Added
- Added a versioned, sanitized MCP runtime status snapshot on Pi's shared event bus for extensions, without connecting lazy servers or exposing SDK internals. Thanks Ludev (@ludevdot) for issue #110.
- Added opt-in host-specific MCP config discovery with source/provenance and conflict reporting. Standard shared and Pi-owned config precedence remains unchanged, and external host files are never written or silently executed. Thanks @lsmir2 for issue #169.
- Added opt-in metadata-only JSONL MCP protocol tracing with bounded per-session files and redaction. Thanks @66-firebat for issue #45.
- Added per-server
includeToolsallowlists with exact-name and glob matching for proxy, direct-tool, and/mcppanel surfaces. Thanks Finn (@finnvyrn) for issue #136. - Made
mcp({ connect: "server" })refresh an already connected server instead of reusing stale tool metadata. Thanks Sebastiano Poggi (@rock3r) for issue #28 and @theflysurfer for the refresh analysis. - Added a plug icon prefix to MCP footer status text. Thanks Felipe Cadal (@cadal-cw) for issue #145.
- Discovered user-global MCP configs from
~/.agents/mcp.jsonand~/.agents/mcp/mcp.json. Thanks David Jadczyk (@davidjadczyk) for issue #117. - Accepted JSONC-style comments and trailing commas in MCP JSON config files. Thanks @GoCoder7 for issue #124.
Changed
- Measured and spilled oversized raw MCP result details as compact JSON instead of pretty-printed JSON, reducing hot-path allocation and event-loop work. Thanks José Maia (@glitch-ux) for issue #214 and PR #215.
- Renamed generated MCP resource tools from
get_<resource>toread_<resource>to match the MCPresources/readoperation. Thanks @vdom-1 for issue #185.
Security
- Moved persistent OAuth credentials from plaintext
tokens.jsonfiles into the operating system credential store, with one-way legacy import and fail-closed behavior when secure storage is unavailable. Thanks Sam Atkins (@atkinsam) for issue #180.
Fixed
- Skipped
resources/listfor MCP servers that do not advertise theresourcescapability, matching the existing prompt discovery gate and silencing the SDK v2 debug line that tools-only servers printed on every connect. Thanks Aleksandr Davydenko (@kotuke) for PR #213. - Made the MCP footer show enabled configured servers as the primary count, with active connections as secondary state, so lazy servers no longer look broken before first use or after idle shutdown. Thanks blumlaut (@Blumlaut) for issue #93.
- Show the actual proxied MCP server/tool name in
mcptool results. Thanks Finn (@finnvyrn) and @dillontkh for issue #68. - Removed the remaining TypeScript import cycles reported by
madge. Thanks @av1155 for issue #101.