---
summary: "mcp-ts-core ^0.9.9 → ^0.9.13: HTTP body cap (413 guard), session-init gate, quieter 401/403/400/404 logging, GET /mcp keywords; dep refresh"
breaking: false
security: true
---

# 0.2.2 — 2026-05-28

## Changed

- **`@cyanheads/mcp-ts-core`** ^0.9.9 → ^0.9.13 — adopts four framework releases:
  - **`MCP_HTTP_MAX_BODY_BYTES`** — inbound request-body cap on the HTTP endpoint (default 1 MiB); oversized bodies rejected with `413` before any SDK parsing. Set to `0` to disable.
  - **HTTP session-init gate** — stateful HTTP mode rejects non-`initialize` requests that arrive without `Mcp-Session-Id` with `400`, preventing uninitialized session minting.
  - **Expected client error log-level split** — `401`, `403`, `400`, `404` responses use `logger.warning` instead of the full `ErrorHandler` pipeline, reducing stack-trace noise in error logs.
  - **`GET /mcp` keywords** — `package.json` `keywords` surfaced in the HTTP status JSON alongside `name`, `version`, and `description`.
- **`landing.requireAuth: false`** — `createApp()` call now explicitly opts out of the new auth-gated landing page default so the tool catalog remains visible on the hosted (no-auth) deployment.
- **`@duckdb/node-api`** ^1.5.3-r.1 → ^1.5.3-r.2
- **`@biomejs/biome`** ^2.4.15 → ^2.4.16