Full Changelog: v1.2.1...v1.3.0
Bug fixes
- Fixed server silently exiting when launched via npx, Claude Desktop, opencode, or mcpo (#91). Root cause: the isMainModule path comparison introduced in v1.2.0 fails when Node runs through an npm .bin/ symlink. Replaced the fragile detection with a dedicated src/cli.ts entrypoint — works on every Node version and invocation method.
Security
- HTTP server now binds to 127.0.0.1 by default instead of 0.0.0.0 — opt in to network-wide access with MCP_HTTP_HOST=0.0.0.0 (breaking for HTTP transport users)
- Rate limiting added to all HTTP routes: 20 req/min for new sessions, 300 req/min for existing sessions, 60 req/min on /health. Configurable via MCP_RATE_* env vars
- CI: docker-publish.yml now uses least-privilege GITHUB_TOKEN permissions