Releases · vcth4nh/idesense

Seven tools removed in refocusing IdeSense on code analysis without human-in-the-IDE
interaction: ide_open_file and ide_get_active_file (editor interaction),
ide_refactor_safe_delete, ide_optimize_imports, ide_convert_java_to_kotlin, and
ide_reformat_code (code mutation), ide_build_project (dev-loop driver). Breaking for
MCP clients that call these tools. ide_refactor_rename and ide_move_file remain as the
minimal retained refactorings.
totalCount removed from every paginated search result (ide_find_usages, ide_find_class,
ide_find_symbol, ide_find_file, ide_find_implementations, ide_search_text). It duplicated
totalCollected, but the name implied a whole-project total, so an agent could stop paginating
early and miss results. Completeness is signalled by hasMore/nextCursor; totalCollected (the
collected count) remains. Breaking for clients that read totalCount (#30).
isIndexing and indexingProgress removed from ide_index_status. isIndexing always
mirrored isDumbMode and indexingProgress was always null; the result is now just
{ isDumbMode }. Breaking for clients that read those fields (#31).

Mission statements (README/Marketplace description, CLAUDE.md, agent skill) rewritten to the
analysis-first philosophy. ide_diagnostics still reports last-build errors via the passive
build listener — only the ability to trigger builds is gone.
Error taxonomy unified so agents parse one shape. invalid_scope is now built from the central
McpErrors vocabulary — it gains a human-readable message; error/parameter/provided/
supportedValues are unchanged — across all seven scope-taking tools (the five search tools plus
ide_type_hierarchy/ide_call_hierarchy). A missing query on the search tools now returns the
structured invalid_arguments shape (a missing_required violation) instead of a generic
tool_error string. Breaking for clients that matched the old missing-query message (#39).
Analysis-only default tool set. Fresh installs now enable every read-only analysis tool:
ide_find_symbol and ide_file_structure leave the default-disabled set (#72). The retained
refactorings ide_refactor_rename and ide_move_file become opt-in instead, joining
ide_install_plugin, ide_restart, and ide_read_file (enable any tool under Settings →
Tools → IdeSense). Installs that ever saved the tool toggles are unaffected — persisted
settings replace the defaults entirely. Breaking for MCP clients on fresh installs that
call the refactoring tools without opting in.

Security — non-loopback bind is now opt-in. There is no authentication on any transport, so
binding a non-loopback host (0.0.0.0, a LAN address, …) hands every enabled tool to any machine
that can reach the port. A new Allow non-loopback bind setting (off by default) must be
ticked for such a host to be honored; without it the server falls back to 127.0.0.1, keeps
running (local agents are unaffected), and warns via notification. URLs reported in the status
panel and generated client configs now reflect the host actually bound, not the configured one
(#25).

Security: disabled tools are now refused at the tools/call dispatch site instead of only
being hidden from tools/list; a client that already knows a disabled tool's name gets a
clear "disabled by user settings" error (#23).
Security: ide_install_plugin requires the source .zip to resolve (canonically, symlinks
followed) inside the open project's roots, mirroring the containment other file-taking tools
apply; out-of-root paths are rejected. For cross-project dev loops, copy the zip into the
target project first (#24).

Navigation Menu