v0.1.0

Added

• Initial release: an MCP server for ntfy, covering
  publishing, reading the message cache, and user and topic-access
  administration.
• A multi-architecture container image at ghcr.io/ni-c/ntfy-mcp
  (amd64 and arm64), published with an SBOM and build provenance. It runs as
  an unprivileged user with no npm in the runtime layer and speaks stdio
  only, so it needs -i and exposes no port.
• Thirteen tools. Six read: list_messages, get_message,
  check_topic_access, get_server_info, get_account, list_users. Seven
  write: publish_message, update_message, mark_messages_read,
  delete_messages, create_user, delete_user, manage_user_access.
• NTFY_ALLOW_TOOLS and NTFY_DENY_TOOLS narrow the tool list by name or by a
  trailing-* prefix, and NTFY_ALLOW_TOOLS=essential selects a curated six
  that cover publishing and verifying end to end.
• NTFY_TOPICS names the topics the server may touch. The first entry is the
  default when a tool omits one, which keeps a topic name — a bearer secret on a
  public instance — out of the tool arguments; the list also bounds every read
  and write tool.
• Basic authentication (NTFY_USERNAME / NTFY_PASSWORD) alongside access
  tokens (NTFY_TOKEN), because ntfy user add produces a username and
  password rather than a token. Setting both forms is refused at startup rather
  than resolved by a precedence rule.

Security

• NTFY_READ_ONLY defaults to false, unlike the same variable in
  imap-mcp, where it defaults to true.
  ntfy exists to publish; a read-only default would ship a notification server
  that cannot notify. Because of that direction, only the literal string true
  disables the write tools — a typo leaves them enabled. The destructive tools
  are gated behind confirmation tokens and ntfy's own permissions instead, and
  NTFY_ALLOW_TOOLS=essential or a NTFY_DENY_TOOLS list is the recommended
  hardening.
• delete_messages, delete_user and manage_user_access require a
  server-generated confirmation token bound to a fingerprint of the exact
  target, so a confirmation for one target cannot execute another or a longer
  list.
• Access tokens are removed from get_account output. ntfy returns every token
  of the account in plaintext there, which would otherwise put a live credential
  into the conversation transcript. The account's sync_topic is removed for the
  same reason — a topic name is a bearer secret.
• click, icon, attach and every action button URL are restricted to
  http: and https:. ntfy stores whatever it is given, and these URLs are
  opened by the recipient's device rather than by the server.
• Publishing cannot send email or place a phone call, and no tool creates,
  reads or exchanges an ntfy access token.