Fixed
- HTTP mode crashed on Node 18.
crypto.randomUUID()was used as a bare
global (stable only on Node 19+) whileengines/CI include Node 18. HTTP mode
is now stateless and no longer references the global. - HTTP concurrency bug. A single shared
StreamableHTTPServerTransportwas
connected once at startup (a documented anti-pattern that collides across
concurrent clients). Each request now gets a fresh stateless server+transport. - Tool errors now set
isError: trueso MCP clients/LLMs can distinguish a
failure from a normal result and self-correct. get_salary_statisticswas mislabeled — it advertised "salary
distribution" but returned only a count. hh.ru has no free distribution
endpoint, so the tool now samples posted salaries and computes
median/P25/P75/min/max client-side, clearly labelled as a biased estimate.search_vacanciesno longer forcescurrency=RURon every query — the
currency is sent only together with a salary filter.- Required
HH-User-Agentheader is now sent (hh.ru requires it; missing it
risks blocks/captcha). Configurable viaHH_USER_AGENT. - Server version, the User-Agent and
/healthare single-sourced from
package.json(was hardcoded and drifting at2.0.0). - Removed a stale, broken duplicate test file referencing a long-gone 8-tool API.
- Test files are no longer compiled into
dist// published to npm.
Added
- Compact, LLM-friendly output by default for vacancy/employer/resume search
and detail tools, withraw: trueto get the full hh.ru JSON. - Expanded
search_vacanciesfilters:professional_role,industry,
metro,employer_id,period/date_from/date_to(mutually
exclusive),search_field,excluded_text,label, plus modern
work_format/employment_form(the legacyemployment/scheduleremain
accepted but are marked deprecated). Pagination depth is capped at 2000. - New tools:
get_industries,get_metro,get_areas_subtree, and
validate_token(checksHH_ACCESS_TOKENvia/meand reports the role). - Dictionary/suggest tools now return compact
id — namelistings (raw viaraw). - HTTP mode: DNS-rebinding protection (allow-lists via
HH_ALLOWED_HOSTS/
HH_ALLOWED_ORIGINS), binds to127.0.0.1by default (HOST),/health
reports version, graceful shutdown and a friendlyEADDRINUSEmessage. - ESLint +
lint/typecheckscripts wired into CI;.env.example.
Changed
- Resume tools now fail fast with an actionable message and clarify that they
require an employer token and a paid resume-database subscription. - Bumped
@modelcontextprotocol/sdkfloor to^1.28.0. - Tool count is derived from the registry (now 19 tools) and can no longer drift.
Install: npx -y @theyahia/hh-mcp@2.1.0 · npm
Tag v2.1.0 already existed in the repository; this adds the missing GitHub Release for it.