---
summary: "census_resolve_geography auto-detects place/state before defaulting to county, fixing wrong-place results (#15) and blank-state ambiguous_name candidates (#18); mcp-ts-core ^0.10.9 → ^0.11.0 maintenance"
breaking: false
security: false
---

# 0.1.12 — 2026-07-31

## Fixed

- **`census_resolve_geography`**: bare city names and spelled-out state names no longer silently resolve to the wrong county. `detectGeographyTypes` replaces the single-guess heuristic with an ordered layer chain (state → county/tract keywords → place falling back to county), so `"Seattle, WA"` resolves to the place FIPS and `"Texas"` resolves to the state instead of Texas County, Oklahoma. ([#15](https://github.com/cyanheads/census-mcp-server/issues/15))
- **`census_resolve_geography`**: rows are now preferred by exact `NAME`/`BASENAME` match before falling back to raw `LIKE` results, so `"Kansas City, MO"` resolves to Kansas City instead of the first `LIKE` hit (North Kansas City).
- **`census_resolve_geography`**: `ambiguous_name` candidates carry a real `stateAbbr`, derived by reversing the state FIPS table instead of reading `STUSAB` (which the county/place/tract layers don't return) — candidates no longer render as `"Washington County, "` with an empty state. Ambiguity now fires on any 2+ surviving match rather than only past a threshold of three, and tract candidates report their county since tract names repeat within a state. ([#18](https://github.com/cyanheads/census-mcp-server/issues/18))
- **`census_resolve_geography`**: `ambiguous_name` now throws through the `validationError()` factory (wire code `-32007`) instead of a plain `Error` with `code: -32602`, matching the tool's declared error contract.

## Changed

- **`@cyanheads/mcp-ts-core` `^0.10.9` → `^0.11.0`** — nine framework releases: `z.stringbool()` for env booleans, `createApp()` identity fields (`name`/`title`), a `ctx.recoveryFor()` helper for wiring typed error recovery hints, and `ctx.state`/`ctx.elicit`/`ctx.enrich`/`ctx.content`/`ctx.progress` documented in CLAUDE.md/AGENTS.md.
- **`census-api-service.ts`**: reads the framework's canonical `data.status` instead of the deprecated `data.statusCode` alias when classifying an expected 404.
- **`bunfig.toml`**: adds `[install.security] scanner = "@socketsecurity/bun-security-scanner"` (install-time supply-chain scanning) and `minimumReleaseAge` — a 3-day hold on fresh package publishes, excluding `@cyanheads/mcp-ts-core`.
- **`Dockerfile`**: pins the base image to `oven/bun:1.3.14` instead of the floating `1.3` tag, runs installs with `--ignore-scripts`, and adds a BuildKit cache mount for Bun's package cache.
- **`scripts/clean-mcpb.ts`**: strips `@duckdb/node-bindings-*` platform-native entries from `.mcpb` bundles alongside the existing agent-doc strip, keeping bundles portable across platforms and under the registry size cap.
- **`scripts/check-dependency-specifiers.ts`**: now also scans `package.json` `overrides` for floating specifiers.
- **`scripts/devcheck.ts`**: the outdated-package check no longer flags `peerDependency` rows or versions held back by `minimumReleaseAge`.
- **`.gitignore`**: `data/` anchored to the repo root (`/data/`).
- Adds `.gitattributes` (LF normalization, binary asset list, linguist-generated markers) and `.github/SECURITY.md`.
- 33 `skills/` files re-synced to their upstream versions, including new `api-mirror` and `techniques` entries.

### Dependency bumps

- `@cyanheads/mcp-ts-core` `^0.10.9` → `^0.11.0`
- `typescript` `^6.0.3` → `^7.0.2`
- `@biomejs/biome` `^2.5.0` → `2.5.5`
- `@types/node` `^26.0.0` → `26.1.1`
- `ignore` `^7.0.5` → `^7.0.6`
- `tsc-alias` `^1.8.17` → `^1.9.1`
- `vitest` `^4.1.9` → `^4.1.10`
- `@socketsecurity/bun-security-scanner` (new) `^1.1.2`