v1.0.0 — Multi-format rendering + enterprise security hardening

v1.0.0 — Multi-format rendering + enterprise security hardening

New features

• Multi-format output — render_echart now emits SVG, PNG, and/or self-contained interactive HTML in a single call, selected via the formats argument (default ["svg"]).
  • svg — raw vector text (zero native dependencies).
  • png — base64 image block via the optional @napi-rs/canvas dependency.
  • html — a self-contained interactive page (pinned echarts@6.1.0 CDN).
• URL export seam — exportToUrl persists a rendered artifact and returns a public URL (configure via MCP_EXPORT_DIR + MCP_EXPORT_BASE_URL), for chat-platform targets.

Security hardening

• SSRF deny-by-default — remote image:// fetches are rejected unless hostlisted via MCP_IMAGE_ALLOW_HOSTS / security.imageAllowHosts.
• Bounded inputs — option/theme depth (≤ 64) and node count (≤ 100k) guards; pixel budget and maxImageBytes caps.
• Render timeout — per-image-load AbortSignal timeout.
• Constant-time auth — SHA-256 + timingSafeEqual bearer-token compare.
• HTML script-breakout fix — safeJson escaping prevents </script> injection via the embedded option.
• Non-root container — USER nodejs in the Dockerfile.

Testing & docs

• New test:security, test:stress, test:leak, test:enterprise suites (42 tests).
• New SECURITY.md threat model with implemented controls and residual risks.
• Refreshed README.md, SKILL.md, and VERIFICATION.md.

Full changelog: v0.1.2...v1.0.0

v0.1.2 — Agent Skills support

v0.1.2 — Agent Skills support (.agents/skills standard)

Ship one skill that every major AI tool auto-discovers.

What's new

• Canonical Agent Skills file at .agents/skills/echarts/SKILL.md — the cross-tool standard location (agentskills.io) scanned by Claude Code, OpenCode, Codex, Antigravity, Cursor, and others.
• install-skills command — npx @ryuk3nd0/echarts-mcp install-skills copies the skill into each tool's personal discovery directory:
  • Claude Code: ~/.claude/skills/echarts/
  • OpenCode: ~/.config/opencode/skills/echarts/
  • Codex / Antigravity / Cursor: ~/.agents/skills/echarts/ (shared standard)
• Skill arrives inside the npm package (.agents/skills/ in the tarball) and is committed to the repo for project-level discovery.
• SKILL.md frontmatter fixed (name: echarts, proper 'use when' description) and documents the portable-option workflow: the returned option JSON can be dropped directly into a browser echarts.init(dom) build for live charts.

Research-backed

Cross-tool discovery conventions were verified against primary sources (code.claude.com, opencode.ai, developers.openai.com, antigravity.google, cursor.com, agentskills.io). Full reference: agent-skills-discovery-reference.md.

Verification

• 23 tests pass (5 suites), typecheck/lint/build clean.
• Skills auto-discovery proven live: the harness itself picked up .agents/skills/echarts/SKILL.md as a loadable echarts skill.

Note

• npm publish is 2FA-gated and handled by the maintainer manually, not automation.
• After npm i -g @ryuk3nd0/echarts-mcp, run echarts-mcp install-skills to install the skill into your tools.

npm: @ryuk3nd0/echarts-mcp@0.1.2

v0.1.1

v0.1.1

Fixes and verification hardening for the first public release.

Fixed

• Integration snippets now point at the correct scoped package @ryuk3nd0/echarts-mcp (previously npx echarts-mcp would have resolved to an unrelated project).
• HTTP integration test flake: replaced a blind startup sleep with a proper port-readiness probe.
• Empty-catch-block lint error in the HTTP integration test.

Added

• Real-client integration tests using the official @modelcontextprotocol/client SDK over stdio and Streamable HTTP.
• VERIFICATION.md — a pass/fail checklist for verifying in real apps (Claude Desktop, Claude Code, Cursor, HTTP gateway).
• README install section for the published package.

Verification

• 23 tests pass (5 suites), typecheck clean, lint clean, build clean.

---

npm: @ryuk3nd0/echarts-mcp@0.1.1

v0.1.0 — Initial release

v0.1.0 — Initial release

Apache ECharts MCP server: type-safe tools, SVG-first rendering, stdio + Streamable HTTP transports.

Highlights

• SVG-first rendering via echarts.init(null, theme, { renderer: "svg", ssr: true }) + renderToSVGString() — zero native dependencies.
• Fully stateless — self-contained results (raw SVG + echoed option).
• Type-safe JSON Schema derived from Zod v4 (Standard Schema).
• Tools: render_echart, validate_echart_option, list_chart_types.
• Built on MCP SDK v2 (@modelcontextprotocol/server@2 + @modelcontextprotocol/node@2).

Stack

• Node 20+, TypeScript NodeNext ESM, pnpm, Vitest.
• echarts@6.1.0 (pinned).

---

npm: @ryuk3nd0/echarts-mcp@0.1.0