---
summary: "Adopt @cyanheads/mcp-ts-core ^0.10.6, migrate boolean env flags to z.stringbool(), set explicit createApp identity, and harden MCPB bundle packaging"
breaking: false
security: false
---

# 0.7.4 — 2026-06-12

## Added

- **`createApp` identity** — `name` and `title` are now passed explicitly as `'brapi-mcp-server'` so the served `server_name` and display title are the unscoped machine name rather than the scoped npm package name.
- **`scripts/clean-mcpb.ts`** — post-pack bundle cleaner wired into the `bundle` script: runs `mcpb clean` (dev-dependency prune + manifest validation) then strips dependency-shipped agent-doc entries (`node_modules/**/skills/`, `.claude/`, `.agents/`, `SKILL.md`) that root-anchored `.mcpbignore` patterns cannot reach.
- **`lint-packaging` checks 5–9** — bundle-content guards (root dev dirs excluded, no unanchored `.mcpbignore` patterns stripping `node_modules/**` runtime paths, no critical runtime path stripped), a post-bundle scan asserting zero `node_modules` agent-doc entries in a built `.mcpb`, and an identity check that `createApp`/`createWorkerHandler` `name`/`title` and manifest `display_name` equal the unscoped package name.
- **`check-framework-antipatterns` rule 4** — flags `z.coerce.boolean()` on env flags (it can't be disabled via the environment, since `Boolean("false") === true`); comment lines are skipped so documenting the pattern doesn't self-trigger.
- **Dockerfile `APP_VERSION` + `HEALTHCHECK`** — build arg feeds `org.opencontainers.image.version`; a `HEALTHCHECK` polls the framework `/healthz` endpoint.

## Changed

- **Boolean env config** — `allowPrivateIps`, `enableWrites`, `canvasDropEnabled`, and `sessionIsolation` migrate from `z.enum(['true','false']).transform(...)` to `z.stringbool()`, which parses `true/false/1/0/yes/no/on/off` and rejects other values.
- **`.mcpbignore`** — root dev-dir patterns anchored with a leading `/` (`/.claude/`, `/skills/`, `/Dockerfile`, …) so they no longer also strip nested `node_modules/**` runtime paths; adds `/.agents/` and `/skills/`.
- **`.codex-plugin/plugin.json`** — `interface.displayName` set to the unscoped `brapi-mcp-server`; both plugin manifests resynced to the current package version.

## Dependencies

- **`@cyanheads/mcp-ts-core`** `^0.9.21` → `^0.10.6`
- **`@types/node`** `^25.9.1` → `^25.9.3`
- Transitive: `hono` `4.12.23` → `4.12.25`, `@modelcontextprotocol/ext-apps` `1.7.3` → `1.7.4`