v2.2.0 - Current FuseBase APIs, safer auth and verified releases

Highlights

• 177 MCP tools (34 core, 143 extended), with current Gate/Dashboards discovery and updated official CLI integration for named environments, access principals, permissions and deployment contracts.
• Corrected page/database/SQL, portal, automation and AI Assistant workflows, with fresh read-back and exact-owned-fixture cleanup.
• Isolated named-profile credentials; bounded error redaction; no credential fallback replay after an uncertain write.
• Installable runtime with packaged authentication/guide helpers and no install-time downloads or source builds. Bounded HTTP sessions, external runtime storage and read-only container support.
• Source-aware dashboard evidence, browser checks and exact release-manifest/rendered-source verification. Expanded Windows/Linux, package, Docker, dependency and secret checks in CI.

Upgrade notes

• Requires Node.js 22.19 or later.
• Browser capture and reference-guide downloads are explicit opt-ins. In a source checkout, use npm run setup:browser and npm run guides:fetch when needed.
• Named profiles must provide their own credentials. Default-account cookies/tokens are no longer inherited.
• Token-only coverage remains partial; cookie/hybrid authentication is required for unsupported operations. Existing upstream permission limitations remain documented.

Install the attached package

Download fusebase-mcp-2.2.0.tgz and SHA256SUMS from this release. Verify the checksum, then run:

npm install -g ./fusebase-mcp-2.2.0.tgz

The CLI entry points are fusebase-mcp, fusebase-auth and fusebase-guides. This is a GitHub-distributed package; this release does not publish a new npm-registry package.

Verification

Pre-commit typecheck, lint, clean build, 541 unit tests and the tool/README audit passed. The isolated production-package stdio/HTTP/helper checks and package-content secret scan passed.

All 12/12 release-validation stages passed, including 1,686 live assertions and the final owned-fixture cleanup sweep. All 10/10 CI jobs passed for commit 28e2fe3d65666a66dbc6c90f6bc44903752503c8: Windows/Linux on supported Node versions, packed installation, nine dashboard browser scenarios, Docker, three dependency audits and secret scanning.

CI evidence: https://github.com/ryan-haver/fusebase-mcp/actions/runs/42660265378

The uploaded tarball was downloaded and its SHA-256 verified against SHA256SUMS.

Full changes: v2.1.0...v2.2.0

v2.1.0 — Measured token coverage, honest docs

v2.1.0 measures which tools work with FuseBase's official Gate and Dashboards tokens alone, fixes the silent wrong answers that measurement found, and brings the docs and status dashboard in line with what the tests actually prove.

There are no breaking changes. A few error behaviours changed; see Upgrade notes.

Token-only coverage, measured

The live suites can now run in a coverage mode (LIVE_TOKEN_COVERAGE=1). Every tool call goes first to a second server that has only the tokens and no session cookie. A write counts as working only when the suite reads the data back.

Result: 14 of the 129 tools exercised work with tokens only. The full per-tool results, and which gaps have an official route, are in docs/TOKEN-COVERAGE.md.

• Work with tokens: workspaces, listing and reading pages and folders, creating pages and folders, appending content, listing databases, isolated SQL stores, and triggering automation flows.
• Need a session cookie today: database schemas, rows, views and relations; renaming, moving and deleting pages; tasks; comments; tags; members and usage; automations; and most portal tools.

Run the report with npm run coverage:tokens. It replaces org hosts and ids with placeholders, so the output can be published.

Fixed

These tools reported success with wrong data in token mode:

• list_pages ignored the folder and returned the top-level pages instead.
• resolve_database_alias answered "not found" when it couldn't read the database list. It now reports the error.
• get_user_preferences and get_billing_info returned nulls when their requests failed. They now fail when every part fails, and name any failed parts in unavailable.

Two timing-sensitive unit tests no longer fail intermittently on a busy machine.

Honest docs and status

• Status dashboard: its test figures now come from real runs. test-all records each stage's outcome and counts, and the dashboard publishes only those, replacing the hand-written "passed" suites.
• fusebase://status resource: reports tool counts, checked against the registry by a unit test. It no longer returns invented assertion totals.
• README badges and headline claims: "100% parity" and "100% verified" are replaced with what the tests show, as are the token-mode sections in the README, AGENTS.md and the endpoint reference.
• Wording: docs now describe how the web-app integration was built in neutral terms.

Repository

• Layout: live suites now live in tests/live/, and the endpoint reference in docs/.
• New files: LICENSE (MIT), CONTRIBUTING.md, SECURITY.md and CHANGELOG.md.
• Guides: the FuseBase guides are no longer committed. npm install, npm run guides:fetch and the Docker build download them into .cache/guides.
• Package metadata: the plugin manifests name the maintainer and describe the server as unofficial, and package.json declares license and engines (Node ≥ 22.12).

Upgrade notes

• resolve_database_alias returns an error, rather than found: false, when it can't read the database list.
• get_user_preferences / get_billing_info throw when every underlying request fails. Partial results include unavailable.
• fusebase://status no longer has totalSuites or passedAssertions.
• Browser for cookie login: it's no longer downloaded on install. Run npm run setup:browser once if you use scripts/auth.ts or refresh_auth.
• Guides: after upgrading from a git checkout, run npm install or npm run guides:fetch so the guide tools have their content.

Validation

• Offline: typecheck, lint, build, 394 unit tests and the tool audit pass.
• Live: all live suites pass against a sandbox workspace, with every write proven by a fresh read and a clean leftover sweep.
• CI: Node 22 and 24.

Full changelog: v2.0.0...v2.1.0

v2.0.0 — Hardened, write-verified FuseBase MCP

v2.0.0 is a hardening release. It follows a full review of the server (remediation plan).

Every change was tested against a live FuseBase workspace. In the live suites, each write is now proven by reading the stored data back. That found several tools that reported success without storing anything, and they are fixed here.

⚠️ Breaking changes

• HTTP transport is locked down. It listens on loopback (127.0.0.1) by default. Listening on any other address requires MCP_AUTH_TOKEN, which clients send as a bearer token. Requests are also checked for an allowed Host and Origin (MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS).
• Saved credentials are re-encrypted. The first start migrates data/*.enc to a new random key, stored in data/.key or supplied as FUSEBASE_SECRET_KEY. It keeps a .legacy-bak copy of each file. Restart any server started before the upgrade, and keep the key: without it, the saved credentials can't be read.
• Docker image moved to Node 22. The image no longer bundles anything from data/; mount it as a volume.
• fusebase_cli_logs now maps to the CLI's remote-logs command. type: "dev" returns an error.
• get_org_trials no longer takes orgId; FuseBase never used it.
• move_page can return a different pageId. FuseBase recreates a moved page under a new id. Use the returned pageId, and check idChanged.

Fixed: tools that reported success without doing the work

Tool	Problem
move_page	Returned the old id, which no longer exists after a move. Moves "to root" were silently ignored; they now go to the top level.
publish_page_to_portal	Never published or unpublished: FuseBase ignored the field it sent.
update_page_content (replace)	Could leave behind content appended just before it.
add_database_row	Returned no row id when no values were given.
get_comment_threads	Returned comment counts only. It now returns each comment's text.
duplicate_database, create_view, search_tasks	Ignored title, the view type/grouping, and query.
fusebase_swarm_task_transition	Didn't store its audit comment or hand-over. It now writes both to the swarm board.
list_folders	Dropped subfolders.

Security

• Path traversal and CLI argument injection are fixed. Page content fetched into prompts is marked as untrusted.
• Error messages from FuseBase no longer pass on its internal request details.
• New 1Password support. Keep secrets in 1Password and start with op run --env-file=.env, or load a 1Password Environment with a read-only service account. See docs/1PASSWORD.md.

Reliability

• One request path for every API call: timeouts, a single shared session refresh, and truncated or HTML responses treated as errors, not data.
• No duplicate writes when a request fails over to Gate. No formatting bleeding between text runs.
• Page content survives a read → write round trip (tables, nested blocks, checklists).
• Page writes are confirmed against FuseBase before the tool reports success.
• The active profile is per session in HTTP mode.

Testing

• npm run hooks:install enables a gate. Each commit runs the offline checks (typecheck, lint, build, unit tests, tool audit). Each push also runs the live suites against a sandbox workspace, and every write must be proven by a read. A sweep then checks nothing was left behind. See docs/TESTING.md.
• CI runs the offline checks on Node 22 and 24.
• For this release, all seven live stages pass, and the Docker image was tested live.

Full change list: PR #2 and PR #3 · v1.0.0…v2.0.0

v1.0.0 — Enterprise FuseBase MCP Platform (175 Tools, Dual Transport & Docker)

Release v1.0.0 — Enterprise FuseBase MCP Platform

🌐 Interactive Architecture & Live Status Dashboard: fusebase-mcp.thefusebase.app
Searchable directory of all 175 tools, schema parameters, 17 test suite metrics, system architecture, and milestone chronology.

---

🌟 Overview

FuseBase MCP Server v1.0.0 is an enterprise-grade Model Context Protocol (MCP) platform enabling autonomous AI coding agents (Claude Code, Cursor, OpenAI Codex, Antigravity, Devin, Aider, OpenCode) and developers to programmatically control the entire FuseBase (formerly Nimbus Note) ecosystem.

This release establishes 100% feature coverage across collaborative Y.js documents, relational Kanban databases, client portals, ActivePieces automations, Gate PostgreSQL isolated stores, token lifecycles, and multi-agent swarm orchestration.

---

🚀 Key Highlights & New Capabilities

1. Universal Agent Guidance & Zero Context Clutter (AGENTS.md)

• Two-Tier System (34 Core vs 141 Extended): To protect agent context windows from schema pollution (~15,000–20,000 tokens), the server boots in Core Tier covering all everyday CRUD. Extended tools are unlocked dynamically on demand (set_tool_tier({ tier: "all" }) or FUSEBASE_TOOLS=all).
• Standardized Playbooks: Added AGENTS.md and CLAUDE.md instructing agents on zero-browser auth, token economics, table blocks vs dashboard databases, and safe handling of [DESTRUCTIVE] tools.

2. Dual-Transport Architecture (Stdio + Network HTTP/SSE)

• Stdio Transport (Default): Drop-in local pipe execution for desktop agent IDEs (node dist/index.js).
• Streamable HTTP / SSE Transport: Run as a standing network microservice (--transport sse --port 3000 or MCP_TRANSPORT=sse).
  • Includes /health status endpoint.
  • Per-session transport isolation with /sse and /message routing.
  • Permissive CORS headers for browser-based agents and web dashboards.

3. Docker Containerization (~150MB Lightweight Alpine)

• Multi-stage Dockerfile built on node:20-alpine.
• Non-root execution (node user) with persistent /app/data volume for credentials.
• Zero-install execution via Stdio (docker run -i --rm ...) or SSE (docker compose up -d).

4. Direct Gate & Dashboards Token Bridge (Zero-Browser)

• Connect directly to FuseBase Gate (https://gate-mcp.thefusebase.com/mcp) and Dashboards (https://dashboards-mcp.thefusebase.com/mcp) using FUSEBASE_GATE_TOKEN and FUSEBASE_DASHBOARDS_TOKEN.
• Automatically discovers tenant organization ID (orgId), custom domain host, and default workspace ID via upstream whoami.
• Fully autonomous: No Chromium dependencies or interactive browser captchas needed.

5. Full-Spectrum Platform Toolsuite (175 Tools)

• Pages & Documents: Real-time Y.js CRDT synchronization, non-destructive block appending (append_page_content), GitHub callout hint blocks, syntax highlighting, and Markdown conversion (get_page_content(format: "markdown") cuts tokens by ~50%).
• Relational Databases & Dashboards: Full table lifecycle, typed columns (Text, Progress, Select, Multi-select, Date, Rating, Checkbox, Number, Currency, Formula, Lookup), Kanban views, cross-table relations, and CSV import/export.
• Client Portals: Availability inspection, themes, navigation trees, client permission management, and 24h passwordless magic links.
• Workflow Automations: ActivePieces integration with 72 connector pieces, flow lifecycle, and test triggers.
• PostgreSQL Isolated Stores: Tenant SQL database provisioning, direct query execution, and migration bundle application.
• FuseBase Work, Firecrawl & n8n: Web scraping via hosted Firecrawl and n8n workflow triggers.
• Multi-Agent Swarm Orchestrator: Shared Kanban state machines for 6 agent roles (PM, Architect, Dev, QA, Review, DevOps).
• Native Resources & Prompts: 8 native MCP resources and 17 engineered workflow prompt templates.
• Offline Guides Catalog: 278 official FuseBase documentation guides indexed across 19 categories.

---

⚡ Quick Start

Option A: Docker (Zero-Install — Recommended)

Run locally via Stdio (for Cursor, Claude Desktop):

docker run -i --rm \
  -e FUSEBASE_GATE_TOKEN="your_token" \
  -e FUSEBASE_DASHBOARDS_TOKEN="your_token" \
  -e FUSEBASE_TOOLS="all" \
  fusebase-mcp:latest

Run as a standing Network SSE Service:

docker run -d --name fusebase-mcp -p 3000:3000 \
  -e FUSEBASE_GATE_TOKEN="your_token" \
  -e FUSEBASE_DASHBOARDS_TOKEN="your_token" \
  -e MCP_TRANSPORT="sse" \
  fusebase-mcp:latest
# SSE: http://localhost:3000/sse | Health: http://localhost:3000/health

Option B: Local Node.js

git clone https://github.com/ryan-haver/fusebase-mcp.git
cd fusebase-mcp
npm install && npm run build
node dist/index.js

---

🤖 Client Configuration Templates

Cursor IDE (.cursor/mcp.json)

{
  "mcpServers": {
    "fusebase": {
      "command": "node",
      "args": ["dist/index.js"],
      "env": {
        "FUSEBASE_GATE_TOKEN": "your_gate_token",
        "FUSEBASE_DASHBOARDS_TOKEN": "your_dashboards_token",
        "FUSEBASE_TOOLS": "all"
      }
    }
  }
}

Claude Desktop / Claude Code

{
  "mcpServers": {
    "fusebase": {
      "command": "node",
      "args": ["dist/index.js"],
      "env": {
        "FUSEBASE_GATE_TOKEN": "your_gate_token",
        "FUSEBASE_DASHBOARDS_TOKEN": "your_dashboards_token",
        "FUSEBASE_TOOLS": "all"
      }
    }
  }
}

Or via Claude Code CLI:

claude plugin add .

Docker Drop-in for Any Client

{
  "mcpServers": {
    "fusebase": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "FUSEBASE_GATE_TOKEN",
        "-e", "FUSEBASE_DASHBOARDS_TOKEN",
        "-e", "FUSEBASE_TOOLS=all",
        "fusebase-mcp:latest"
      ]
    }
  }
}

---

📊 Verification & Validation

Domain	Metrics	Status
Production Tools	175 Tools (34 Core, 141 Extended)	✅ 100% Verified
Automated Assertions	17 Test Suites, 212 Passed Assertions	✅ 100% Verified
Token vs Cookie Parity	11 Core Functional Domains	✅ 100% Verified
Transports	Stdio (Local) + HTTP/SSE (Network) + Docker	✅ 100% Verified
Live Engineering Dashboard	Hosted on FuseBase Cloud at fusebase-mcp.thefusebase.app	✅ Operational

---

Full Changelog: https://github.com/ryan-haver/fusebase-mcp/commits/v1.0.0