---
summary: "@cyanheads/mcp-ts-core ^0.9.6 → ^0.9.13: HTTP 413 body cap, session-init gate, quieter error logs, landing inventory open-catalog override, URL placeholder guard"
breaking: false
security: false
---

# 0.6.3 — 2026-05-28

## Changed

- **`@cyanheads/mcp-ts-core`** ^0.9.6 → ^0.9.13 — picks up HTTP transport hardening, session-init gate, and quieter client-error logs (see below).
- **`landing.requireAuth: false`** set in `createApp()` (`src/index.ts`) — restores the open-catalog UX for the hosted public endpoint; framework 0.9.13 gates landing inventory behind auth by default when `MCP_AUTH_MODE` is `jwt`/`oauth`.
- **`BRAPI_DEFAULT_BASE_URL` Zod preprocessor** (`src/config/server-config.ts`) — strips `${...}` placeholder strings (injected by MCPB when no value is supplied) to `undefined` before the URL validator runs, preventing startup failures on optional URL fields.
- **`@duckdb/node-api`** ^1.5.3-r.1 → ^1.5.3-r.2.
- **`@biomejs/biome`** ^2.4.15 → ^2.4.16.

## Framework changes (0.9.7–0.9.13)

User-facing items from the adopted range:

- **`MCP_HTTP_MAX_BODY_BYTES`** (0.9.13) — configurable inbound request-body cap; oversized requests rejected with `413` before SDK parse. Default 1 MiB; `0` disables.
- **HTTP session-init gate** (0.9.10) — stateful HTTP mode rejects non-`initialize` requests without `Mcp-Session-Id` with `400`, preventing uninitialized sessions from being minted on first contact.
- **Quieter 401/403/400/404 logging** (0.9.10) — expected client errors now log at `warning` instead of full error pipeline with stack traces, reducing noise.
- **`GET /mcp` surfaces `package.json` keywords** (0.9.12) — `server.keywords` included in the HTTP status response alongside `name`, `version`, and `description`.