---
summary: "mcp-ts-core ^0.9.6 → ^0.9.13: HTTP 413 body cap, session-init gate, quieter 401/403/400/404 logs, GET /mcp surfaces keywords; manifest metadata; dep refresh"
breaking: false
security: false
---

# 0.4.7 — 2026-05-28

## Added

- **`MCP_HTTP_MAX_BODY_BYTES`** — configurable inbound request-body cap (default 1 MiB); oversized HTTP requests rejected with 413 before body parsing. Documented in `.env.example`. Inherited from `@cyanheads/mcp-ts-core` 0.9.13.
- **`landing.requireAuth: false`** — explicitly opts the public hosted endpoint into serving the full tool/resource/prompt inventory without authentication (new `mcp-ts-core` 0.9.10 default gates inventory behind auth when `MCP_AUTH_MODE` is `jwt`/`oauth`).
- **`GET /mcp` keywords** — `package.json` keywords (`mcp-server`, `openfec`, `fec`, `campaign-finance`, etc.) now surfaced in the HTTP status response. Inherited from `@cyanheads/mcp-ts-core` 0.9.12.
- **`manifest.json`** — `repository`, `homepage`, and `license` fields added.
- **`package.json` keywords** — `bun`, `stdio`, `streamable-http` added.

## Changed

- **HTTP session-init gate** — stateful HTTP mode now rejects non-`initialize` requests arriving without `Mcp-Session-Id` with HTTP 400. Inherited from `@cyanheads/mcp-ts-core` 0.9.10.
- **Expected client error log levels** — 401, 403, 400, and 404 HTTP errors use `logger.warning` instead of the full error pipeline with stack traces, reducing noise in logs. Inherited from `@cyanheads/mcp-ts-core` 0.9.10.
- **Skills** — bulk refresh from framework 0.9.7–0.9.13: `git-wrapup`, `release-and-publish`, `api-canvas`, `api-config`, `design-mcp-server`, `polish-docs-meta`, `report-issue-framework`; `code-simplifier` and `git-wrapup` added; `migrate-mcp-ts-template` removed.

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.9.6 → ^0.9.13
- `@biomejs/biome` ^2.4.15 → ^2.4.16