v0.2.0

Added

• Every tool declares an outputSchema and answers with structuredContent
  beside the text block. A client no longer has to parse prose to use a result —
  which six of them made unavoidable, since they answered with a sentence. The
  sentence stays, in the text block, and so does query_search_analytics'
  rendered table: the rows themselves are now in the structured half.

  Every tool that reports Google's data carries untrusted: true and
  source: "search-console" as fields, not only as a preamble in the text. A
  search query is a string a member of the public typed into Google and a page
  title comes from the crawled site, so a client that reads the structured half
  must not get either unframed. Six tools are without the marker: their answer
  is a property this server was given and a fact it established.

• Tools that need a confirmation now ask the user, on clients that can show
  a prompt. The two-call confirm_token remains for clients that cannot, so
  nothing that works today stops working — but where a person can be asked, one
  is, instead of a token that only proves the same call was made twice.

• ELICITATION switches the dialog off — false sends a client that could have
  been asked down the two-call-token path instead. For a scheduled job or a test
  harness, where a dialog is the wrong shape rather than an unwanted one.

  It does not remove the guard: there is no setting in which a guarded call
  goes unannounced. Two deliberate rough edges come with it. The variable is
  not prefixed, so one export ELICITATION=false reaches every MCP server in
  the environment — which is why a server started with it off prints a line
  saying so, and why the fallback text names the server instead of blaming a
  client that was working fine. And a value that is neither true nor false
  stops the server: it is the only variable here that defaults to on, so
  failing open on a typo would leave the dialog running while the operator
  believed it was off. It is read after the credentials are wiped from the
  environment, so that exit cannot leave them behind.

• A docs/guide/approval.md page.

Changed

• The advertised schemas avoid spellings that are legal JSON Schema and still
  get a tool refused, or its constraint silently dropped, by some MCP clients:
  an open object now writes "additionalProperties": true rather than the
  empty schema {} zod emits for it; a value that was left untyped is declared
  as what it really is; and a nullable field is written as anyOf branches
  rather than "type": ["string", "null"], which several clients read as a
  single type and then drop. What the tools accept and return is unchanged;
  only the way the schema says so is.

• A result too large to shorten is now an error rather than an envelope saying
  so. The envelope was a different shape from what the tool declares it
  returns, which the SDK refuses.

• The two-call confirm_token prompt is an error result. What was asked for did
  not happen, which is what isError says. The text is unchanged and still
  carries the token.

• stdio is served through serveStdio, so the connection's era is negotiated
  on the opening exchange rather than assumed. A client that pins the
  2026-07-28 era is served it; until now its server/discover probe was
  answered with "Method not found" and only 2025-11-25 was on offer. A client
  that speaks the older era sees no change — it is still pinned to one instance
  for the life of the connection, exactly as a hand-wired
  StdioServerTransport served it.