v0.41.0

Added

• [Swagger] Added Kiro (AWS) setup instructions and one-click install badge for the Swagger Remote MCP Server.

Changed

• [Common] Rewrote the transport bootstrap to serve both the 2025-11-25 and 2026-07-28 (RC) MCP protocol revisions from a single deployment, on stdio (serveStdio, legacy: "serve") and HTTP (per-request routing between the existing sessionful wiring and a new stateless createMcpHandler leg). Existing 2025-11-25 clients are unaffected. #687
• [Common] Modern-era (2026-07-28) requests now carry client identity: the protocol version, client info and capabilities are extracted from each request's _meta envelope into the request context, so error reports are attributed for clients that no longer send an initialize handshake, and downstream User-Agent attribution follows on stdio. On the HTTP transport the downstream User-Agent is still fixed at configuration time and does not yet reflect the per-request client (pre-existing behavior, tracked separately). Legacy per-connection capture is unchanged. #691
• [Common] Protocol-compliance fixes for the modern (2026-07-28) era: cacheable list/read results (tools/list, prompts/list, resources/list, resources/templates/list, resources/read) now carry cache hints (ttlMs from CACHE_TTL, cacheScope: private); tools/list output is deterministically ordered (alphabetical by name, both eras); the modern era no longer advertises the deprecated logging capability (SEP-2577), while tools.listChanged remains advertised on both eras (the SDK's serving entries implement subscriptions/listen natively for modern clients); Mcp-Method and Mcp-Name are allowed through CORS. SEP-2243 param-driven request headers (Mcp-Param-<Name>, declared via x-mcp-header schema annotations) are validated against tool arguments natively by the SDK; no tool currently declares one, so no additional CORS entries are needed for them. Legacy (2025-11-25) capability declarations and cache-result envelopes are unchanged; resource-not-found errors are now reported as -32602 (Invalid Params) in both eras per the 2026-07-28 spec, and clients should accept both -32602 and the former -32002. #708
• [Common] Elicitation on the modern (2026-07-28) era now uses the multi round-trip pattern (SEP-2322): tools that need user input return an input_required result carrying an embedded elicitation/create request, and the client's retry supplies the answers via inputResponses. Answers from earlier rounds are correlated through a server-minted requestState. Modern clients that do not declare the elicitation capability, and all legacy (2025-11-25) clients, keep the existing instruction-based fallback. #705
• [Zephyr] Change outputSchema for issue link test cases, cycles and executions to be objects instead of arrays. #706

Fixed

• [Swagger] Updated and fixed Functional Testing tool descriptions for clarity and LLM usability: added explicit async/polling guidance to run_test and run_suite, enumerated status values with descriptions for get_test_status and get_suite_status, added limit/offset pagination hints and total run count to get_test_history, standardized status terminology to canceled across all tool descriptions, and restructured the public doc into Tests and Suites sections with bold field labels and cross-tool references.

• [Common] Security: WWW-Authenticate OAuth discovery URLs are no longer derived from the client-supplied Host header over a hardcoded http://. The header is now built via getBaseUrl(), honouring the BASE_URL env var and deriving the scheme from X-Forwarded-Proto. X-Forwarded-Host is now only trusted when the new TRUST_PROXY env var is enabled, since it can be forged by clients on deployments without a proxy stripping it. Both variables are documented in the README.

• [Common] The Smartbear-Toolsets header (used to load only specific tool groups, e.g. qtm4j:testcases) was missing from the allowed CORS headers, so browsers were blocking it before it reached the server. It's now added to the allow-list and works as expected.