Release v0.3.3 · matthewhand/mcp-openapi-proxy

Release covering all changes since v0.2.1 (0.3.0–0.3.3 were developed but never tagged).

0.3.3

Strip path parameters from non-GET request bodies (was GET-only). Substituted
{path} placeholders were left in parameters for POST/PUT/PATCH/DELETE and leaked
into the JSON body, so strict APIs returned 400 — e.g. Home Assistant
POST /api/services/{domain}/{service} rejected the body carrying domain/service.
Now stripped for all methods. Regression test added.

Home Assistant example (examples/homeassistant.openapi.json +
examples/homeassistant-claude_desktop_config.json): generic REST slice
(get_config, list_states, get_state, list_services, call_service, get_history) with
named call_service body args. Auth via EXTRA_HEADERS="Authorization: Bearer ${HA_TOKEN}"
and SERVER_URL_OVERRIDE. Requires this release's fix for call_service.

FastMCP / simple mode (OPENAPI_SIMPLE_MODE=true) advertised the prompts and
resources capabilities but served empty lists. It now serves native MCP prompts
(summarize_spec, whimsical_blog) and the spec_file resource — at parity with the
low-level server. (Tools, prompts, resources all work in both modes now.)
FastMCP spec-serialization paths now use default=str, so specs with YAML datetime
example values (e.g. the apis.guru directory spec) no longer crash resources/read
with "Object of type datetime is not JSON serializable".

TDD: added simple-mode prompts/resources serve tests (not just advertise) and a
datetime-serialization regression test. Verified with a full permutation sweep —
both modes × {tools, prompts, resources} × {list, invoke} — all green.

Client matrix re-verified against the published 0.3.0 release (no flags, default-on
advertising), driving every available real client binary. Filled the previously
"unknown" cells with evidence:
- opencode surfaces tools + prompts + resources — the only client that does all three.
- Codex surfaces tools + resources (read_mcp_resource); no prompt mechanism.
- Kilocode tools + resources; Qwen tools + prompts (slash); Gemini tools
  (prompts/resources interactive-only); Vibe tools-only.
- Letta marked unknown — not testable headless (needs a running server + model).
No code changes; README is the PyPI long-description, so the corrected matrix ships to devs.

Prompts and resources are now advertised by default. ENABLE_PROMPTS and
ENABLE_RESOURCES default to true. Previously they defaulted to false, which —
per the MCP spec (a client won't call prompts/list/resources/list unless the
capability is advertised in initialize) — made prompts and resources invisible to
every client at once, despite being implemented and served correctly. Opt out with
ENABLE_PROMPTS=false / ENABLE_RESOURCES=false.

Regression test asserting the default handshake (no env flags) advertises prompts
and resources, not just tools.