openclaw/mcporter v0.14.0

mcporter 0.14.0

on GitHub

Highlights: OAuth consent scopes are configurable, generated TypeScript clients preserve complete tool arguments, and cancellation, local state, and generated-code handling are safer.

• Keep server-controlled descriptions and metadata inside generated comments, preventing comment terminators or line breaks from becoming executable client code.
• Refresh runtime validation, generated-CLI bundling, and development tooling while preserving Node 24 support and the 48-hour dependency release-age policy.
• Cancel uncached discovery connections on list timeout or runtime close, retire late setup results before completing cleanup, and reject superseded callers without stale connection metadata. Thanks @SebTardif (#383).
• Emit strict-compatible object-argument clients that forward every tool argument and return CallResult, including tools with reserved property names or named output schemas; preserve proxy defaults and validation. Thanks @nathanvale (#378, #379).
• Avoid repeated warnings for already-ignored uint32 and uint64 output-schema annotations while preserving schema metadata, dialect handling, and validation. Thanks @0xCUB3 (#377).
• Reject non-object --persist destinations and invalid mcpServers containers with clear errors, preserving the existing file instead of silently losing the new server or replacing invalid data. Thanks @SebTardif (#387).
• Preserve the saved tool timeout when regenerating a CLI with --from, unless --timeout explicitly overrides it. Thanks @SebTardif (#384).
• Bound --tail-log reads to the last MiB of regular files, reject special files without blocking even if the path changes during opening, and avoid padding short reads. Thanks @SebTardif (#388).
• Materialize Chrome compatibility preloads in private, unique directories with exclusive file creation, preventing shared-temp symlink overwrites and cleaning up with the transport. Thanks @SebTardif (#386).
• Retry transient Windows file-lock release failures without replaying the protected operation or deleting a successor's lock, while keeping permanent failures visible.
• Discover Claude Desktop's actual config filename and Cursor's default Linux user config, and honor redirected Windows APPDATA locations for both clients. Thanks @SebTardif (#382).
• Verify private Windows daemon and Chrome handoff directories without requiring administrator elevation, while preserving owner and access restrictions. Thanks @yegetables for the report (#380).
• Resolve the daemon process inventory through PATH, allowing retirement and migration on NixOS and other systems without /bin/ps. Thanks @tsln1998 (#381).
• Honor cancellation during HTTP/1.1 request preparation so an already-cancelled MCP request is never sent after body serialization.
• Report asynchronous recording failures without unhandled rejections and always close the underlying MCP transport when recording writes fail.
• Accept narrowly normalized loopback redirects from fresh OAuth registrations, including Fastmail's portless localhost response, while preserving the actual callback and stale-client safeguards. Thanks @mikegreiling for the report (#354).
• Add per-server oauthRequestedScope and config add --oauth-requested-scope to control OAuth consent scopes across authorization and reauthorization without changing default scope negotiation. Thanks @ronyrus for the report (#356).
• Start OAuth on an initial unauthenticated HTTP challenge instead of treating missing credentials as a failed refresh; reuse credentials that another flow saved before retrying.

Verification: npm, registry tarball, native assets, and browser Gatekeeper proof. npm integrity: sha512-R60nKyUcW65WawhVjoESC0HeNibsf+1iqpX0wHPX9P60AFX/DYCBlhS7pDYcuWzeGYqYfZG2Xf5jWWkM74d/+A==.