Repository navigation
Releases
v0.7.3 — fix one-time secret loss in or_key_create
Fixed
`or_key_create` was silently dropping the new key's one-time secret. OpenRouter's `POST /keys` returns `{data: {…}, key: "sk-or-v1-…"}` with the secret as a sibling of `data`, but the client's auto-unwrap returned `payload.data` and discarded the rest. Every key created through the MCP produced an unrecoverable secret.
Changes
- Add `RequestOptions.noUnwrap` (default false). When set, `client.request` returns the full payload as-is.
- `or_key_create` opts in and reads `data` + `key` separately.
- Existing test mocks nested `key` inside `data` (wrong shape) so CI never flagged the bug. Fixed both, plus two new client-level tests: noUnwrap envelope works, default-unwrap trap is documented.
84 → 86 unit tests.
v0.7.2
v0.7.1
v0.7.0
v0.6.0
v0.5.0
v0.4.0
v0.3.0
feat: v0.3.0 — write tools opt-in (security), Biome lint, fix Node 18 CI failure
Security: destructive write opt-in
or_key_create / or_key_update / or_key_delete are no longer registered by
default. Set OPENROUTER_ADMIN_ALLOW_WRITE=1 to enable. Rationale: prevents
accidental key mutation through prompt-injected tool calls when only read
access is intended. Read tools (or_overview, or_credits, or_current_key,
or_keys_list, or_key_get, or_activity) are unchanged and always available.
Server logs the active mode at startup:
openrouter-admin-mcp running on stdio (write tools: ENABLED|disabled)
Lint: Biome
Added @biomejs/biome as the linter+formatter. Auto-fixed import sorting +
template-literal style across the codebase. New scripts: lint, lint:fix,
format. prepublishOnly now runs lint → build → test.
CI: fix Node 18 startup error, add lint step
vitest 4.x's bundled rolldown imports node:util.styleText (Node ≥20.12),
which broke the Node 18 matrix. Dropped 18 from the matrix and bumped
engines.node to >=20.18 to match reality. CI workflow now runs
lint → build → test on Node 20 and 22.
Tests
42 → 45. New test/registration.test.ts covers the opt-in matrix
(default, allowWrite=false, allowWrite=true).
Registry
server.json bumped to 0.3.0; OPENROUTER_ADMIN_ALLOW_WRITE documented as an
optional, non-secret env var.
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com