v0.2.1

Brings the MCP tool in line with Anthropic's Software Directory policy, and adds the pages a directory listing needs.

Changes

• The check_what_exists tool now has the title "Check what already exists" and declares itself read-only, non-destructive, idempotent and open-world, so clients can see what calling it does before they call it.
• New PRIVACY.md: what leaves your machine, what stays, and that the author collects nothing.
• New SECURITY.md: report vulnerabilities privately through GitHub.
• README: three example prompts under "Try it", and a troubleshooting table.
• Plugin: a listing icon, plus documentation, support and privacy links in plugin.json.
• The session block's command hints were reworded. Its behaviour is unchanged.

No breaking changes. Upgrade with uv tool upgrade sota-anchor, or update the plugin in Claude Code.

v0.2.0

sota-anchor is an MCP server and Claude Code plugin that checks what has shipped since your coding agent's training before it rebuilds something from scratch, by searching the last year of papers, repositories and packages.

This is the first release on PyPI:

uvx sota-anchor serve

Breaking change

sota-anchor now reads only its own environment variables, never keys you set for other tools:

Old	New
GITHUB_TOKEN, GH_TOKEN	SOTA_ANCHOR_GITHUB_TOKEN
BRAVE_API_KEY	SOTA_ANCHOR_BRAVE_API_KEY
OPENROUTER_API_KEY, OPENAI_API_KEY	SOTA_ANCHOR_API_KEY

In Claude Code, set the GitHub token and the Brave key in the plugin's settings. They're stored as sensitive values.

Security

• The model list fetched from OpenRouter is checked before it's added to session context or CLAUDE.md. Malformed IDs and fields are dropped.
• Search results are labelled as third-party text in the prompt your agent reads: data, never instructions. Any package they name should be checked before you install it.
• Each search result field is kept on one line, so it can't pass for part of the prompt around it.
• SOTA_ANCHOR_API_KEY is sent only over HTTPS, or plain HTTP to a server on your own machine. It's masked whenever settings are printed or logged.
• The Brave key is never sent along a redirect.
• PyJWT is locked at 2.15.1, which fixes PYSEC-2026-4141. That issue couldn't be triggered here, since sota-anchor runs over stdio and doesn't use the MCP library's HTTP login.
• Releases are published to PyPI with Trusted Publishing. The job that uploads runs none of the project's code, and every action it uses is pinned to a commit.

Fixes

• One malformed row in the model registry no longer breaks the model list or the check. The check now answers even if the model list fails to load.
• A failing model provider in headless mode now gives a one-line error instead of a traceback.
• The MCP tool's months setting is limited to 1-120.
• The plugin's server, hooks, /sota-sync and the skill all install from uv.lock (uv run --frozen).

Docs

• The README leads with what the tool is for: finding what shipped after the model's training.
• A new section, "What it sends and fetches", lists every network request and every file the plugin writes. There is no telemetry.
• README images now work on PyPI and in the plugin directory.

Compatibility

Tested on Python 3.11, 3.12, 3.13 and 3.14, on Linux and Windows.

v0.1.0

First public release.

sota-anchor checks what already exists before your coding agent builds it from scratch. When a plan assumes something isn't available (a library, a reader for a format only the vendor's software opens, a model capability), it searches the last year of papers (arXiv, Hugging Face), repositories (GitHub) and packages (npm, crates.io), and the agent weighs what comes back, with dates.

What's in it

• A Claude Code plugin: the check-what-exists skill, /sota-check, /sota-sync, and a session-start hook that adds a dated list of current model API IDs.
• An MCP server, sota-anchor serve, with the check_what_exists tool and the models://active resource, for Cursor, VS Code, Codex CLI, Gemini CLI, OpenCode and other MCP clients.
• A CLI: check, evidence, seed, sync and serve.

No API key is needed: your agent does the reasoning, sota-anchor does the retrieval.

Install

• Claude Code: /plugin marketplace add luckmanqasim/sota-anchor, then /plugin install sota-anchor@sota-anchor.
• Other agents: uv tool install git+https://github.com/luckmanqasim/sota-anchor, then register sota-anchor serve as an MCP server. The README has a snippet for each agent.