UVCS MCP 1.4.1

UVCS MCP 1.4.1

UVCS MCP 1.4.1 publishes the server to the official MCP Registry as io.github.ProAnima/uvcs-mcp. MCP clients and directories that read the registry can now find and install it. The server, its tools, and its behavior are unchanged from 1.4.0.

MCP Registry

• server.json describes the npm package @proanima/uvcs-mcp, its stdio transport, and the environment variables a client should ask for: UVCS_WORKSPACE (required), UVCS_MCP_MODE, UVCS_ALLOWED_WORKSPACES, UVCS_ALLOWED_REPOS, and UVCS_CM_PATH.
• package.json declares the matching mcpName, which the registry checks in the published package.
• Releases publish the registry entry automatically: the Publish workflow waits until npm serves the new version, verifies a pinned mcp-publisher with Sigstore, and publishes through GitHub OIDC.

Release tooling

• npm run release:check and a test fail when server.json drifts from package.json (name, versions, npm identifier, description length, icon, documented environment variables).
• The npm job skips npm publish when the version already exists, so the workflow can be re-run after a failed registry step.

Documentation

• docs/configuration.md describes UVCS_CHECKIN_MAX_FILES for path-scoped checkins and lists checkout and release checkout among the write timeouts.
• docs/publishing.md documents the registry job and how to check the entry.

Quality gate

• 171 automated tests (one POSIX-only test skipped on Windows), ESLint, syntax validation, release metadata check, fake and fleet smoke flows, and the packed-tarball smoke.
• server.json validated against the official schema and with mcp-publisher validate against the registry.

Upgrade

No action is needed for existing installations. To pin the new version:

npx -y @proanima/uvcs-mcp@1.4.1 init --client=claude-code --workspace="D:/Repositories/YourWorkspace" --safety=guarded

See the changelog and the publishing guide.

UVCS MCP 1.4.0

UVCS MCP 1.4.0

UVCS MCP 1.4.0 lets agents understand repository history, review branches, preview merges, check in only the files of a task, and lock Unity assets before editing them. It ships an agent skill that teaches Claude Code, Codex, Cursor, OpenCode, and other SKILL.md agents to use these tools. It also fixes three issues that affect every earlier release, so upgrading is recommended.

Fixes

• uvcs_diff_file no longer starts the GUI diff tool. In 1.3.0 and earlier it ran cm diff <path>, which opened a diff window on the user's desktop and hung until the read timeout. It now returns a unified diff of the loaded revision against the file on disk. The result has a diff field instead of the raw cm output.
• uvcs_merge no longer leaves a conflicting merge in progress. Prepare runs the merge preview and refuses merges with conflicts (MERGE_HAS_CONFLICTS); confirm checks again.
• Checkin tokens bind the size and modification time of the files. Editing an already changed file after prepare used to go into the checkin unreviewed; now the confirm is refused with WORKSPACE_CHANGED_SINCE_PREPARE.
• uvcs_changeset_analytics sends dates as ISO yyyy-MM-dd; the previous form was rejected on some locales.

History, review, and merge preview

All read-only, in every safety profile:

• uvcs_changeset_diff: what changed in a changeset, label, shelve, or branch, or between two changesets or labels, with Unity .meta pairing warnings.
• uvcs_revision_diff: the line diff of one file for a changeset, between revisions, or against the workspace copy.
• uvcs_file_history and uvcs_annotate: who changed a file or a line, and when.
• uvcs_branch_list and uvcs_label_list: find branches and labels by name, owner, date, parent, or branch.
• uvcs_merge_preview: files a merge would bring and items that would conflict, into the workspace or into any branch on the server.

Checkin by path and exclusive checkout

• uvcs_checkin_prepare accepts paths. Selected Unity assets bring their .meta files along, assets whose .meta is still private are refused (UNITY_META_NOT_ADDED), and new parent folders a change needs are listed as dependencies.
• uvcs_checkout checks files out and takes the exclusive lock when the server's lock.conf covers them. Files locked by someone else are refused.
• uvcs_release_checkout releases checkouts of unchanged files; modified files keep their checkout and edits.
• uvcs_locks accepts paths and a scope (all, user, workspace).

Agent skill

• uvcs-mcp skill install copies the uvcs-version-control skill into Claude Code (.claude/skills), the shared .agents/skills folder (Codex, Cursor, OpenCode, Gemini CLI), and other agent folders, for the user or a project.
• npm run pack:skill validates the skill and builds a marketplace ZIP.

Safety

• Item paths containing * or ? are rejected, because cm expands wildcards itself.
• zod 4.6.7 and transitive dependency updates; npm audit reports zero known vulnerabilities.

Quality gate

• 169 automated tests (one POSIX-only test skipped on Windows), ESLint, syntax validation, and mutation checks of the key safety guards.
• Fake single-workspace and fleet MCP smoke flows, including checkout, release checkout, path-scoped checkin, and the history tools.
• npm run smoke:pack installs the packed tarball, starts the installed server, and checks that the skill is shipped.
• Live validation with cm 10.0.16.6656 on a self-hosted server: the Plastic SCM smoke and a 37-check write scenario on a disposable repository (path-scoped checkins, .meta pairing, moves into new folders, deletes, checkout and release, a real merge conflict), and the read-only history tools on a production repository.
• Not covered live: exclusive locking through a lock.conf rule, and the new commands on cm 11.x clients.

Upgrade

npx -y @proanima/uvcs-mcp@1.4.0 init --client=claude-code --workspace="D:/Repositories/YourWorkspace" --safety=guarded
npx -y @proanima/uvcs-mcp@1.4.0 doctor --workspace="D:/Repositories/YourWorkspace"
npx -y @proanima/uvcs-mcp@1.4.0 skill install

Restart the MCP client after upgrading. Clients that parsed the stdout of uvcs_diff_file should read diff instead. See the changelog, the agent skill guide, and the security model.

UVCS MCP 1.3.0

UVCS MCP 1.3.0 is a hardening release. It closes an option-injection gap in path-scoped writes, makes cm execution reliable on Windows and with non-ASCII paths, and makes first-time setup work without manual fixes. Upgrading is recommended for every installation that uses the standard or guarded profile.

Security

• Paths, branch names, and labels that start with - are rejected. In 1.2.x an item path such as -r reached cm undo as an option, which could widen uvcs_undo to a recursive undo of the workspace root.
• @modelcontextprotocol/sdk 1.32.1 and zod 4.6.5; npm audit reports zero known vulnerabilities.
• Every tool carries MCP annotations, so clients can auto-approve read-only tools while keeping manual approval for *_confirm tools. The server also sends instructions describing the prepare → approval → confirm workflow.

Reliability

• Cyrillic and other non-ASCII paths and comments from cm are decoded correctly on Windows (OEM/ANSI code pages are detected automatically; UVCS_CM_OUTPUT_ENCODING overrides).
• cm never waits for interactive input, and timeouts terminate the whole process tree before the write lock is released.
• Private and ignored files no longer block switch or merge or count toward the checkin limit.
• The current branch and repository identity come from cm wi, which also works while the server is unreachable.
• Write locks use a heartbeat and recover immediately from crashed processes.

Setup

• init writes project configs into the workspace (or --project-dir), detects the absolute cm path, uses cmd /c npx on Windows only for clients not confirmed to resolve npx.cmd, validates every target before writing, keeps timestamped backups, and never prints other servers' settings.
• doctor distinguishes a wrong workspace path from a missing cm.
• Node.js 22 or newer is required.

Quality gate

• 135 automated tests (one POSIX-only test skipped on Windows), ESLint, and syntax validation.
• Fake single-workspace and fleet MCP smoke flows with real pending-change tracking.
• npm run smoke:pack installs the packed tarball into a clean project and starts the installed server.
• CI on Ubuntu, Windows, and macOS with Node.js 22, 24, and 26.
• Read-only live validation on Plastic SCM 10.0.16.6656: doctor, status with Cyrillic paths, locks, changeset analytics, branch detection for branch- and changeset-loaded workspaces, and offline repository detection.

Upgrade

npx -y @proanima/uvcs-mcp@1.3.0 init --client=claude-code --workspace="D:/Repositories/YourWorkspace" --safety=guarded
npx -y @proanima/uvcs-mcp@1.3.0 doctor --workspace="D:/Repositories/YourWorkspace"

Restart the MCP client after upgrading. See the changelog, configuration reference, and security model.

UVCS MCP 1.2.1

UVCS MCP 1.2.1 is a production patch release for dependable guarded multi-workspace operation with real Plastic SCM workspaces.

Fixed

• Guarded repository identity parsing now correctly removes Plastic status suffixes such as (cs:… - head) and (head:…). Valid workspaces with local pending changes no longer fail repository allowlist checks.
• JSONL audit logs now create their parent directories automatically, making per-workspace audit paths in fleet manifests work without manual preparation.
• Cursor MCP configuration directories are kept local and excluded from source control.

Live fleet validation

• Validated four guarded, repository-pinned Plastic SCM workspaces through uvcs-mcp doctor --manifest=....
• Created a test branch independently in all four workspaces through the MCP prepare/confirm workflow.
• Confirmed each target requires its own explicit workspace selector and has separate audit logging.

Quality gate

• 70 automated tests passing.
• ESLint and Node syntax validation passing.
• Production dependency audit: zero known vulnerabilities.
• Single-workspace and two-workspace fleet smoke tests passing.

Upgrade

npx -y @proanima/uvcs-mcp@1.2.1 init --client=cursor,codex --manifest=workspaces.json
npx -y @proanima/uvcs-mcp@1.2.1 doctor --manifest=workspaces.json

Restart the MCP client after upgrading. See the multi-workspace guide, security model, and production-readiness checklist.

UVCS MCP 1.2.0

UVCS MCP 1.2.0

UVCS MCP 1.2.0 makes safe agent-assisted source-control work practical across both one project and fleets of Plastic SCM / Unity Version Control workspaces.

Highlights

• One MCP process can serve up to 50 named workspaces from a fleet manifest.
• Every fleet tool call uses an explicit workspace selector.
• Workspace policies, repository allowlists, confirmation tokens, audit logs, and write locks remain isolated.
• readonly, guarded, and standard safety profiles make setup intent explicit.
• uvcs-mcp doctor --manifest=... validates every configured workspace before client restart.
• Guarded setup can detect repository/server identity from real Plastic workspace status.
• Naming, checkin, and release rules can be initialized per workspace or inherited from a shared policy.
• Path-scoped uvcs_undo_prepare / uvcs_undo_confirm adds controlled undo without exposing whole-workspace undo.

Reliability and security

• Confirmation tokens are short-lived, single-use, action-scoped, and workspace-bound.
• Switch, merge, update, undo, and checkin revalidate workspace state after prepare.
• Writes are serialized across requests and MCP processes.
• Workspace paths are canonicalized and protected against escape.
• Read and write timeouts are separate, and process output is bounded.
• Runtime dependencies are pinned and production audits are enforced in CI and publishing.
• Codex TOML setup safely replaces an existing MCP server and descendant environment tables.

Setup

One workspace:

npx -y @proanima/uvcs-mcp@1.2.0 init \
  --client=cursor,codex \
  --workspace="D:/Repositories/YourWorkspace" \
  --safety=guarded

npx -y @proanima/uvcs-mcp@1.2.0 doctor \
  --workspace="D:/Repositories/YourWorkspace"

Multiple workspaces:

npx -y @proanima/uvcs-mcp@1.2.0 init \
  --client=cursor,codex \
  --manifest=workspaces.json

npx -y @proanima/uvcs-mcp@1.2.0 doctor \
  --manifest=workspaces.json

Validation

• 70 automated tests.
• Full single-workspace MCP smoke workflow.
• Parallel two-workspace fleet smoke with independent naming rules and branches.
• Dependency audits with zero known vulnerabilities.
• npm package dry run.
• Read-only live validation on Plastic SCM 10.0.16.6656.

Upgrade notes

• Existing single-workspace configurations remain supported.
• Fleet mode is opt-in through UVCS_FLEET_MANIFEST.
• Existing standard configurations continue to work; guarded is recommended for production writes.
• Restart the MCP client after upgrading.

See the multi-workspace guide, security model, and production-readiness checklist for operational details.

v1.0.0

First production release line. This release keeps the safe MCP surface from 0.3.0, adds static analysis and publish automation, and formalizes the 1.x support and security posture.

Added

• ESLint static analysis with npm run lint.
• Release metadata validation with npm run release:check.
• GitHub Actions npm publish workflow using trusted publishing/OIDC and provenance.
• Security review notes covering path confinement, confirm-token replay, environment handling, command construction, and destructive-operation policy.
• 1.x production readiness documentation and npm publishing runbook.

Changed

• CI now runs tests, lint, syntax checks, release metadata checks, fake MCP smoke, and npm pack dry-run across Ubuntu and Windows on Node.js 20, 22, and 24.
• The project is now documented as the stable 1.0.x release line.

Tested

• npm test: 43 tests passing.
• npm run lint.
• npm run check.
• npm run release:check.
• npm run smoke:fake.
• npm pack.

Local artifact

• npm tarball prepared locally: proanima-uvcs-mcp-1.0.0.tgz
• SHA256: F050026EC77CF4B346E940E584111C0ADAFF129EEAFF8F20B348CBB943092A72

0.2.0

First stable 0.2.x release.

• Supported cm range: 10.0.16.6656 and newer, including Unity Version Control 11.x
• No functional changes from 0.2.0-alpha.1; compatibility validated in live workspaces

See CHANGELOG.md for details.