v0.17.0

Minor release. Highlights:

• Copilot Studio agent authoring & Rovo evaluation/activity — a new capability area: agents, tools, topics, knowledge, evaluation test sets/cases/runs, activity/Monitor reads, and MCP connector creation, with source-guarded typed replacements and conservative, opt-in evidence projection.
• Per-tenant Dataverse token fix — token requests for a tenant's own *.dynamics.com org host are accepted, restoring the Dataverse-backed tool surface.
• HTTP500 evaluation-start diagnostics and a comment-only recorded-read contract on get_copilot_agent_activity.
• Trimmed the heaviest tool descriptions to cut the tools/list token cost with no change to any tool's behavior or schema.

Tool count 290 → 291. Full details in CHANGELOG.md.

v0.16.15

Token sign-in stability — full detail in CHANGELOG.md:

• The shared token store can no longer be emptied out from under a working sign-in ("No cached credentials" mid-session). An empty store read never wipes a healthy in-memory sign-in, and an account-less cache write is refused while the store still holds accounts other processes are using — deliberate sign-outs still pass through, and healthy paths cost no extra keychain prompts.
• The wizard and --login "clear cached credentials" step now actually clears the keychain/DPAPI store on macOS and Windows — previously it unlinked only the cache files, so stale or wrong-app tokens silently survived a re-setup.

This release also publishes the 0.16.14 notes (real Graph b! drive ids accepted, get_action_schema swagger $ref resolution, stopped clones, fast-uri 3.1.6 security floor).

Upgrade: quit your AI clients, then npm install -g powerautomate-mcp@latest.

v0.16.13

Connection-binding fixes — full detail in CHANGELOG.md:

• update_flow now declares the $connections workflow parameter when an update introduces the flow's first connector action — previously the save was rejected with InvalidTemplate and the flow had to be recreated.
• A source: "Invoker" connection reference no longer fails as "Missing connection" when the connection exists — logical connection names are resolved against the environment's actual connections before saving.
• Connection errors now name the environment they checked and list the connections that DO exist for that connector there, so an environment mismatch is obvious immediately.
• New validate_flow best-practice check: flows using embedded (direct) connections instead of connection references (solution ALM).

Upgrade: quit your AI clients, then npm install -g powerautomate-mcp@latest.

v0.16.12

[0.16.12] - 2026-08-16

• Bug fix — an action whose inputs is an array is no longer stored as an object. typeof [] === "object", and the preprocessor that fixes expression-bearing payloads spreads its argument into an object literal — so a Compose holding a literal list came back as {"0":"a","1":"b"}. create_flow reported success and the flow then failed at runtime with "the result of the evaluation of 'foreach' expression … is of type 'Object'. The result must be a valid array." Found while provisioning columns across 18 SharePoint libraries from a list held in a Compose. An array has no body/parameters to rewrite, so it now passes through untouched; update_flow's deep merge already guarded this, which is why only newly created flows were affected.
• Bug fix — a destructive tool called without confirm: true reported SUCCESS while doing nothing. The confirmation prompt was returned as ordinary text, so a refusal was indistinguishable from a completed delete: the MCP result carried no isError, and a script that deleted 59 SharePoint items and checked only that flag reported 59 deletions and performed none. All 36 refusals across 15 tools (delete_flow, delete_sharepoint_item, delete_environment, delete_powerapp, solution/connector/work-queue/Power Pages deletes, and the restore/reset/import gates) now raise a ConfirmationRequiredError, which is rendered verbatim so the prompt keeps the id you must confirm against. The interactive flow is unchanged — read the prompt, call again with confirm: true. delete_flow and delete_custom_connector also had their best-effort name lookup restructured: the prompt now names the flow or connector instead of falling back to the id.
• Bug fix — get_flow now tells you which connection a flow is bound to. A flow's connection reference carries three easily-conflated things: the reference key (shared_jira), the connector type, and the actual bound connection id (connectionName). Only the first two were reported, so "which connection is this trigger using?" could not be answered from the tool — during a live trigger outage the binding had to be read out of the maker portal by hand while the tool confidently displayed the connector name. connectionName (and source) now appear in both the structured output and the summary, which also makes read → rebind a round trip since it is exactly the field update_flow accepts back.
• Regression test — an explicitly requested environment now provably reaches the connections API URL. list_connections honouring its environment argument was fixed in 0.16.10, but the wire-level test only ever called the API with no argument, so it pinned the configured environment and would have stayed green through the original defect. Connections are environment-scoped, and getting this wrong answers confidently about the wrong environment.

v0.16.11 — sign in against your tenant, not /common

Two bug fixes, both from field reports:

The setup wizard now authenticates against the tenant you actually signed into. Silent token calls no longer go to the /common authority (which fails for some accounts even when the same sign-in works tenant-specifically), the wizard re-points itself at your tenant the moment sign-in reveals it, and post-sign-in failures surface the real Microsoft error instead of a misleading "resource may not be registered" message.

npm 12's install-script blocking no longer breaks secure token storage. If npm blocked keytar's install script, sign-in appeared to work and then everything reported "not authorized." Setup and --doctor now detect and repair this automatically — or install with the scripts allowed up front:

npm install -g --allow-scripts=@azure/msal-node-extensions,keytar powerautomate-mcp

Upgrade: quit your AI clients, then npm install -g powerautomate-mcp@latest. Full detail in CHANGELOG.md.

v0.16.10

• Bug fix — create_connection no longer produces connections that can never be signed in. The create body always sent connectionParameters and never connectionParameterSets, so for a connector publishing more than one authentication mode the service stored a connection with no auth mode attached. It looked fine — the tool reported "Connection created" and handed over sign-in instructions — but the portal's Fix connection then showed only the parameter form with an Update button and no consent step, so reconnecting looped forever. Field report: an Azure Key Vault connection created this way sat Unauthenticated through repeated reconnect attempts and had to be deleted and rebuilt by hand. Azure Key Vault, SQL Server and Azure Blob all publish parameter sets, so this was the general case rather than one connector's quirk. create_connection now takes parameterSet, sends the correct connectionParameterSets shape, auto-selects when a connector publishes exactly one mode, and refuses up front — naming the valid modes — rather than creating a dead connection. Connector metadata that can't be read is not treated as an error: those connectors fall back to the previous behaviour, so discovery can never become a new way for a working create to fail.
• Bug fix — list_connections ignored the environment argument. The tool validated environment, logged it, then called listConnections() with no argument, so the API always filtered on its own configured environment. Connections are environment-scoped, so the result was a confident answer about the wrong environment. Field report: list_connections({environment: <production>}) returned the DEFAULT environment's 82 connections — which read as "Jira is already connected in Production" when Production had none, and a flow migration was planned on the strength of it. The environment now reaches the API call and is validated like any other environment id; omitting it still uses the configured default. build_flow takes no environment parameter and is unaffected.
• Bug fix — validate_flow no longer reports "Unbalanced brackets" on valid index accessors. The pattern that finds bare @function() expressions ended in a greedy .*\), which backtracks to the LAST ) in the string — so anything closing after it was cut off. @variables('EinToCompany')?[outputs('Parse_EIN')] was captured as variables('EinToCompany')?[outputs('Parse_EIN') and then confidently reported as "Unbalanced brackets: missing ']'" on a flow that was valid and already deployed. A truncated capture is worse than none: it becomes a definite error about correct code. Expressions are now located by regex and terminated by a scanner that tracks paren/bracket depth, respects '' escapes inside string literals, and follows chained accessors (?['a'], .value, [0]) to the real end. Genuinely unbalanced expressions are still reported.
• Bug fix — a misspelled parameter no longer reports success while doing nothing. Tool inputs are validated with zod, which strips keys it doesn't recognize rather than rejecting them — so a parameter named slightly wrong was silently discarded and the tool cheerfully reported that it had done the work. Field report: update_flow was called with patchTrigger (the real name is trigger, and patchActions next to it makes the wrong name look right), the tool answered "Updated …", and the flow's trigger was never touched; the mistake only surfaced later when the schedule hadn't changed. Unknown top-level parameters are now rejected with an error that names the likely intended parameter ('patchTrigger' (did you mean 'trigger'?)) and lists the valid ones. Checked against each tool's published JSON Schema, so it needs no per-tool upkeep; nested objects — fields, data, a flow's trigger and actions — stay deliberately open-ended and are not policed.
• Bug fix — get_run_actions now surfaces the real error on failed actions. The platform's run-action records carry an error object for skipped actions (the runAfter noise) but leave it null for many genuine connector failures — so the one action that actually failed reported error: null while the AI had to dig the real 400 out of the raw outputs. Failed actions with no platform error now derive one from the already-fetched outputs ([HTTP 400] …the vendor's actual message…), platform-provided errors are untouched, and the summary line now counts skipped actions separately.
• Bug fix — no more macOS keychain password prompt on every tool call. The token cache was re-read from the keychain on every single tool call, and macOS prompts for each read when the Node binary isn't on the keychain item's approval list (Node upgrades reset that, and "Always Allow" often doesn't stick for Homebrew's Node). Two-part fix: the server now re-reads the keychain only when your sign-in actually changed (a shared marker file signals it — in-chat sign_in still propagates instantly), and a new powerautomate-mcp --fix-keychain command rebuilds the keychain entry under your current Node with one final approval, after which reads and writes never prompt again. Rerun it after Node upgrades if prompts return. PA_MCP_TOKEN_CACHE_SYNC=always restores the old eager behavior.
• Bug fix — connector actions that take an object parameter save again. Some connector operations declare a parameter as an object rather than a string — Files.com's Move File or Folder takes a { destination } body, for example. When such a parameter contained an expression, the rewrite that keeps expressions out of object payloads emitted string interpolation (@{json(...)}), whose result is a String. Power Automate type-checks connector parameters against the connector's definition when the flow is saved, so it refused the flow outright: "Input parameter 'body' validation failed … type/format 'String' is not convertible to type/format 'Object'." Connector parameters now use the bare @json(...) form, which keeps the declared object type while still being the single expression that avoids object-level evaluation at save time. HTTP action bodies are untouched, and the runtime JSON-escaping of every substituted value is unchanged.

v0.16.9 — Power Pages bug fixes

Provisioning no longer reports false failures (operation polls now carry api-version), and site/component tools survive tenants whose mspp_* virtual tables error on retrieve-by-key.

See CHANGELOG.md · Install: npm install -g powerautomate-mcp@latest

v0.16.8 — errors that name the real problem

Power Pages permission failures (the API's D004) now say a role grant is needed instead of "Authentication failed"; InvalidApiVersion names your installed version and gives the exact update command; --setup --client skip works as documented for scripted setups.

See CHANGELOG.md · Install: npm install -g powerautomate-mcp@latest

v0.16.7 — switch environments mid-chat + update notices

switch_environment (227 → 228 tools): work across dev/test/prod without leaving the chat — switch by environment name or ID and every tool re-points, including Dataverse. Session-only: nothing is written to your configuration, and while switched every destructive tool's output names the active environment.

You'll hear about new versions in chat: a one-line note once per session with the exact update command. Org-managed machines stay quiet; PA_MCP_UPDATE_NOTICE=0 disables anywhere.

Under the hood: better-sqlite3 13 (bundled prebuilds — no compiler ever), msal-node 5.4.3, MCP SDK 1.30.

See CHANGELOG.md · Install: npm install -g powerautomate-mcp@latest

v0.16.6 — Dataverse depth: 227 tools

Eleven new Dataverse tools (216 → 227): FetchXML aggregates and joins, option-set and relationship schema lookups, schema write (columns + lookups), $batch with changesets, alternate-key upsert, row assignment, N:N/1:N association, and full-text relevance search — plus categorized Dataverse errors, background sign-in renewal, auth errors that name the real cause, and a new Rolling back guide in INSTALL.md.

See CHANGELOG.md for details.

Install: npm install -g powerautomate-mcp@latest