cc6e0ce83c
BREAKING CHANGE: GET /sse and POST /messages now answer 404. Every client
connects over Streamable HTTP at /mcp. The sse remote is removed from
server.json.
- Add unauthenticated GET /health ({status, version}); no session, no
rate-limit touch.
- Add any-origin CORS across the whole HTTP surface, incl. OPTIONS
preflight and error responses; mcp-session-id exposed to browsers.
- Unify every version string at 2.0.0; both McpServer identities now read
the version from package.json at build time instead of hardcoding it.
- Raise @modelcontextprotocol/sdk floor to ^1.30.0 and sync the local
install with the lockfile.
- Tests: retire the SSE-shaped auth-gating suite (its unique
process-liveness test is ported to streamable-http-gating), move the
shared harness and rate-limit suite to StreamableHTTPClientTransport,
and add http-surface.test.ts for CORS//health//sse-404 coverage.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# Changelog
|
|
|
|
## 2.0.0 - 2026-08-17
|
|
|
|
### Breaking
|
|
|
|
- **The legacy SSE transport is removed.** `GET /sse` and `POST /messages` now answer 404.
|
|
Every client connects over Streamable HTTP at `/mcp`:
|
|
`claude mcp add --transport http vector-mcp <url>/mcp`. The `sse` remote was removed from
|
|
the MCP Registry manifest (`server.json`).
|
|
|
|
### Added
|
|
|
|
- `GET /health`: unauthenticated liveness probe, returns
|
|
`{"status":"ok","version":"<version>"}`. It creates no session and bypasses the rate
|
|
limiter.
|
|
- Any-origin CORS on the whole HTTP surface, including preflight (`OPTIONS` → 204) and error
|
|
responses, with `mcp-session-id` exposed to browser callers. Browser-based MCP clients can
|
|
connect directly; authorization remains bearer-token only. Note for self-hosters: with
|
|
`MCP_AUTH_TOKENS` unset, any web page can drive your instance from a visitor's browser,
|
|
sharing that visitor's per-IP rate-limit bucket - set `MCP_AUTH_TOKENS` on any instance
|
|
reachable by anyone but you.
|
|
|
|
### Changed
|
|
|
|
- All package versions, `server.json`, and both advertised MCP server identities are unified
|
|
at 2.0.0; the identities now read the version from `package.json` at build time instead of
|
|
hardcoding it.
|
|
- `@modelcontextprotocol/sdk` floor raised to `^1.30.0`.
|
|
|
|
### Known limits
|
|
|
|
- POST responses stream as SSE frames (the spec-default mode) with no keepalive bytes while a
|
|
tool call computes. Behind a proxy that cuts idle responses (Cloudflare's edge does at
|
|
~100 s), a single tool call that stays silent longer than that window is dropped by the
|
|
proxy. Long waits (e.g. `vector_await_transaction` on a congested chain) should poll in
|
|
shorter calls.
|