---
summary: "Compatibility upgrade: OAuth2 client credentials, tolerant capability fallback, route-planned find tools, and live server matrix."
breaking: false
---

# 0.4.5 — 2026-05-01

This release widens real-server compatibility without changing tool names or required inputs. The focus is making connection setup, capability discovery, and curated find tools adapt to what each BrAPI server actually advertises.

## Added

- **OAuth2 client-credentials auth** — `brapi_connect` now exchanges `mode: "oauth2"` credentials for an access token at connect time. Env-derived aliases support `BRAPI_<ALIAS>_OAUTH_CLIENT_ID`, `BRAPI_<ALIAS>_OAUTH_CLIENT_SECRET`, and optional `BRAPI_<ALIAS>_OAUTH_TOKEN_URL`.
- **Find-route planner** — curated `find_*` tools now prefer advertised GET list endpoints and fall back to POST `/search/{noun}` when the server only advertises search.
- **Dialect coverage** — added `breedbase` and `brapi-test` dialect ids. CassavaBase keeps the historical `cassavabase` id; sister SGN/Breedbase deployments now resolve to `breedbase`.
- **Compatibility matrix** — `docs/compatibility.md` records live `/serverinfo` probes for BrAPI Test Server, CassavaBase, SweetpotatoBase, T3/Wheat, and FAIDARE/GnpIS.

## Changed

- **Capability discovery** now tolerates missing or malformed `/serverinfo` by falling back to `/calls`, returning a partial orientation envelope with explicit notes instead of failing the connection outright.
- **Orientation envelopes** now surface dialect-level compatibility notes alongside disabled search routes.

## Fixed

- `oauth2` is no longer a schema-only auth variant that fails at runtime.
- Curated find tools no longer fail solely because a server advertises only POST `/search/{noun}` for a supported resource.