v0.3.0

⚠️ If your workflow uses ivermin1123/mcp-cassette@v0

@v0 is a floating tag. It follows every 0.x release, and while the major
version is 0, a minor release may carry a breaking change. This one does.

What you will see. On your next run — with nothing changed on your side —
check may exit 1 on a server you did not touch. Eight new safety-lint rules
land in this release, three of them at error level (CAS-L009, CAS-L010,
CAS-L013), and the lint now reads more of each schema than it did in 0.2.0:
title, default, const, the string members of enum and examples, and
tool annotations, on top of every description.

The action's fail-on input will not soften this. It gates contract drift
(snapshot --check), not the safety lint, whose gate is error-level and fixed.

What to do — pick one.

1. Not now: pin to the previous release.

- uses: ivermin1123/mcp-cassette@v0.2.0

An exact tag, already published, behaving exactly as it did yesterday. Note
v0.2.0 — not @v0, which is the thing that just moved.

2. Take the upgrade, keep the lint out of your gate. Run the contract half
only:

- uses: ivermin1123/mcp-cassette@v0
  with:
    mode: snapshot        # contract drift only — the safety lint does not run
    fail-on: breaking     # or: dangerous

The findings leave your gate along with the lint, so treat this as a deliberate
pause rather than a destination. On the CLI the equivalent knob only tightens:
check gates on error-level findings, and check --fail-on warn adds the
warnings. There is no looser setting, because the error-level rules are the ones
worth stopping for.

3. Fix it. Every finding prints a rule id. Look it up in the
rule table —
sixteen rows, each with its severity, its OWASP MCP Top 10 risk and its SAFE-MCP
technique. The three new error rules fire on a bidirectional text override
(Trojan Source), variation selectors used as a data channel, and an instruction
telling the model to assume a role. None of those belong in an honest tool
description, so a hit is worth fixing rather than muting. If one is a false
positive, please open an issue — the rules ship with paired fixtures precisely so
legitimate tools stay quiet.

One more thing: never point a workflow at @main. It is not a release
channel, and its action.yml can name a version that is not on npm yet.

---

What's Changed

• ci(release): verify the publish with one resolver, not two by @ivermin1123 in #31
• ci(release): make the npx version pin survive our own checkout by @ivermin1123 in #32
• feat(replay): a miss is data before it is a sentence by @ivermin1123 in #33
• test(replay): every miss cause, and the one renderer by @ivermin1123 in #34
• feat(vitest): put a cassette around a describe block by @ivermin1123 in #35
• test(vitest): prove the adapter by running vitest by @ivermin1123 in #36
• feat(lint): cite the standards, read the whole schema, prove the patterns by @ivermin1123 in #37
• test(lint): the mapping, the surface, and the gate's own coverage by @ivermin1123 in #39
• feat(lint): eight more rules, and the two kinds of certainty by @ivermin1123 in #40
• test(lint): the fixture-double law, encoded by @ivermin1123 in #41
• feat(check): SARIF output, and the rule catalogue moves out by @ivermin1123 in #42
• test(check): validate SARIF against the specification by @ivermin1123 in #43
• chore: release 0.3.0 by @ivermin1123 in #44

Full Changelog: v0.2.0...v0.3.0