---
summary: "@cyanheads/mcp-ts-core ^0.9.9 → ^0.9.13: HTTP body cap, session-init gate, quieter 4xx logs, GET /mcp keywords, MCPB placeholder fix"
breaking: false
security: false
---

# 0.1.9 — 2026-05-28

## Added

- **`MCP_HTTP_MAX_BODY_BYTES`** env var — inbound request-body cap (default 1 MiB); oversized bodies rejected with HTTP 413 before SDK parsing. Documented in `.env.example`. (via `@cyanheads/mcp-ts-core` ^0.9.13)
- **`GET /mcp` keywords** — `package.json` `keywords` now surfaced in the HTTP status response alongside name, version, and description. (via `@cyanheads/mcp-ts-core` ^0.9.12)
- **`.claude-plugin/`** and **`.codex-plugin/`** — plugin metadata files for Claude Code and Codex discovery.

## Changed

- **`landing.requireAuth: false`** — explicit opt-in to serve the full tool inventory on unauthenticated `GET /mcp` requests, consistent with this server's public-catalog posture. (via `@cyanheads/mcp-ts-core` ^0.9.13)
- **`CROSSREF_MAILTO` config** — `z.preprocess` strips MCPB `${user_config.X}` placeholder literals to `undefined` before `z.email()` validation, preventing startup crash on bundle install with blank optional field. `manifest.json` `user_config` entry gains `"default": ""`. (via `@cyanheads/mcp-ts-core` ^0.9.11)
- **HTTP session-init gate** — stateful HTTP sessions now reject non-`initialize` requests missing `Mcp-Session-Id` with HTTP 400. (via `@cyanheads/mcp-ts-core` ^0.9.10)
- **4xx log level** — expected client errors (400, 401, 403, 404) logged at `warning` instead of triggering full error pipeline with stack traces. (via `@cyanheads/mcp-ts-core` ^0.9.10)

## Dependency bumps

- `@cyanheads/mcp-ts-core` ^0.9.9 → ^0.9.13
- `@biomejs/biome` ^2.4.15 → ^2.4.16