Release Release v1.7.0 · kesslerio/attio-mcp-server

Safe deals-only merge_records, Cloudflare remote MCP sessions that no longer drop after an hour, and tenant/OAuth security hardening.

What's New

merge_records universal tool — dry-runs a deals-only leftover-versus-live field plan, then requires explicit confirmation and the dry-run fingerprint before patching, clearing, and native-merging into a new survivor record (#1264)

Date-parser relative ranges are host-timezone stable — parseRelativeDate now uses UTC calendar helpers (aligned with timeframe-utils), so week/month fixtures no longer flip under Asia/Tokyo and similar offsets (#1253)
Cloudflare Worker remote MCP: connector dropped to 401 ~1 hour after connecting (examples/cloudflare-mcp-server). Sessions now use a 30-day lifetime when Attio omits expires_in, and an unresolved session token returns 401/re-authenticate instead of being forwarded to Attio (#1241)

Isolate Attio client, search, task, and note caches per request/tenant so credentials and results cannot leak across sessions (#403)
Block list mutations through generic CRUD, require note_id validation on note write/delete, restore batch operation safety limits, and mark manage-list-entry as a write tool
Stop forwarding unresolved Cloudflare session tokens and isolate Worker tool auth per request; validate OAuth callback state and escape user-controlled callback HTML (#1241, #1243)
Sanitize create/API error logging so raw Axios payloads are not serialized into client responses
Harden GitHub Actions, Claude, and publish workflows against untrusted PR/issue context and over-scoped credentials

npm install -g attio-mcp

Or update your existing installation:

npm update -g attio-mcp

Full Changelog: v1.6.1...v1.7.0