Skip to content

v1.0.2 — MCP Registry metadata and server instructions

Choose a tag to compare

View all tags
@shakaran shakaran released this 23 Aug 02:47
· 74 commits to main since this release
v1.0.2
bab31af

Added

The server now publishes instructions in its initialize response.

With progressive discovery on, tools/list advertises five meta-tools and hides the other 1,672 until a category is activated. A client had no way to learn they existed — directories that introspect the server reported it as a five-tool server. The instructions carry the real tool count, the five meta-tools by name, the SYMFONY_MCP_DYNAMIC_TOOLS=false escape hatch, and the read-only guarantee.

They cost 261 tokens. Advertising every schema up front costs about 154,000:

tools advertised tools/list payload
default 5 2.2 kB (~568 tokens)
SYMFONY_MCP_DYNAMIC_TOOLS=false 1,677 616 kB (~153,981 tokens)

Registry metadata — server.json (validated against the official MCP Registry 2025-12-11 schema), mcpName in package.json, glama.json and smithery.yaml, plus a registry-metadata test suite so a future release cannot bump the version in one file and forget the others.

Fixed

  • symfony-health-endpoint-security scanned almost nothing. The filename check ran continue before the route check, so the HEALTH_PATHS lookup below it could never change the outcome — a health endpoint in a controller not named *health*/*ping*/*status* was skipped entirely. Either signal now qualifies.
  • Prototype pollution in symfony-translation-yaml-lint. The domain map was a plain object, so hasOwnProperty(map, '__proto__') read false, the guarded assignment went through the prototype setter, and the write landed on the map's prototype instead of an own key. Both levels now have a null prototype.
  • doctrine-dbal-driveroptions and php-gd-security each tested the same condition on both sides of an ||.
  • http-cache let a non-array trusted_proxies / trusted_headers through a cast that pretended otherwise.

Changed

  • CodeQL scans GitHub Actions workflows alongside JavaScript/TypeScript, one job per language. Both security panels are at zero open alerts.

This is the first release published from CI, so it is the first to carry an SLSA provenance attestation.

Full changelog: https://github.com/shakaran/symfony-agent-mcp/blob/main/CHANGELOG.md

Assets 2
Loading