Skip to content

v2.0.0: Tool consolidation and agent-ready hardening (breaking)

Choose a tag to compare

View all tags
@jztan jztan released this 15 May 21:25
v2.0.0
d57b0ab

Highlights

v2.0.0 is a major release that reshapes the tool surface. 35 CRUD tools are consolidated into 9 manage_X(action=...) tools, cutting the count from 69 to 43, and the monolithic handler is refactored into a tools/ package. Three new tools then bring the surface to 46: delete_redmine_issue (double-confirmation gated, with a cascade-impact preview), get_mcp_server_info, and manage_document for the DMSF plugin.

Agent ergonomics get a broad hardening pass: action values and limit/offset bounds are now JSON-schema enums, a new boundary middleware returns a clean INVALID_ARGUMENTS envelope instead of raw Pydantic errors, list/search failures return a flat {"error": ...} shape, and search_redmine_issues hydrates full issue fields. create_redmine_issue also accepts custom fields by name.

This release is breaking: the redmine_handler module is gone (internal imports must migrate), get_redmine_attachment_download_url is replaced by get_redmine_attachment, and several parameters reject previously-accepted shapes. Security: all GitHub Actions are SHA-pinned and fastmcp, pytest, and python-multipart are bumped for CVEs.

Changes

Breaking

  • The redmine_handler module is removed; the implementation now lives in a tools/ package with _* helper modules. External code must migrate internal imports (e.g. from redmine_mcp_server.tools.projects import manage_project_member).
  • get_redmine_attachment_download_url is removed; use get_redmine_attachment, which works in both HTTP and stdio deployments.
  • List/search tools return a flat {"error": ...} envelope on failure instead of a single-element [{"error": ...}] list. (#117)
  • cleanup_attachment_files is no longer on the default surface; opt in with REDMINE_MCP_EXPOSE_ADMIN_TOOLS=true. (#115)
  • import_time_entries.entries no longer accepts a JSON string, only a list. (#114)
  • list_redmine_issues.assigned_to_id and list_time_entries.user_id reject strings other than "me". (#116)
  • mark_checklist_done is removed; use update_checklist_item(is_done=True).
  • Structured-metadata fields (filenames, display names, identifiers) are no longer wrapped in <insecure-content> tags; free-text fields stay wrapped. (#109)

Added

  • delete_redmine_issue: gated issue deletion requiring confirm_delete=True, with a cascade-impact preview and a second opt-in for subtasks. (#120)
  • get_mcp_server_info: returns version, read-only mode, auth mode, and plugin flags; credentials are never included. (#124)
  • manage_document: DMSF document operations (list/get/create/update) behind REDMINE_DMSF_ENABLED=true. (#104)
  • get_redmine_attachment: unified download returning an HTTP URL or a local file_path depending on deployment, with a byte cap (ATTACHMENT_MAX_DOWNLOAD_BYTES, default 200 MB).
  • manage_X action values and limit/offset bounds are now JSON-schema enums/ranges, rejected at the boundary with INVALID_ARGUMENTS. (#112, #111)
  • Validation-boundary middleware returns the standard INVALID_ARGUMENTS envelope instead of leaking raw Pydantic errors. (#108)
  • create_redmine_issue accepts custom fields by name in fields, matching update_redmine_issue. (#123)
  • REDMINE_PUBLIC_URL rewrites internal-host attachment content_urls to a client-reachable origin. (#110)
  • list_redmine_issues.status_id accepts the sentinels "open", "closed", and "*". (#107)

Changed

  • 35 CRUD tools consolidated into 9 manage_X(action=...) tools (69 to 43 before later additions); read actions remain available in read-only mode.
  • create_redmine_issue / update_redmine_issue validation errors now carry missing_required_fields and a tailored recovery hint. (#119)
  • get_redmine_issue and create_redmine_issue descriptions padded with synonyms to improve tool-search recall. (#113)

Fixed

  • search_redmine_issues now hydrates full issue fields (subject, status, project, assignee, dates) instead of returning nulls.
  • get_redmine_attachment returns a structured ATTACHMENT_UNAVAILABLE envelope on a 404 instead of a bare message. (#106)
  • Wiki attachments now expose content_url and author, matching the issue attachment shape. (#118)

Security

  • Pin all GitHub Actions to immutable commit SHAs to prevent tag-hijacking supply-chain attacks.
  • Bump fastmcp 3.2.0 to 3.2.4 (decoded-base64 size validation, header-forwarding fix, RFC 8707 audience binding), pytest 9.0.2 to 9.0.3 (CVE-2025-71176), and python-multipart 0.0.26 to 0.0.27 (CVE-2026-42561).

Acknowledgements

Thanks to @mihajlovicjj for contributing:

  • added manage_document tool for DMSF (Document Management System for Files) plugin support, with 31 new tests covering list/get/create/update across feature-flag gating, dispatch routing, two-step upload, byte-cap enforcement, and validation paths (#104)

Installation

pip install redmine-mcp-server==2.0.0

Links

Contributors

mihajlovicjj
Assets 2
Loading