v0.19.0

What's Changed

• feat(fields): pass limit to SigNoz and say what to do when a list is cut by @srikanthccv in #431
• feat(query-tools)!: return complete records from get_trace_details and the search tools by @srikanthccv in #403
• chore(gen): move the SigNoz spec pin to main and drop the retired alert fields by @srikanthccv in #440
• fix(query-tools): teach timeShift window comparisons and what functions do on scalar requests by @srikanthccv in #438
• chore: pre-release v0.19.0 by @github-actions[bot] in #441

Full Changelog: v0.18.0...v0.19.0

v0.18.0

Security fixes

This release closes two reports against the HTTP transport. Both allowed an unauthenticated caller to pick the SigNoz instance the server talks to through the X-SigNoz-URL header or the OAuth setup form. Operators of the HTTP transport must upgrade. The stdio transport is not affected.

• The server-held API key goes only to SIGNOZ_URL. A request that names another instance in X-SigNoz-URL must carry its own SIGNOZ-API-KEY or Authorization header, or the server refuses it with HTTP 401. Before this release the server sent SIGNOZ_API_KEY to whatever host the caller named. Advisory GHSA-rhr9-6wcm-f9cj. (#433)
• The instance allowlist fails closed. When SIGNOZ_INSTANCE_URL_ALLOWLIST is empty, the server accepts no instance URL other than SIGNOZ_URL. Before this release an empty allowlist accepted every host, so the server could be used to send requests to arbitrary hosts. Advisory GHSA-wv9c-48cg-v2xm. (#434)
• The SigNoz API client no longer follows redirects. A redirect from an instance could carry the request headers, including credentials, to another host. The client now returns the redirect response to the caller. (#435)

The advisories will be published once CVE identifiers are assigned.

Breaking change: SIGNOZ_INSTANCE_URL_ALLOWLIST is required for multi-instance HTTP deployments

Who is affected. HTTP transport deployments that serve more than one SigNoz instance, through X-SigNoz-URL or the OAuth setup form, and do not set SIGNOZ_INSTANCE_URL_ALLOWLIST.

What changes.

• An empty allowlist now allows only SIGNOZ_URL. Every other instance URL is refused with HTTP 403, and the OAuth token endpoint returns invalid_grant for tokens bound to another instance.
• A server in HTTP transport with neither SIGNOZ_URL nor SIGNOZ_INSTANCE_URL_ALLOWLIST refuses to start.
• A client that relied on the server-held SIGNOZ_API_KEY while naming a different instance now gets HTTP 401 and must send its own credential.

What to do. Set SIGNOZ_INSTANCE_URL_ALLOWLIST to the hosts the server may proxy to. Entries are exact hosts or wildcards:

SIGNOZ_INSTANCE_URL_ALLOWLIST=signoz.example.com,*.us.signoz.cloud

Not affected. Deployments that set SIGNOZ_URL and serve only that instance, and all stdio deployments. The operator's own SIGNOZ_URL is always allowed.

Other changes

• Logs the requested name when a client calls an unknown tool. (#430)
• Reads top operations from the v2 endpoint so tag filters match. (#428)
• Sends each backend warning once. (#429)
• Logs expected dashboard patch failures below ERROR. (#436)
• Adds SECURITY.md with private vulnerability reporting. (#432)
• Splits aggregate_helper.go by owner. (#424)
• Dependency bumps in tools/mcp-ci and tests. (#366, #367, #368, #369, #374, #375, #376, #426, #427)

Full Changelog: v0.17.0...v0.18.0

v0.17.0

What's Changed

• feat(dashboards): search the template catalog with searchText by @makeavish in #371
• feat(gen): drive tool schemas, descriptions, and examples from the SigNoz spec by @srikanthccv in #377
• refactor(client): send every documented SigNoz call through the generated client by @srikanthccv in #379
• feat(query-builder): derive the signoz_execute_builder_query input schema from the SigNoz spec by @srikanthccv in #378
• fix(logging): log rejected SigNoz requests at WARN, not ERROR by @srikanthccv in #397
• feat(fields): add queryType to select AI fields on signoz_get_field_keys by @nityanandagohain in #381
• fix(query-builder): stop limiting formula input queries by @srikanthccv in #405
• feat(traces): AI search and trace rows on signoz_search_traces by @nityanandagohain in #390
• feat(query-tools)!: aggregations expressions, having, functions, order, and selectFields on the query tools by @srikanthccv in #380
• refactor(tools): keep the query tools' parameter descriptions in one file by @srikanthccv in #382
• feat(traces): AI aggregates and the AI query guide by @nityanandagohain in #404
• fix(query-tools): teach the unknown-key fallback instead of a hard error by @srikanthccv in #383
• fix(logs): ignore searchScope without searchText instead of failing by @srikanthccv in #384
• fix(traces)!: reject the legacy query alias like the log tools by @srikanthccv in #385
• fix(traces): parenthesize the filter and quote shortcut values by @srikanthccv in #386
• fix(traces): let SigNoz parse minDuration and maxDuration units by @srikanthccv in #387
• feat: add pricing and mapping tools by @nityanandagohain in #407
• fix(traces)!: find a trace by ID alone in get_trace_details by @srikanthccv in #388
• docs(traces): teach the filter grammar agents trip on by @srikanthccv in #389
• fix(metrics): let SigNoz validate aggregation combinations by @srikanthccv in #392
• fix(metrics): look up query_metrics metadata by exact name by @srikanthccv in #393
• fix(metrics): parse query_metrics groupBy like the other query tools by @srikanthccv in #394
• feat(ai): route LLM and agent questions to builder_ai_query and explain AI results by @nityanandagohain in #410
• fix(metrics)!: reject the legacy query alias like the log and trace tools by @srikanthccv in #395
• feat(metrics)!: make reduceTo an explicit choice for scalar queries by @srikanthccv in #396
• docs(dashboards): teach explicit full-text predicates in the query-builder example by @srikanthccv in #409
• fix(logs): match the severity shortcut as a case-insensitive prefix by @srikanthccv in #398
• docs(logs): teach the filter operators agents reach for that do not exist by @srikanthccv in #399
• feat(ai): signoz_test_ai_attribute_mapping runs sample spans through the mappings by @nityanandagohain in #411
• refactor(traces): let SigNoz resolve trace field names by @srikanthccv in #400
• docs(logs): group and select a body field only when field keys list it by @srikanthccv in #412
• fix(query-tools): read a JSON-encoded array string for groupBy and selectFields by @srikanthccv in #413
• fix(query-tools): reject a filter sent as the {"expression": ...} wire object by @srikanthccv in #414
• docs(metrics): teach searching list_metrics by one word, not a separator guess by @srikanthccv in #416
• fix(services): list services from the v2 endpoint, sorted by name by @srikanthccv in #417
• feat(alerts): filter, state, and sort alert rules in SigNoz before paging by @srikanthccv in #418
• feat(tools): log and count tool arguments the input schema does not declare by @srikanthccv in #415
• feat(org-overview): report the org's feature flags by @srikanthccv in #419
• fix(alerts)!: build anomaly rules as v2alpha1 and target SigNoz v0.148.1 by @srikanthccv in #420
• fix(query-tools): name REGEXP when SigNoz rejects a PromQL =~ matcher by @srikanthccv in #421
• docs(query-tools): teach that orderBy names the query's own aggregation by @srikanthccv in #422
• chore: pre-release v0.17.0 by @github-actions[bot] in #425

New Contributors

• @nityanandagohain made their first contribution in #381

Full Changelog: v0.16.0...v0.17.0

v0.16.0

What's Changed

• feat(traces)!: return a core field set from search and add optional selectFields by @srikanthccv in #325
• chore(deps): upgrade MCP Go SDK to v1.8.0 by @makeavish in #326
• fix: use public SigNoz URL for resource links by @makeavish in #332
• chore(deps): bump pyjwt from 2.13.0 to 2.15.0 in /tests by @dependabot[bot] in #338
• chore(deps-dev): bump undici from 7.29.0 to 7.30.0 in /tools/mcp-ci by @dependabot[bot] in #336
• chore(deps): bump ip-address from 10.5.0 to 10.7.3 in /tools/mcp-ci by @dependabot[bot] in #330
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /tests by @dependabot[bot] in #337
• chore: add testing doc by @srikanthccv in #340
• feat(client): generate the SigNoz API client with skaff by @srikanthccv in #341
• fix(alerts)!: stop injecting limit/order into alert evaluation queries by @srikanthccv in #345
• test: apply the testing standard to the existing suite by @srikanthccv in #348
• fix(fields): stop teaching the legacy 'tag' fieldContext alias by @srikanthccv in #350
• feat(fields)!: delete client-side validation and teach the truncation signal by @srikanthccv in #351
• test!: delete MockClient and everything that relied on it by @srikanthccv in #352
• chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /tools/mcp-ci by @dependabot[bot] in #343
• chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.32.1 in /tools/mcp-ci by @dependabot[bot] in #342
• feat(views)!: delete client-side validation, SigNoz is the only validator by @srikanthccv in #349
• feat(channels)!: delete the hand-copied provider specs and validation, SigNoz is the only validator by @srikanthccv in #355
• feat(alerts)!: delete client-side validation and the hand-copied rule types, SigNoz is the only validator by @srikanthccv in #354
• chore: delete dead code left behind by the validation-deletion wave by @srikanthccv in #356
• test(wire-catalog): record what the server sends instead of rewriting it into mcp-go shapes by @srikanthccv in #360
• fix(client): stop logging the value of a custom header that collides with the auth header by @srikanthccv in #359
• refactor(querybuilder)!: replace the hand-copied QB v5 mirror with the generated types by @srikanthccv in #358
• test: drop logger and telemetry plumbing tests by @srikanthccv in #361
• test: drop re-pins of the wire catalog, wording pins, and count pins by @srikanthccv in #362
• test: drop tests that assert the wrong thing or only test library behavior by @srikanthccv in #363
• test: keep each rule pinned once, at the lowest layer that runs it by @srikanthccv in #364
• test(e2e): keep only the checks that need SigNoz by @srikanthccv in #365
• fix(web-urls): discover browser links from SigNoz global config by @makeavish in #339
• fix(metrics): stop pinning temporality in dashboard and metrics examples by @srikanthccv in #370
• chore: pre-release v0.16.0 by @github-actions[bot] in #372

New Contributors

• @srikanthccv made their first contribution in #325

Full Changelog: v0.15.0...v0.16.0

v0.15.0

What's Changed

• chore: post-release v0.14.0 by @github-actions[bot] in #301
• chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /tools/mcp-ci by @dependabot[bot] in #302
• chore(deps): bump hono from 4.13.2 to 4.13.7 in /tools/mcp-ci by @dependabot[bot] in #304
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in #300
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #306
• docs: align planning convention with AI Assistant by @makeavish in #307
• perf(docs): bound docs refresh memory with conditional fetches, content gating, chunked builds, and live-index deltas by @makeavish in #308
• feat(docs-search): rank by all-term and most-term matches, stem titles, and guide client queries by @makeavish in #309
• docs(alerts): correct percentile guards and anomaly guidance by @makeavish in #314
• chore(make): add make ci target and share CI checks with make by @makeavish in #315
• feat!: align MCP with released SigNoz feature contracts by @makeavish in #313
• ci(release): list breaking changes in the generated changelog by @makeavish in #316
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in #312
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.42.0 to 1.45.0 by @dependabot[bot] in #311
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.42.0 to 1.45.0 by @dependabot[bot] in #310
• fix(views): name the real PromQL and ClickHouse envelope types by @makeavish in #318
• fix(notification-channels): accept SigNoz Slack message settings by @makeavish in #319
• feat(dashboards): support SigNoz area chart panels by @makeavish in #320
• feat(dashboards): teach panel query dry-runs in the widget guide by @makeavish in #323
• chore(client): remove unused ListMetricKeys by @makeavish in #322
• chore: pre-release v0.15.0 by @github-actions[bot] in #324

Full Changelog: v0.14.0...v0.15.0

v0.14.0

What's Changed

• docs(mcp): remove AI-slop patterns and fix misreadings in client-visible copy by @makeavish in #294
• refactor(mcp): retire live resource templates by @makeavish in #295
• feat(saved-views): migrate saved view tools to v2 saved_views API (nerve-pod#100) by @therealpandey in #296
• test(e2e): foundry-provisioned e2e harness and CI workflow by @therealpandey in #297
• test(e2e): port the Go e2e families to the Python harness by @therealpandey in #298

Full Changelog: v0.13.0...v0.14.0

v0.13.0

What's Changed

• feat(mcp): migrate to the official Go SDK and support 2026-07-28 MCP spec by @makeavish in #286
• test(mcp): add selected official conformance by @makeavish in #287
• fix(mcp): preserve recognized backend error guidance by @makeavish in #289
• chore(build): upgrade to go 1.26 by @makeavish in #290
• docs: add Grok Build MCP configuration by @makeavish in #292
• chore: pre-release v0.13.0 by @github-actions[bot] in #293

Full Changelog: v0.12.0...v0.13.0

v0.12.0

What's Changed

• refactor(client): validate credentials via service_accounts/me only by @claude[bot] in #280
• chore: pre-release v0.12.0 by @github-actions[bot] in #282

New Contributors

• @claude[bot] made their first contribution in #280

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• fix(alerts): support policy routing and preflight reuse by @makeavish in #264
• feat: add organization overview and auth recovery by @makeavish in #267
• feat(observability): capture failed MCP requests by @makeavish in #276
• chore: pre-release v0.11.0 by @github-actions[bot] in #278

Full Changelog: v0.10.0...v0.11.0

v0.10.0

Breaking Change: Dashboard API

SigNoz MCP Server v0.10.0 migrates dashboard tools to the v2/Perses dashboards API.

• Dashboard create, get, update, patch, list, delete, and import tools require SigNoz v0.135.0 or later.
• Dashboard create and update payloads now use the Perses v6 schema. Update direct callers that still send legacy v5 dashboard payloads.
• signoz_check_metric_usage requires SigNoz v0.135.0 to return dashboard references. On older versions, alert references continue to work, but dashboard references will be empty.

Upgrade SigNoz before upgrading the MCP server if you use dashboard tools.

What's Changed

• docs: streamline CLAUDE.md and extract plan templates by @makeavish in #258
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 by @dependabot[bot] in #259
• feat: migrate dashboard tools to v2 perses APIs by @namanv3 in #260
• chore: pre-release v0.10.0 by @github-actions[bot] in #261

New Contributors

• @namanv3 made their first contribution in #260

Full Changelog: v0.9.0...v0.10.0