jerry/apex-mcp-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7a8cafb08afc8025320ded9f98cb7608c3a0504f
apex-mcp-server/CHANGELOG.md
david cc6e0ce83c feat(builder)!: remove deprecated SSE transport - Streamable HTTP only (2.0.0) 
BREAKING CHANGE: GET /sse and POST /messages now answer 404. Every client
connects over Streamable HTTP at /mcp. The sse remote is removed from
server.json.

- Add unauthenticated GET /health ({status, version}); no session, no
  rate-limit touch.
- Add any-origin CORS across the whole HTTP surface, incl. OPTIONS
  preflight and error responses; mcp-session-id exposed to browsers.
- Unify every version string at 2.0.0; both McpServer identities now read
  the version from package.json at build time instead of hardcoding it.
- Raise @modelcontextprotocol/sdk floor to ^1.30.0 and sync the local
  install with the lockfile.
- Tests: retire the SSE-shaped auth-gating suite (its unique
  process-liveness test is ported to streamable-http-gating), move the
  shared harness and rate-limit suite to StreamableHTTPClientTransport,
  and add http-surface.test.ts for CORS//health//sse-404 coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 14:11:18 +02:00

1.6 KiB
Raw Blame History

Changelog

2.0.0 - 2026-08-17

Breaking

  • The legacy SSE transport is removed. GET /sse and POST /messages now answer 404. Every client connects over Streamable HTTP at /mcp: claude mcp add --transport http vector-mcp <url>/mcp. The sse remote was removed from the MCP Registry manifest (server.json).

Added

  • GET /health: unauthenticated liveness probe, returns {"status":"ok","version":"<version>"}. It creates no session and bypasses the rate limiter.
  • Any-origin CORS on the whole HTTP surface, including preflight (OPTIONS → 204) and error responses, with mcp-session-id exposed to browser callers. Browser-based MCP clients can connect directly; authorization remains bearer-token only. Note for self-hosters: with MCP_AUTH_TOKENS unset, any web page can drive your instance from a visitor's browser, sharing that visitor's per-IP rate-limit bucket - set MCP_AUTH_TOKENS on any instance reachable by anyone but you.

Changed

  • All package versions, server.json, and both advertised MCP server identities are unified at 2.0.0; the identities now read the version from package.json at build time instead of hardcoding it.
  • @modelcontextprotocol/sdk floor raised to ^1.30.0.

Known limits

  • POST responses stream as SSE frames (the spec-default mode) with no keepalive bytes while a tool call computes. Behind a proxy that cuts idle responses (Cloudflare's edge does at ~100 s), a single tool call that stays silent longer than that window is dropped by the proxy. Long waits (e.g. vector_await_transaction on a congested chain) should poll in shorter calls.