Release notes from mcp-compliance
Articles about Release notes from mcp-compliance
Release v0.21.0 · YawLabs/mcp-compliance
Changed Under MCP_COMPLIANCE_RUNTIME=oam, the "no usable oam" error now gives a fix that matches what the launcher found. An outdated oam gets oam self-update. A binary that would not run gets "check that it is an executable oam". An OAM_BIN that does not exist gets "point OAM_BIN at an existing binary". The install link from https://oamjs.org is given only when no oam was found at all, and not on Linux off x64, where oam publishes no build. It used to print "Install or update from https://oamjs.org" in every case.
Release v0.20.4 · YawLabs/mcp-compliance
Fixed The five open CodeQL code-scanning alerts, all in the test suite. Four (js/incomplete-sanitization) built a new RegExp from an expected string while escaping only ., () or /, so a backslash or any other metacharacter in it would have changed the pattern; they now go through one escapeRegExp helper (src/tests/helpers/modern-fixture.ts) that escapes every metacharacter, backslash included. The fifth (js/cors-misconfiguration-for-credentials): the inline "reflect" CORS server
Release v0.20.3 · YawLabs/mcp-compliance
Security The MCP SDK moves from 1.30.0 to 1.32.1 (GHSA-6qxp-vccf-f47h, high: the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server). The SDK is a runtime dependency here -- tsup leaves it external and dist/ imports it -- so its floor is now ^1.32.1, and a fresh install can no longer resolve a vulnerable version.
Release v0.20.2 · YawLabs/mcp-compliance
Fixed release.sh finishes on the first re-run after a later step fails, and retries the MCP Registry publish while the registry cannot see the new version yet. Every "is this version on npm?" read now fetches npm's per-version document with curl (the path the MCP Registry's validator reads, served uncached) instead of npm view, whose packument Cloudflare's edge caches for up to five minutes; only a host without curl falls back to npm view --prefer-online.
Release v0.20.1 · YawLabs/mcp-compliance
Fixed 2026-07-28: the gaps 0.20.0 listed under "Not yet tightened" are closed. The 2026-07-28 suite now asks whose answer a rejection is, as the 2025-11-25 suite has since 0.20.0. These fixes leave the score math alone; verdicts on the checks below move. lifecycle-jsonrpc and five error checks no longer credit a gateway's answer as the server's. Against a gateway that answers 401 with a JSON-RPC -32001 "Unauthorized" body echoing the request id, lifecycle-jsonrpc
Release v0.20.0 · YawLabs/mcp-compliance
Changed A skipped check no longer counts in the score, so grades can move. A check that measured nothing (skipped: true: no --auth, no tools declared, a check that does not apply on the transport, a refusal an earlier check could not attribute) used to score as a pass. It is now left out of both the numerator and the denominator: the 70% required / 30% optional weighting applies to the checks that measured something, and when every required or every optional check skipped, the other pool carries the whole score.
Release v0.19.0 · YawLabs/mcp-compliance
Added MCP 2026-07-28 support (#63). A second test catalog, MODERN_TEST_DEFINITIONS (103 tests in the same 8 categories: 20 transport, 22 lifecycle, 6 tools, 8 resources, 4 prompts, 12 errors, 10 schema, 21 security), and a stateless suite for the per-request-_meta era: server/discover instead of initialize, _meta and standard-header validation (-32602, -32020, -32022), caching hints (ttlMs / cacheScope) on every cacheable result, resultType on every result, -32602 for missing resources, subscriptions/listen acknowledgment,
Release v0.18.2 · YawLabs/mcp-compliance
Security undici is now ^8.9.0 (was ^8.7.0) and @modelcontextprotocol/sdk is now ^1.30.0 (was ^1.29.0); npm audit goes from 10 findings (5 high) to 0. Both are runtime dependencies that tsup leaves external, and nothing in the advisory set is bundled: the published dist/ imports the SDK and undici as bare specifiers and carries no fast-uri, hono, @hono/node-server, qs or ip-address code, so a consumer's copies come from their own install, and a fresh install of 0.18.1 already resolves every advised runtime package to a patched version.
Release v0.18.1 · YawLabs/mcp-compliance
Changed npm and MCP Registry listing metadata: bugs URL, core keywords, and server.json title/repository/websiteUrl release.sh writes a ## [x.y.z] changelog entry for every release — promoting [Un
Release v0.18.0 · YawLabs/mcp-compliance
No runtime changes; the published package behaves exactly as 0.17.4. Changed release.sh waits for npm to actually serve the new version before the MCP Registry step. npm publish returns as soon as the registry accepts the tarball, but the version is not yet readable from npm's CDN-backed read path, and the MCP Registry validates a release by reading it — so a registry publish that ran straight after npm publish could fail with version '' was not found (status: 404) and need a second run.
Release v0.17.4 · YawLabs/mcp-compliance
v0.17.4 docs(changelog): date the launcher fixes as 0.17.4 fix(launcher): always use the newest oam, floor at the latest release (0.15.2) (#72)
Release v0.17.3 · YawLabs/mcp-compliance
v0.17.3