Skip to content

2.1.0

Choose a tag to compare

View all tags
@kiliczsh kiliczsh released this 21 Jul 21:17
2.1.0
655e68f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MCP 2025-11-25 spec compliance, security hardening and dependency updates

Spec compliance

  • SEP-1303: validation and MongoDB runtime errors are now tool execution errors (isError: true) so models can self-correct; unknown tools remain protocol errors, cancellation propagates as AbortError
  • Task-augmented execution only runs when explicitly requested by the client
  • Added title, description and websiteUrl to server implementation info
  • Tool schemas verified against JSON Schema 2020-12 (strict), tool names conform to SEP-986

Security

  • Origin header validation on HTTP transport (DNS rebinding protection): invalid origins get 403 Forbidden; configurable via --allowed-origins / MCP_HTTP_ALLOWED_ORIGINS
  • Dependency overrides for 13 vulnerable transitive packages: audit findings reduced from 57 (1 critical, 16 high) to 3 moderate

Dependencies

  • @modelcontextprotocol/sdk 1.29 (protocol 2025-11-25), mongodb 7.5, zod 4, @biomejs/biome 2.5, @types/node 26, inspector 1.0

Tested end-to-end against MongoDB 4.4, 6.0, 7.0 and 8.2 (standalone, replica set, no-auth, auth+keyFile RS, TLS) — 7/7 passing.

Full Changelog: 2.0.2...2.1.0

Assets 2
Loading