v2.27.0

Pi MCP Adapter 2.27.0 makes server setup more flexible and long-lived MCP sessions more reliable. Packages and extensions can now provide MCP servers without asking users to hand-edit config files, and static bearer tokens can use the OS credential store. OAuth flows clean up after themselves more reliably, and remote keep-alive sessions handle slow refreshes and reconnects with fewer false failures. The release also trims repeated work in search, cache writes, stream pruning, and panel rendering.

Highlights

• MCP servers can now come from packages, runtime extension APIs, or the usual config files.
• Static bearer tokens can use the OS credential store, with a stdin-only CLI for safer token management.
• Long-lived sessions recover better when remote MCP servers are slow, refreshed, or reconnected.
• OAuth flows clean up their callback listener when idle and work better inside nested terminal UI prompts.
• Search, metadata cache writes, direct-tool counts, and UI stream pruning now do less repeated work.

Highlights

• MCP servers can now come from packages, runtime extension APIs, or the usual config files.
• Static bearer tokens can use the OS credential store, with a stdin-only CLI for safer token management.
• Long-lived sessions recover better when remote MCP servers are slow, refreshed, or reconnected.
• OAuth flows clean up their callback listener when idle and work better inside nested terminal UI prompts.
• Search, metadata cache writes, direct-tool counts, and UI stream pruning now do less repeated work.

Added

• /pi-mcp now works as an alias for /mcp when a host reserves /mcp. Thanks to @inxeoz for #391.
• registerMcpServer({ pi, name, definition }) lets other extensions register and dispose session-scoped MCP servers at runtime. Registrations are proxy-tool-only, never persisted, and duplicate names fail closed. Thanks to @bendavis78 and @fmoda3 for the runtime API request in #376/#382.
• Pi packages can ship prefixed MCP server definitions with pi.mcp manifest entries, without asking users to edit MCP config files. Thanks to @bendavis78 for #376 and @fmoda3 for the manifest design.
• Static bearer tokens can opt into OS credential-store lookup with URL-bound records by setting bearerTokenStore: true. The new pi-mcp-adapter token set|status|remove <server> CLI reads tokens from stdin and never accepts a token as an argument. Thanks to @AlexanderBartash for issue #366.

Changed

• Search ranking now reuses normalized MCP tool fields and keyword tokens per catalog.
• Per-request header commands collect process cleanup data in one snapshot per pass, reducing cold HTTP connect overhead.
• Metadata cache saves write compact JSON while preserving atomic replacement and cross-process merges.
• High-frequency UI stream event-log pruning tracks the latest checkpoint event ID instead of rescanning retained patches.
• The MCP panel reuses direct-tool counts and token totals across renders while keeping toggle and reconnect updates immediate.

Fixed

• Short-lived mcpScript workers no longer emit false unmanaged file-descriptor warnings on Node 24. Thanks to @blalor for PR #407.
• OAuth callback listeners are released after idle auth flows, and MCP pickers stay hidden while nested OAuth input is active. Thanks to @trevorleibert-mixpanel for PRs #403 and #404.
• Request-header command cleanup can scan large process lists without overflowing spawnSync's 1 MiB default buffer, which previously caused spurious HTTP request headers command cleanup failed: ps exited with code unknown refresh failures on busy hosts. Thanks to @rtfpessoa for PR #399.
• Slow but healthy remote keep-alive servers are no longer marked failed when a bounded tools/list refresh times out. Thanks to @brightmeowso for #400.
• Cached metadata reconstruction now reuses one selector candidate index, avoiding repeated scans of large cached catalogs at startup.
• MCP status consumers no longer see a connected catalog before Pi's model-facing tool surface is current. The first connected status snapshot now waits for direct-tool synchronization. Thanks to @dmorn for PR #380.
• JSON-string MCP tool-call arguments are normalized before approval and transport, preserving all fields and embedded quotes. Thanks to @sebbean for PR #377.
• Session tool approvals are scoped to the approved argument payload instead of every later call to the same tool. Thanks to @spaceshipmike for #367.
• MCP panel commands no longer hang in RPC, JSON, and print modes when terminal-only custom UI is unavailable. Thanks to @shixin-guo for PR #365.
• Compact MCP rows now show a bounded tool-input preview and skip leading blank output lines in collapsed result previews.
• MCP gateway requests nested inside proxy args are recovered instead of silently showing status, and invalid nested gateway requests now fail with guidance. Thanks to @ibrmora for #363.
• Remote keep-alive tool catalogs refresh before user input, adapter-triggered turns, and health checks. Expired Streamable HTTP sessions reconnect so long-lived Pi sessions can discover replacement catalogs without restarting. Thanks to @dmorn for #369 and PR #370.