---
summary: "mcp-ts-core 0.10.6 adoption; bundle-content + identity packaging guards; in-code identity pinning; Dockerfile healthcheck"
breaking: false
security: false
---

# 0.4.12 — 2026-06-12

## Added

- **In-code identity** — `createApp()` now sets `name` and `title` explicitly to `openfec-mcp-server`, and `manifest.json` carries a matching `display_name`. Pins the unscoped repo name across registry, bundle, and client surfaces rather than relying on the npm-scoped `package.json` `name`.
- **`scripts/clean-mcpb.ts`** — post-pack MCPB cleaner wired into the `bundle` script: runs `mcpb clean` (dev-dependency prune) then strips dependency-shipped agent docs (`skills/`, `.claude/`, `.agents/`, `SKILL.md`) nested under `node_modules/` that root-anchored `.mcpbignore` patterns cannot reach.
- **`lint-packaging.ts` bundle-content + identity checks** — new checks 5–9: `.mcpbignore` must anchor root dev-dir patterns (an unanchored `skills/` also strips `node_modules/x/skills/`), must not strip critical runtime paths, a built `.mcpb` must contain zero `node_modules/**` agent-doc entries, and `name`/`title`/`display_name` must equal the unscoped package name.
- **`check-framework-antipatterns.ts` rule 4** — flags `z.coerce.boolean()` on env flags (`Boolean("false")` is `true`, so the variable can't be disabled via the environment); use `z.stringbool()`. Comment lines are skipped so docs naming an antipattern don't register as violations.
- **`Dockerfile` healthcheck** — bun-native `fetch` against `/healthz` (the slim image ships no curl/wget), plus an `APP_VERSION` build arg feeding the `org.opencontainers.image.version` OCI label.

## Changed

- **`server.json` `FEC_API_KEY` description** — trimmed to `optional (DEMO_KEY: 30 req/hr). Own key: 1000 req/hr. Free at api.data.gov.`

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.9.21 → ^0.10.6
- `@types/node` ^25.9.2 → ^25.9.3