mcp-data-platform-v1.97.2

Highlights

The search-first hard gate introduced in v1.97.0 is now safe for multi-replica deployments. This is a required fix for anyone running more than one pod behind a load balancer.

Note: v1.97.2 ships the identical application code as v1.97.1 (commit 8ae5c42); it is a re-cut release that regenerates signed artifacts. If you are already on v1.97.1 there is no code change. The notes below describe the substantive fix the v1.97.x line delivers over v1.97.0.

Bug Fixes

Search-first gate is now replica-shared (#789, #790)

Impact: In v1.97.0 the search-first gate stored each session's discovery signal in a per-pod in-memory map. In a multi-replica deployment, a search call recorded on one replica was invisible to a query load-balanced to a different replica, so trino_query / trino_execute were rejected with SEARCH_REQUIRED even after the agent had already called search. The failure was non-deterministic, occurring roughly (R-1)/R of the time for R replicas (e.g. ~66% of the time with 3 replicas). Before v1.97.0 the same signal was only a soft warning, so the per-pod storage was harmless; promoting it to a hard gate is what exposed the topology bug in production.

Fix: The discovery signal is now backed by a shared store, mirroring how sessions and audit already externalize across replicas:

• New pkg/searchgate package — a Store interface with an in-memory implementation, plus a pkg/searchgate/postgres replica-shared implementation and migration 000077.
• Automatic backend selection — the platform uses the Postgres store when a database is configured (the same condition under which sessions externalize) and falls back to in-memory otherwise. No new configuration required.
• Single source of truth — the tracker no longer keeps a replica-local "discovered" bit that could diverge from the shared store.
• Sliding window — any tool call by a discovered session refreshes the shared record (writes throttled to once per half session-timeout), so a long, active workflow is never re-gated mid-session.
• Write-failure self-heal — a failed discovery write always retries on the next search; a failed slide is deferred to the next window, so a degraded database is not hammered with a write per query.
• Fail-open on read error (deliberate) — if the store read fails (e.g. a database outage), queries are allowed rather than every one being blocked. These events are logged.

Migration: Applying this release runs migration 000077 (search_gate_discovery). No manual action is required; the migration runner applies it on startup.

Upgrade Notes

• Single-replica / stdio deployments: No behavioral change — the in-memory store behaves exactly as before.
• Multi-replica deployments: This fix is strongly recommended. Ensure a database is configured (database.dsn) so the Postgres-backed store is used; otherwise each replica keeps its own in-memory signal and the original bug persists.
• The search-first gate remains on by default. To disable it, set workflow.require_search: false.

Installation

Homebrew (macOS)

brew install txn2/tap/mcp-data-platform

Claude Code CLI

claude mcp add mcp-data-platform -- mcp-data-platform

Docker

docker pull ghcr.io/txn2/mcp-data-platform:v1.97.2

Verification

All release artifacts are signed with Cosign / Sigstore and ship with SBOMs. Verify a download with:

cosign verify-blob \
  --bundle mcp-data-platform_1.97.2_linux_amd64.tar.gz.sigstore.json \
  mcp-data-platform_1.97.2_linux_amd64.tar.gz

Full changelog: v1.97.1...v1.97.2 (no code change) · v1.97.0...v1.97.2 (#789, #790)