v1.9.0

1.9.0 (2026-09-26)

Bug Fixes

• apply canAccess to resource update subscriptions (c8bd89a)
• auth: name the MCP endpoint as the protected resource (d3ec457)
• declare resources.subscribe so notifyResourceUpdated reaches subscribers (03ac05f)
• deliver context.log messages at the level the client asked for (82b5821)
• stop advertising logging to 2025-era clients, which cannot opt in to it (ff53ec7)

Features

• auth: let providers pass clientIdMetadata and allowPlainPkce to their proxy (c106ece)

v1.8.8

1.8.8 (2026-09-25)

Bug Fixes

• stdio: keep the default logger off stdout, which carries the protocol (b280698)
• validate converted tool schemas with their own library, so Valibot transforms and checks work (15efe35)

v1.8.7

1.8.7 (2026-09-25)

Bug Fixes

• keep record and rest value schemas in converted tool schemas, and stop an unconvertible one from failing every request (9f4214b)

v1.8.6

1.8.6 (2026-09-24)

Bug Fixes

• cli: pass the validate file as an argument, type-check it under the project's tsconfig, and exit once it loads (58e5068)

v1.8.5

1.8.5 (2026-09-16)

Bug Fixes

• auth: resolve CIMD clients on every leg, and match loopback ports per RFC 8252 §7.3 (33c7cef)

v1.8.4

1.8.4 (2026-09-11)

Bug Fixes

• auth: answer list methods with an empty list when canAccess hides every primitive (cd96abe)

v1.8.3

1.8.3 (2026-09-07)

Bug Fixes

• http: stream response bodies instead of buffering them (a700fdc)

v1.8.2

1.8.2 (2026-09-04)

Bug Fixes

• openapi: bracket nested form body values instead of JSON-encoding them (abb3cae)
• openapi: drop a response schema that pulls in more than 100 definitions (af39fd1)
• openapi: release the response body when a spec fetch fails (b0e4637)

v1.8.1

1.8.1 (2026-09-01)

Bug Fixes

• repeat array-valued form body properties once per entry (cc2e63e)

v1.8.0

1.8.0 (2026-09-01)

Features

• generate an MCP server from an OpenAPI document (ded1d08)