---
summary: "Adopt framework 0.9.1 — wire `instructions` field for server-level orientation, port two raw schemas off `z.url()` and three off `.nullish()` unions to clear the new cross-vendor portability lint family (`schema-format-portability`, `schema-anyof-needs-type`)."
breaking: false
security: false
---

# 0.5.5 — 2026-05-16

## Added

- **Server-level `instructions` on `createApp()`** — agents now receive a one-paragraph orientation on `initialize` describing the connect-first handshake, the `find_*` / `get_*` / `raw_*` tool families, the spillover-to-canvas flow, and which tools to prefer. Spec-compliant clients forward it as session-level system context, so the same guidance reaches the model without bloating individual tool descriptions. ([@cyanheads/mcp-ts-core#91](https://github.com/cyanheads/mcp-ts-core/issues/91))

## Changed

- **`brapi_connect` and OAuth2 auth schemas dropped `z.url()`** ([`src/mcp-server/tools/definitions/brapi-connect.tool.ts`](./src/mcp-server/tools/definitions/brapi-connect.tool.ts), [`src/mcp-server/tools/shared/connect-auth-schema.ts`](./src/mcp-server/tools/shared/connect-auth-schema.ts)) — `z.url()` emits `format: "uri"` which OpenAI's tool validator hard-rejects, so `gpt-5-codex` was silently dropping the tools. Replaced with `z.string()` and moved the "absolute URL" constraint into `.describe()` text where the model actually reads it; clears the new default-on `schema-format-portability` lint rule. ([@cyanheads/mcp-ts-core#132](https://github.com/cyanheads/mcp-ts-core/issues/132), field report: [cyanheads/git-mcp-server#47](https://github.com/cyanheads/git-mcp-server/issues/47))
- **`find_observations` season + season.year and `find_variants` variantSetDbId unions ported off `.nullish()`** ([`src/mcp-server/tools/definitions/brapi-find-observations.tool.ts`](./src/mcp-server/tools/definitions/brapi-find-observations.tool.ts), [`src/mcp-server/tools/definitions/brapi-find-variants.tool.ts`](./src/mcp-server/tools/definitions/brapi-find-variants.tool.ts)) — `.nullish()` on a `z.union([...])` emits a typeless `anyOf` branch that Gemini rejects with `400: reference to undefined schema`. Switched to `.optional()` + explicit `z.null()` in the union so every branch carries a top-level `type`; clears the new default-on `schema-anyof-needs-type` lint rule.
- **`scripts/devcheck.ts` `bun outdated` parser fixed** — `bun outdated` emits markdown-style rows (`| pkg | … |`) with an empty leading cell, so `split('|')[0]` was always empty and the allowlist never matched. Now reads index `[1]` and strips the trailing `(dev|peer|prod|optional)` workspace marker so bare package names match. Synced from framework 0.9.1.
- **Changelog summary cap raised 250 → 350 chars** — `SUMMARY_MAX_LENGTH` in `scripts/build-changelog.ts`, `changelog/template.md`, and the AGENTS.md / CLAUDE.md changelog section. Synced from framework 0.9.0 — 250 was forcing operator-relevant context out of recent summaries. ([@cyanheads/mcp-ts-core#129](https://github.com/cyanheads/mcp-ts-core/issues/129))
- **AGENTS.md / CLAUDE.md skill table** — added rows for `tool-defs-analysis`, `release-and-publish`, `migrate-mcp-ts-template`, and `api-linter`; refreshed the changelog frontmatter section with the `security: boolean` flag and Keep-a-Changelog section-order guidance.
- **Skills resynced from `@cyanheads/mcp-ts-core@0.9.1`** — `api-auth` 1.0 → 1.1 (`mcp_tool_scopes` union claim, Authentik/Keycloak/Zitadel operator setup, `MCP_AUTH_DISABLE_SCOPE_CHECKS` bypass), `api-linter` 1.2 → 1.3 (new portability rule family), `api-workers` 1.3 → 1.4 (`instructions` resolver form documented), `polish-docs-meta` 1.7 → 1.8 (350-char summary cap), `add-tool`, `api-config`, `api-errors`, `design-mcp-server`, `field-test`, `security-pass`, `tool-defs-analysis`. Phase B mirrored into `.claude/skills/` and `.agents/skills/`.

## Dependencies

- **`@cyanheads/mcp-ts-core` `^0.8.19 → ^0.9.1`** — Workers boot under `nodejs_compat` ([#124](https://github.com/cyanheads/mcp-ts-core/issues/124); not used by this server but unblocks anyone bridging to Workers), `instructions` field on `createApp` ([#91](https://github.com/cyanheads/mcp-ts-core/issues/91)), cross-vendor JSON Schema portability lint family ([#132](https://github.com/cyanheads/mcp-ts-core/issues/132)), build-time-only definition linting (no longer gates `createApp()` startup), RFC 8414 §3 path-suffixed well-known mount, SSRF DNS validation now enforced in Workers, IPv6-mapped/unique-local/link-local SSRF blocklist, FileSystemProvider tenant-id boundary check, rate-limit metric cardinality bound. ⚠️ Breaking: `schema-format-portability` is default-on `error` — the two `z.url()` migrations above are this server's response. ([changelog](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.9.x/0.9.0.md))
- **`@biomejs/biome` `^2.4.14 → ^2.4.15`**, **`@types/node` `^25.6.2 → ^25.8.0`**, **`vitest` `^4.1.5 → ^4.1.6`** — patch refreshes.