v0.15.1

Security

• @modelcontextprotocol/sdk floor raised to ^1.32.1, and patched
  transitive dependencies. The SDK range was ^1.30.0, which still admitted
  1.30.0 and 1.30.1, inside the range of a high-severity advisory for
  1.12.0 to 1.30.1; installs now resolve 1.32.1 or later. The lockfile also
  moves proxy-addr to 2.0.8 (critical advisory on 1.1.0 to 2.0.7),
  ip-address to 10.7.4 and source-map-js (development only); npm audit
  reports no vulnerabilities. The schema wrapper of #189 was tested on SDK
  1.30.0 and 1.32.1.

Fixed

• Tool schemas are JSON Schema 2020-12, so clients that accept only 2020-12
  accept them (#189). Up to 0.15.0, every inputSchema and outputSchema on
  tools/list said "$schema": "http://json-schema.org/draft-07/schema#",
  because @modelcontextprotocol/sdk 1.x converts zod schemas without a
  target and its converter then falls back to draft-07
  (modelcontextprotocol/typescript-sdk#2084, open on 2026-10-11; checked on SDK
  1.30.0 and 1.32.1). MCP 2025-11-25 makes 2020-12 the default dialect, and a
  client whose validator accepts only 2020-12 refused every tool of this
  server with "JSON Schema declares an unsupported dialect (draft-07)", the
  error reported in #189. That message comes from the validator of
  @modelcontextprotocol/client 2.0.0-alpha.4 to 2.0.0-beta.5: run on all 22
  schemas, it rejected each one served by 0.15.0 and accepts each one served
  now. registerMemoryTools now wraps the SDK's tools/list handler: each
  tool's schemas are converted again with the SDK's own converter and
  target: "draft-2020-12", and the $schema key is left out, which under the
  spec means 2020-12. Without the key, a client that validates with a draft-07
  Ajv instance still compiles the schemas; with the 2020-12 URI, a default
  new Ajv() cannot. The schema bodies are byte-identical to 0.15.0's (same
  fields, types, required lists and limits), so nothing a caller sends or
  receives changes; only the dialect declaration goes. The wrapper covers
  every tool on the server. It reads parts of the SDK that are not documented
  API (two converter modules, loaded with a dynamic import(), and
  McpServer._registeredTools): if a later SDK 1.x does not have them, the
  server still starts, tools/list returns the SDK's own draft-07 schemas as
  0.15.0 did, and one line on stderr says why. /shared also exports the wrapper as
  serveToolSchemasIn2020_12(server), for a server that registers tools
  without registerMemoryTools; it has to run before the first tool is
  registered, and registerMemoryTools throws if a tool was registered before
  it (docs/shared.md).

Changed

• The privacy policy URL is the documentation's policy itself.
  privacy_policies in the extension manifest, mcpb.privacyPolicies in
  src/configs/source.json and the Privacy Policy row of the README now give
  https://mnemoverse.com/docs/legal/privacy-policy. Mnemoverse keeps one
  privacy policy there, and mnemoverse.com/privacy is becoming a 301 to it;
  a directory reviewer should not have to follow a redirect, for the same
  reason as in 0.8.3 (#78). The manifest change reaches users with the next
  .mcpb release.

Documentation

• Continue is gone from the install instructions. Continue was acquired by
  Cursor and closed (continue.dev, read 2026-10-07). The README block, the
  docs/snippets/continue.md partial and its generator are removed; the other
  clients' snippets are unchanged.

• npm: https://www.npmjs.com/package/@mnemoverse/mcp-memory-server

• MCP Registry: https://registry.modelcontextprotocol.io/v0.1/servers?search=mnemoverse

What's Changed

• ci: daily check that every packaged form is in sync (packaging plan 2.2) by @izgorodin in #207
• docs: remove Continue from the install instructions by @izgorodin in #208
• docs(privacy): the privacy policy URL is the documentation's policy directly by @izgorodin in #209
• fix: tool schemas use JSON Schema 2020-12 (fixes #189) by @izgorodin in #210
• release: 0.15.1 by @izgorodin in #211

Full Changelog: v0.15.0...v0.15.1