v1.1.0

Added

• Optional Bearer auth on the HTTP /mcp endpoint — set MCP_API_KEY=<key> and every request must include Authorization: Bearer <key> (timing-safe compare). Missing/wrong tokens get 401 with a WWW-Authenticate: Bearer realm="mcp" header. /health stays open for health-checkers. Unset = open endpoint (preserves current behavior). HTTP transport only — stdio is single-process and unaffected. (#11) — thanks @kb1isz for the request.
• Per-client FortiManager token passthrough — set MCP_TOKEN_PASSTHROUGH=true and each MCP client can supply its own FortiManager admin token via the X-FMG-Token header. That token is used (instead of FMG_API_TOKEN) for live API calls made by the execute tool for that request only, so FortiManager's own admin-profile RBAC enforces per-user permissions. Requests without the header fall back to FMG_API_TOKEN, so existing single-tenant deployments keep working unchanged. HTTP transport only. (#11)
• FmgClient.rawRequest(method, params, opts?: { tokenOverride }) — new optional per-call token override threaded through CodeExecutor.execute(code, opts?: { fmgToken }). The shared FmgClient (and its undici dispatcher) is reused across requests; only the Authorization header is swapped per call.
• 18 new tests across config / client / code-executor / HTTP transport covering the auth gate, passthrough, fallback, and combined modes (total 90).

Changed

• HTTP transport's serverFactory now receives an McpRequestContext (currently exposing fmgToken) instead of being called with no arguments. The stdio path is unchanged.
• startHttpTransport now removes its installed SIGINT / SIGTERM listeners when close() is called, so repeated test runs no longer leak signal handlers on the host process.

---

Full Changelog: https://github.com/jmpijll/fortimanager-code-mode-mcp/compare/...

Note: This server requires locally-generated API spec files. See README for setup instructions.

v1.0.2

Fixed

• HTTP transport accepts multiple clients / reconnects — startHttpTransport now builds a fresh McpServer and stateless StreamableHTTPServerTransport per /mcp request. Previously a single module-scope server was reused for every request, so any client after the first was rejected with -32600 "Invalid Request: Server already initialized", breaking reconnects and multi-client deployments. Verified end-to-end against a live FortiManager 7.6.6 with multiple sequential opencode (deepseek) sessions. (#13, #14) — thanks @AndreADV77 for the report and fix proposal.

---

Full Changelog: https://github.com/jmpijll/fortimanager-code-mode-mcp/compare/...

Note: This server requires locally-generated API spec files. See README for setup instructions.

v1.0.1

Fixed

• Spec generator auto-detection — generate-spec.ts now auto-detects the latest FortiManager patch version in docs/api-reference/ instead of requiring a hardcoded directory name. Supports any 7.4.x or 7.6.x release. (#12) — thanks @kb1isz

---

Full Changelog: https://github.com/jmpijll/fortimanager-code-mode-mcp/compare/...

Note: This server requires locally-generated API spec files. See README for setup instructions.

v1.0.0

Added

• Binary entry point — fortimanager-mcp CLI command via bin field in package.json (source installs only)

Changed

• Stable release — promoted from Beta to v1.0.0 public release
• API spec files removed from repository — spec files are now generated locally from Fortinet's HTML docs (not redistributable). Users must download the FortiManager JSON API Reference from FNDN and run npm run generate:spec before first use.
• Git LFS removed — no longer needed since spec files are git-ignored
• Clear startup error — server now shows detailed instructions when spec files are missing
• Documentation updated with spec generation prerequisites across README, usage-guide, and CONTRIBUTING
• Dockerfile updated to require locally-generated spec files before building
• CI workflows no longer require Git LFS checkout
• Repository visibility changed to public

---

Full Changelog: https://github.com/jmpijll/fortimanager-code-mode-mcp/compare/...

Note: This server requires locally-generated API spec files. See README for setup instructions.