breaking change from v3.x: v3 exposed a flat list of tools at session start. Any client configuration that enumerates specific tool names by position will need to be updated to use the kernel's activate_domain flow.

v3.1.0

Full Changelog: v3.0.3...v3.1.0

v3.0.3

Full Changelog: v3.0.2...v3.0.3

v3.0.2

Changes

• chore(deps): bump nltk from 3.9.4 to 3.10.0 (bfe2da0)

Security

Resolves 5 high-severity vulnerabilities in the nltk transitive dependency (via safety):

• CVE-2026-54293: URL-encoded path traversal in nltk.data.load()
• CVE-2026-12072: Path traversal in NKJPCorpusReader
• CVE-2026-12074: Path traversal in FramenetCorpusReader
• CVE-2026-12061: ReDoS in ReviewsCorpusReader FEATURES regex
• CVE-2026-12075: DNS-rebinding SSRF filter bypass in nltk.pathsec

Also adds defusedxml 0.7.1 as a new transitive dependency (XML entity expansion protection introduced by nltk 3.10.0).

Note: cryptography CVE-2026-69247 (Bleichenbacher oracle) remains open — re-evaluate 2026-08-14.

v3.0.1

Summary

• Fix server crash when connecting to DaVinci Resolve on Windows: DaVinci Resolve's fusionscript.dll discovers Python via the Windows registry and loads python3.dll by full path. When the MCP server ran under a different Python installation (e.g. uv-managed), two Python runtimes loaded into the same process, causing an immediate access violation. The server now detects this mismatch before loading the DLL and returns an actionable diagnostic.

• Add os.add_dll_directory() for the Resolve install directory: so fusionscript.dll can find sibling DLLs (lua5.1.dll, tbbmalloc.dll) under the restricted Python 3.8+ DLL search policy on Windows.

• Explicit SystemError handling:** for environments where fusionscript.dll initialization fails.

• DaVinci Resolve Studio is now required: the free edition does not support external scripting and has been removed from the prerequisites.

##Upgrade notes

On Windows, the virtual environment must be created from the system-installed Python — the same installation registered in the Windows registry. If you previously used uv venv without --python, recreate it:

    uv venv --python "C:\Program Files\PythonXYZ\python.exe"
    uv sync

where PythonXYZ matches your system-installed Python version.

v3.0.0

What's New

DaVinci MCP Professional v3.0.0 is a major modernization of the project foundation. No new tools or resources were added in this release — the focus was entirely on build infrastructure, packaging, documentation, and CI.

Breaking Changes

• DXT packaging has been removed: Anthropic has deprecated DXT/MCPB. The .dxt extension format and all associated build scripts (manifest.json, .dxtignore, setup_dxt.py, build-dxt.ps1, build-dxt.bat) have been removed.
• Cursor IDE support has been dropped: Supported MCP clients going forward are Claude Desktop (Anthropic), Gemini CLI (Google), and ChatGPT (OpenAI). Cursor users can fork and adapt.
• Python floor raised to 3.10: Python 3.9 is no longer supported.

Highlights

• uv is now the sole runtime manager: All dependency management, virtual environment creation, and tool invocation use uv. No more pip install or setup.py.
• PyInstaller build support: Run uv run --extra build python build.py to produce standalone executables (davinci-mcp-server, davinci-mcp) as single-directory bundles.
• Git-tag versioning via hatch-vcs: Version is derived from git tags at build time — no more hardcoded version strings in source.
• License corrected: License declaration now correctly reflects GPL-3.0 (was incorrectly declared as MIT in pyproject.toml).
• Documentation overhauled: README.md rewritten for end users; USING.md rewritten for developers. Doxygen API docs regenerated with full coverage of types.py Protocol classes.
• CI modernized: Both ci.yml and codeql.yml migrated to astral-sh/setup-uv with Python version matrix (3.10–3.13).

Dependency Floors

Audited against MCP Python SDK 1.27.0:

• mcp >= 1.10.0
• pydantic >= 2.12.0
• anyio >= 4.9
• httpx >= 0.27.1, <1.0.0
• click >= 8.0.0
• colorama >= 0.4.6

Full Changelog

bef6621...011e060

v2.4.0

🚀 DaVinci MCP Professional v2.4.0 - Enterprise-Grade Release

🎯 Major Achievement: 93% Type Safety Improvement + Comprehensive Security Hardening

This release transforms DaVinci MCP Professional into a professional, enterprise-ready MCP server with exceptional type safety and security infrastructure - suitable for professional investigations and Anthropic ecosystem showcase.

---

📋 What's New Since v2.2.1

🛡️ Security Infrastructure (v2.3.0)

• Added: Dependabot automated security updates (.github/dependabot.yml)
• Added: Comprehensive security policy (.github/SECURITY.md)
• Added: CodeQL static analysis workflow (.github/workflows/codeql.yml)
• Added: Security test suite (tests/test_security.py)
• Added: Security audit automation (security_audit.py)
• Enhanced: CI pipeline with Bandit SAST, Safety scanning, license compliance
• Updated: pyproject.toml with security dependencies

🎯 Type Safety & Code Quality (v2.4.0)

• Added: Comprehensive DaVinci API Protocol definitions (src/davinci_mcp/types.py)
• Improved: 93% pyright error reduction (28 → 2 errors)
• Enhanced: MCP framework type compliance throughout codebase
• Added: Runtime type checking for external API returns
• Fixed: All import/export type issues
• Updated: Complete type annotations across all modules

🔧 Developer Experience

• Added: Pyright configuration in pyproject.toml
• Added: Bandit SAST configuration (.bandit)
• Enhanced: Error handling with proper type safety
• Updated: .gitignore for security artifacts
• Improved: Code documentation through type annotations

---

📊 Quality Metrics

Metric	Before	After	Improvement
Pyright Errors	28	2	93% reduction
Type Coverage	Basic	Comprehensive	Gold Standard
Security Tests	None	Complete Suite	Enterprise-Grade
CI/CD Security	Basic	Multi-Stage	Professional

---

🎯 Professional Use Cases

✅ Ready For:

• Digital Forensics Investigations: Type safety prevents runtime errors during critical analysis
• Enterprise Deployment: Security hardening suitable for government/corporate environments
• Anthropic Showcase: Meets and exceeds their professional development standards
• Team Development: Clear API contracts and comprehensive

---

🎯 NOTE: The v2.4.0 release is functionally identical to the v2.2.1 release except with enhanced development tooling. There is no need to update your installation if you're already running v2.2.1.

v2.2.1

🎬 Enterprise AI-Powered Video Production Integration

DaVinci MCP Professional v2.2.1 brings AI assistance directly to your video editing workflows through seamless DaVinci Resolve integration.

✨ What's New in v2.2.1

🚀 Desktop Extension (DXT) Support

• One-click installation through Claude Desktop Extensions
• Automatic dependency management - no manual setup required
• Cross-platform compatibility with Windows, macOS, and Linux
• Fixed Windows binary dependencies for reliable operation

🔧 Technical Improvements

• Resolved rpds.rpds import issues in DXT packaging
• Enhanced PYTHONPATH configuration for DaVinci Resolve modules
• Streamlined installation process with proper binary bundling

📦 Installation Options

Recommended: Desktop Extension

1. Download davinci-mcp-professional.dxt below
2. Open Claude Desktop → Settings → Extensions
3. Drag and drop the .dxt file to install
4. Start DaVinci Resolve and begin AI-assisted editing!

Advanced: Manual Installation

See README.md for manual setup instructions.

🎯 Ready for Production

This release represents a fully functional, enterprise-grade MCP extension ready for professional video production workflows - from Hollywood studios to YouTube creators.

📂 Repo Infrastructure Upgrade

Added .github folder with CI, templates, and contributor tools. No changes to runtime code.

---

Tested with: DaVinci Resolve Studio 20.0.0.49 | Claude Desktop | Windows/macOS/Linux