Skip to content

Data Olympus 0.6.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 17:08
Immutable release. Only release title and notes can be modified.
v0.6.0
ee04c6c
This commit was signed with the committer’s verified signature.
ajdelaguila Antonio J. del Águila
GPG key ID: CEC2AC84D041B631
Verified
Learn about vigilant mode.

Data Olympus 0.6.0 makes the product easier to discover, install, evaluate, and release with confidence. The default MCP catalog is now compact and searchable, PyPI is the primary installation path, public sandbox behavior is safer, and every release artifact is tied to one reviewed source commit through explicit provenance.

Highlights

Searchable MCP discovery

Agents now receive the seven core tools plus tool_search and call_tool from tools/list by default. The remaining tools stay directly callable with unchanged authorization, while discovery no longer consumes context with the complete catalog.

Operators that need the previous full catalog behavior can set:

KB_TOOL_DISCOVERY_MODE=all

PyPI first installation

Try the CLI without installing it permanently:

uvx data-olympus --help

Install or upgrade the persistent CLI:

uv tool install --upgrade data-olympus

Data Olympus 0.6.0 requires Python 3.13 or newer.

The wheel and source distribution include both console entry points and the enforcement files used by setup. Release automation verifies clean installation from both formats before publication.

Complete, reproducible releases

Release candidates now cover PyPI, GHCR, and GitHub from one exact source commit. Stable promotion requires explicit human approval, compares candidate and stable Python payloads after normalizing version metadata, and retags the verified candidate image digest without rebuilding it.

The 0.6.0 release provenance records:

  • Source commit: ee04c6ca65e525e63337bba30daf8f194d3b3062
  • Promoted candidate: 0.6.0-rc.4
  • GHCR digest: sha256:d2388b3c5a96b2cda6f968db0b7403aae225d4a9cc3417c04fee4c59b6e3d77f
  • Candidate to stable comparison: 85 files equivalent

The downloadable release-provenance.json records the wheel, source distribution, source tree, dependency lock, and candidate to stable comparison. The GHCR digest above is verified separately against the registry.

Executable OKF interoperability

CI now proves both interoperability directions against a pinned revision of Google's Open Knowledge Format reference implementation. Checksummed fixtures detect meaningful upstream changes without treating unrelated repository commits as compatibility changes.

Better registry and sandbox quality

Tool descriptions now state behavior, parameters, side effects, and when a related tool is more appropriate. Glama metadata includes related servers and maintenance guidance, while the public sandbox starts with the safe example corpus instead of an empty index.

Safer incomplete index behavior

Search, document reads, lists, outlines, onboarding status, and cleanup planning now return safe empty results when SQLite exists but has not yet been populated. Raw database errors are no longer exposed during startup or sandbox evaluation.

Security

  • Updated the MCP SDK to 1.28.1, removing the WebSocket transport vulnerability tracked as GHSA-vj7q-gjh5-988w. Data Olympus uses Streamable HTTP, but the affected code is no longer present in the dependency lock.
  • Updated the optional benchmark stack to torch 2.13.0, addressing GHSA-rrmf-rvhw-rf47 in torch.jit.script. Production embeddings do not use torch.
  • Updated FastMCP, regex, mypy, types-regex, Ruff, and GitHub Actions dependencies to their reviewed release baselines.

Benchmark evidence

Benchmark results now carry a deterministic receipt covering source, corpus and query hashes, dependency lock, environment, model and tokenizer identities, commands, seeds, result hashes, and metric summaries. Public claims remain explicitly labeled as maintainer produced and not independently reproduced.

Compatibility note

There is no MCP API removal in this release. Clients that assume every tool appears in the initial tools/list response should either adopt tool_search and call_tool, or set KB_TOOL_DISCOVERY_MODE=all while migrating.

Verification

The release passed the complete Python and Bats suites, Ruff, mypy, actionlint, CodeQL, packaging checks, documentation consistency checks, candidate to stable artifact comparison, PyPI hash readback, and local execution of the promoted container digest.

Full comparison: v0.5.0...v0.6.0

Assets 8
Loading